3 ways agencies can restore cybersecurity trust

Government agencies have been unable to maintain trust in their cybersecurity capabilities this past year, and for good reason. The onset of the pandemic, followed by a year of tumultuous cyberattacks, has further damaged an IT infrastructure that had long been vulnerable to bad actors, nation-state and otherwise.

The perfect storm of pandemic-related events and vulnerable infrastructure has challenged federal, state and local governments. Not only did 2020 see a massive increase in data breaches, with the first quarter of the year showing a 278% increase in leaked government records, cyberattacks happened on a much larger scale, as seen with the SolarWinds hack that affected governments and businesses. These events have clearly shown that if governments continue relying on outdated and insufficient systems and protocols, the number of successful attacks will only grow in size and consequence.

Governments must seriously re-evaluate how to safeguard their data and valuable assets, for the protection of both their sensitive infrastructure and their employees. Fortunately, there are three steps that organizations can take to significantly decrease their chances of suffering a severe cyberattack in the near future.

1. Implement a security-first infrastructure

Unlike perimeter-based security, security-first infrastructure has the potential to be dynamic, flexible and effective in various scenarios. A foundational piece of a security-first infrastructure is zero trust, an IT methodology that always assumes that a threat can come from both outside and inside an organization’s network. Zero trust uses constant vigilance and verification to ensure all data, devices, applications and users can be trusted. It must be a given to ensure a security-first infrastructure, especially with remote workers. In fact, zero trust helped limit the severity of malware spreading across networks from the SolarWinds attack. A zero-trust infrastructure does have its challenges, such as migrating legacy applications and defining use cases, but these issues can be solved with an incremental yet consistent application of zero trust, as well as leadership setting and defining scope and expectations for choosing appropriate tools.

A security-first infrastructure also requires proper tools and platforms to enable its success. It’s important that organizations choose tools and platforms that are built on secure foundations specifically meant to protect sensitive and valuable information. This would include tools and software that implement out-of-band communications for data protection and provide end-to-end encryption (E2EE) across all collaboration platforms, including voice, video, messagin, and file sharing. The use of unauthorized tools should be strictly prohibited, as consumer-focused applications or shadow IT could result in major breaches of compliance policy.

After implementing zero trust and secure collaboration tools, agencies can then evaluate the rest of their practices and policies.

2. Eliminate BYOD

There’s no doubt that the shift to remote work blurred certain lines when it came to rebuilding the workplace at home. Although bring-your-own-device policies existed prior to the pandemic, personal devices had never been utilized to the extent that was required this past year. However, BYOD has become far too great of a security risk to continue as a common operating practice in 2021. Remote workers operate outside of standard-based protections, like firewalls and secure systems. This fact -- combined with a lack of secure infrastructure and proper cybersecurity training -- puts a massive target on the backs of employees and, in turn, on the whole agency.

What’s worse is that employees are usually working on unprotected home networks, and they may be more likely to use platforms or software that is not IT sanctioned, creating more unnecessary risk. Given that no one could have anticipated how long shelter-in-place mandates would last, BYOD seemed like a reasonable solution for a short period of time. Today, however, remote and hybrid work is how business gets done. The lack of secure devices and cybersecurity training, combined with outdated legacy systems, outweigh the temporary convenience that BYOD might bring.

We must look toward solutions that will allow employees to work securely from anywhere. Although sending government approved devices to each employee will be a heavy lift, we must prioritize security over short-term monetary savings -- security is not a corner that can be cut. There is nothing stopping bad actors from targeting individual government employees that have far lower standards for secure operations. Of course this type of initiative will take some time, so in the meantime, manual protections like implementing E2EE tools, regularly updating all software and clearing all mobile device data should help mitigate immediate severe risks.

3. Prioritize training

Once these glaring security risks have been addressed, rebuilding trust will be key to maintaining a security-first infrastructure that can withstand remote work and the coming cyber threats. Some governments have mandated cybersecurity training for all employees. In Texas, a law was passed that requires all government employees to complete an annual cybersecurity training program. This is a very productive step that re-instills the confidence in a government’s cybersecurity capabilities, and should be considered throughout all governments, both at the national and local levels.

It’s important to keep in mind that cybersecurity is not a silver bullet. Human error is inevitable, but the best outcome is an exponentially less vulnerable government. The solution not only includes phasing out BYOD -- and phasing in E2EE and zero trust -- but also prioritizing the knowledge and preparedness of all government employees.