Why Neighboring States and Localities Should Collaborate on Cybersecurity

State and local governments are slated to receive $1 billion in cyber funding through the Infrastructure Investment and Jobs Act. Resource-rich jurisdictions will be sure to secure funding quickly compared to those with time and staffing limitations, and this ultimately will lead to an unequal dispersal of funds. The result is state and local governments will end up coordinating across a spectrum of cyber maturity, which will put everyone at greater risk for cyberattacks.

To have a more secure cyber ecosystem across state and local governments, neighboring localities need to work together -- even as far as reaching across state lines -- to have a shared response and protocol for cyber incidents.

Interconnected Infrastructure

One major challenge governments face is integrating cybersecurity across multiple networks such as highways and railways that often span counties and even states. A similar issue also arises between vertical sectors of critical infrastructure such as an energy grid and water system. The differences between these networks opens opportunities for attack.

This in turn creates a ripple effect, where one vulnerability could bleed into another leaving government officials with a much larger problem than there was to begin with. Fortunately, these situations can be mitigated with proper planning.

In a recent string of cyberattacks affecting multiple Colorado communities, local government websites were targeted by ransomware that shut down government services. Fortunately, Colorado implemented a “whole state” approach to cybersecurity in 2021, allowing the state government to help mitigate cyberattacks and provide resources to localities affected. Colorado had relied on a decentralized approach to cybersecurity that left smaller cities and counties without the resources they needed to deter hackers and quickly respond to outages. But the new “all-hands on deck” mentality allows Colorado to combine every local, state and federal resource available to fight cybercrime.

A Coordinated Response

To replicate this solution, each jurisdiction should work in conjunction with its neighbors -- bordering states and localities  -- to have the same level of cybersecurity and protocol for responses to cyber incidents.

A successful joint cybersecurity posture across overlapping networks and critical infrastructure begins with a shared response protocol. These efforts should start with preparation before an attack occurs.

Agencies should utilize tools such as security information and event management (SIEM) and security orchestration automation and response (SOAR), which are recommended by the Cybersecurity and Infrastructure Security Agency. By using these universal approaches to aggregate data, organizations can discover tools and response protocols built by others, avoiding the need to build solutions from scratch.

As threat data is collected, agencies can also use SIEM and SOAR tools to generate a response that can be used by a range of security products, services and providers. This gives organizations interoperability and a degree of collective security without requiring them to build integration manually.

The Human Element

As important as it is to have a solid plan and tools, it means little without execution. To ensure a coordinated response in action, cybersecurity personnel must be adequately trained. This is challenging even within a single organization since security professionals on a team usually have varied levels of skills and experience. Agencies typically try to level-set through so-called security operation enters (SOCs) by providing baseline training and implementing standard operating procedures and templates for threat reporting.

But beware: Federating security -- a model in which a number of separate networks or locations share information to generate a common operating picture across SOCs -- creates an additional challenge. Even more than individual team members, organizations are often at different levels of capability and frequently have unique missions that drive their security requirements. Typically, no one in these federated groups has directive authority or resource control over the other members, so trying to forge a common approach is more akin to herding cats than to classic program management.

A Shared Vision

The $1 billion in funding coming through the Infrastructure Investment and Jobs Act will undoubtedly bring some relief to chronically underfunded state and local government cybersecurity programs. But these grants require applicants to demonstrate that they have state cybersecurity strategies and a cybersecurity planning committee to facilitate coordination within their state. There is also a requirement for recipients to partially match the federal funds received. Fortunately, this last requirement is waived if jurisdictions are pursuing multistate efforts with the funds to create a much-needed incentive for cross-border partnerships.

Effectively integrating critical infrastructure between geographical borders or levels of government can be a massive undertaking, especially for jurisdictions that don’t have the personnel or resources. Focus on what can be controlled -- such as building a common operating picture of threats and having a shared approach or toolkit for securing networks, along with shared response plans for cyber incidents. These are key to having stronger, safer critical infrastructure and to federating cybersecurity across jurisdictions and critical infrastructure sectors.