Four Critical Cybersecurity Issues Facing State and Local Governments

Cybersecurity is the No. 1 strategic IT priority in 2015 for state and local government agencies, according to a recent report by the National Association of State CIOs.

President Obama’s most recent State of the Union address emphasized the criticality of cyberthreats and the federal government’s imperative to address them. His unprecedented call to action further highlights how pressing this problem has become across the country.

The data housed by state and local agencies is an attractive target for financially-motivated cybercriminals. Social Security numbers, credit card information, drivers license numbers, and tax information are just some of the sensitive data that hackers can use for financial gain and that can create financial havoc for citizens if compromised.

In addition, agencies have to worry about cyberattacks by politically motivated “hacktivists” and even the potential for highly sophisticated state-sponsored attacks (corporate and military espionage, disruption of utilities and infrastructure, etc.).

Unfortunately, IT organizations inside state and local agencies face four critical challenges to keeping their networks—and the data of the citizens they serve—secure against cyberthreats. The issues include:

1. Increasing complexity and intensity of cyberthreats
2. Funding for cybersecurity initiatives is insufficient
3. Lack of cybersecurity visibility and control
4. Maintaining compliance with a growing array of regulations

Let’s take a quick look at each.

1. Cyberthreats are increasing in complexity and intensity

At iSheriff, our cyberthreat lab is seeing rapid growth in the number of threats being released every day. For example, we have seen more than a quarter-million different ransomware variants over the past year with as many as 60,000 new variants in a single day.

Our team has been called into several local government agencies to assist with remediating these attacks.

Ransomware is an example of a large-scale cyberthreat that acts like a trawling net—casting broadly to snare as large a number of victims as possible in one attempt. These threats have become increasingly complex, conducted over multiple threat vectors in combination.

Although somewhat “vanilla” on the spectrum of cyberattack complexity, the results of such an attack can nevertheless be devastating. For example, because many organizations do not backup their data off-network, a ransomware attack can result in catastrophic loss of data.

At the other end of the cyberthreat spectrum are targeted threats, designed to attack a specific organization or even a specific individual within an organization.

Unlike a typical malware-based infection, targeted attacks are very difficult to block with traditional security products. A persistent adversary such as a “hacktivist," sophisticated cyber-criminal or even a state-sponsored actor will attempt to utilize techniques that “fly under the radar” in order to achieve their objectives.

2. Funding for cybersecurity initiatives is insufficient

The typical state or local government agency spends less than 5 percent of its IT budget on cybersecurity, compared to over 10 percent in the typical commercial enterprise.

If we bear in mind that some of the world’s most prominent enterprises have recently been successfully hacked, and that government agencies are faced with precisely the same security challenges as their commercial brethren, it becomes abundantly clear that state and local agencies’ cybersecurity efforts are woefully underfunded.

Unfortunately, state and local government has been let down by the security industry. Security has become too complex for the average agency—requiring multiple products from multiple vendors that not only don’t integrate but also require very expensive installation and ongoing management.

The typical agency doesn’t have the budget required to effectively deploy and maintain all the required components.

In addition to budgetary concerns, government agencies are faced with a security staffing and know-how problems. Given the rapid growth in cyber threats over the last few years, and the increasing corporate focus on addressing this problem, demand has created a substantial premium on cybersecurity skills.

Public sector organizations are hard-pressed to compete for talent, given the wide disparity in compensation levels.

3. Lack of cybersecurity visibility and control

One of the unfortunate byproducts of the proliferation of security point products within the IT environment is an avalanche of security events and alerts, making alert overload one of the banes of agency IT staffs’ existence. In fact a whole new category of products and services has grown up to attempt to bring order to this chaos (referred to as security information and event management or SIEM, for short).

However, managing security through alerts has been described as analogous to driving a car down a busy highway at night by looking through a frosted rear-view mirror: it is not only misleading, but is ultimately likely to end in disaster for all involved.

4. Need to comply with growing array of regulations

Federal and state government agencies have introduced an array of new regulations in an effort to enforce better levels of protection for citizen data and greater transparency when breaches occur. These include the FBI, IRS, HIPPA, OCSE, FSSA, and the NIST Cybersecurity Framework.

For small IT organizations with limited security expertise, enforcing compliance with these regulations can be an onerous level of additional overhead on top of their substantial core responsibilities.

The Answer Is in the Clouds

The benefits of more secure government agencies—from village to federal—are multifaceted. Defending our essential infrastructure and government services, our intellectual property and our citizens’ safety are of paramount importance.

The risks created by improperly protected government assets are enormous, urgent and mounting every day.  

In today’s rapidly evolving cyberthreat landscape, traditional security approaches are not sufficient or practical. IT teams don’t have the time or resources to address each threat vector in isolation, nor should they have to.

Integration, automation and flexibility are today’s security imperatives—required for effective defense against complex and proliferating threats. Comprehensive, scalable solutions help teams maximize their resources and staff efficiency, delivering higher value and better protection from limited budgets.

Agencies that do not have dedicated security personnel need a solution that is simple to set up, run and monitor with a “single-pane -of -glass” view across the agency’s network.

Multi-layered, cloud-based solutions are highly flexible and don’t require any upfront investment in hardware, software or professional installation. Comprehensive solutions cover email, web and endpoint threat vectors in combination, all within a single solution from a single vendor.

Often cloud-based solutions are priced per user, so the service scales efficiently with an agency’s needs—a blessing in itself when dealing with any bureaucratic procurement system.

Globally available protection and detection capabilities are constantly updated to cover ever-mutating malware and vulnerabilities and incorporate all the digital points and platforms through which agencies conduct business, including web sites, email, laptops, tablets, and smartphones.