Survey: Many State and Local Governments Stuck in ‘Reactive Mode’ for IT Security Threats
wk1003mike / Shutterstock.com
Connecting state and local government leaders
Even with limited budgets and challenges retaining talent, there are ways to move into an ‘active defense posture.’
When it comes to IT criticism, the federal government can be an easy target.
However, a recent nationwide survey indicates IT challenges are even greater at the state and local level as those governments struggle to keep up with IT security threats and compliance issues.
According to the study, conducted by Dell Software, nearly 60 percent of all state and local governments are operating in a “reactive mode” when it comes to these issues.
“It’s pretty much everybody. Everyone has to deal with security in a reactive mode,” Paul Christman, vice president for public sector for Dell Software, said in an interview. “If all you do is trap the problems that are known by your technology vendor of choice, you’re stuck in a passive defensive posture of patching and being reactive to unknown threats.”
Sixty-one percent of respondents in the survey said budgetary limitations are the primary setback standing the way of state and local governments coming into compliance with federal standards such as the Payment Card Industry Data Security Standard (PCI DSS), the Health Insurance Portability and Accountability Act (HIPAA) or the Federal Information Security Management Act (FISMA). However, Christman said smaller governments also face a daunting challenge of recruiting and holding onto IT talent, an argument bolstered by 53 percent of respondents who cited “limited manpower” as their top obstacle in confronting IT challenges.
“The first task for local governments is the inability to recruit, retain and train cyber security specialists,” Christman said. “They can’t compete with the straight up salary of private companies.”
Christman offered three best practices suggestions for state and local governments operating with limited budget and manpower that he says can help shift toward what he described as an “active defensive posture.”
Unified Endpoint Management: “If you have to choose just one area before conducting a risk assessment plan, it should be endpoint management,” he said. “You can do unified endpoint management now fairly easily with laptops and mobile devices. Are the operating systems patched? Simply providing that level of endpoint management is enormously effective.”
Two-Factor Authentication: Also known as Multi-Factor Authentication, this process requires users to present a combination of security passes before accessing a protected system or database. For example, instead of just using a name and password, a two-factor authentication would also require the user to offer a security badge, credit card or form of biometric identification to obtain access. “The thing that two factor gets you to is to simply stop relying on user names and passwords,” Christman said.
Privileged User Account Management: Simply put, this practice limits the ability of one user to endanger the integrity of an entire secured system. When a team of users freely shares system administrator access passwords, there’s no way to keep track of who is accessing the system and for what purposes. In the case of an honest mistake, a password might be misplaced or stolen by someone outside the organization. Or, in a scenario where someone has malicious intent, a user could access the system for destructive purposes and walk away undetected until after the damage has been done. But if passwords and kept to specific users and for set periods of time, organizations can track who specifically accessed a database or system and what they accessed it for.
“They have to surrender a bit of autonomy in trade for elevated security,” Christman said. “But it’s just straight up good tech hygiene. It addresses everything that’s bad about only relying on simple passwords. We should say just because you’re a super user doesn’t mean you have access to everything. All of your activity is logged. And that unique ID goes away after a few hours.”
Based on the survey results, it appears that changing attitudes about IT best practices at the state and local level is nearly as important as having a healthy IT budget. Just 41 percent of respondents said they feel equipped to proactively fix security issues and address compliance requirements before they become problematic. Building and retaining talent is another issue that may simply not be attainable in the foreseeable future as well.
For governments that know they need help but can’t build a massive, physical IT infrastructure, companies like Dell, Microsoft and others offer a number of services including security and database management. “From a talent perspective it’s better to rent than own. It’s not something the smaller companies or organizations can do on their own,” Christman said.
“What we’re doing now is moving into the idea of understanding user behavior on the network and intervening before something happens,” he said. “We’ll investigate when see things that look bad. For example, we’ll note behaviors and activities within the network, compare them to normal activity and then dispatch people to investigate.”