sponsor content What's this?
3 Key Considerations for State and Local Cybersecurity
Presented by Carahsoft/Symantec
Steps state and local leaders can take to ensure they’re minimizing breaches and mitigating the ones that slip through
It’s no secret that cyberthreats everywhere are evolving, even at the state and local level. And while Congress is attempting to pass legislation that would provide federal resources to municipal governments, state and local agencies cannot afford to wait on this crucial issue. They must educate and take protective steps themselves.
And they are — more than half of state and local governments have made viable investments in security technology, incident detection and response initiatives. Just as at the federal level, the CISO role needs to become stronger at the state and local level.
Although these steps are important, it is crystal-clear that a lot more work needs to be done. Here are three key areas that state and local governments should focus attention on when developing their cyber strategies.
Prevention
The most obvious defense against a breach is securing the network’s perimeter. Agencies can proactively detect threats through granular systems monitoring, regularly scheduled risk assessments and system oversight that is targeted to vulnerable areas.
In addition to monitoring data traffic within a network, agencies can stave off bad entities by adopting a defense-in-depth approach to security, says Robert Myles, North American state and local government practice manager at Symantec. Defense-in-depth is the idea that agencies are most secure with several layers of defense technology implemented throughout their systems. From firewalls to biometric authentication, doubling down preventative efforts will help networks hold their own against outside threats.
Response
Organizations must recognize that even the strongest defenses are not panacea, and they are still potentially liable to be breached. This makes incident response another key consideration in the event of an attack, Myles says. Retainer services, cyber insurance and breach response plans are the tools state and local agencies should develop to ensure preparedness.
Encrypting data from the start is another tactic Myles recommends — even if bad actors gain access to the data, it will remain secure.
Personnel
Beware the insider threat — accidental or otherwise. Symantec’s Government 2016 Internet Security Threat Report found that close to two-thirds of exposed identities came from negligence on behalf of government employees. To combat this effect, state and local agencies must increase emphasis on comprehensive cyber literacy and training across enterprises. Training in everything from threat prevention to breach preparedness is now essential.
“From a state perspective, the number one spend should be on employee training,” Myles says.
But where do agencies start on their journey to greater cybersecurity? Myles and other experts at Symantec have helped organizations get a leg up on this complex issue with a cloud-hosted cyberthreat intelligence platform called DeepSight.
DeepSight plays into the philosophy that prevention is the best initial defense. With technical and adversary intelligence aggregated from the big data stores of both Managed Adversary and Threat Intelligence (MATI) and Directed Threat Research, the program provides agencies with the power to know the details of what threats are out there and how to arm against them.
Going forward, agencies should look to available expertise for needed improvements, adhere to federal standards like the National Institute of Science and Technology’s Cybersecurity Framework and continue to monitor and assess their capabilities regularly. These steps, plus the considerations above, are the best ways for state and local organizations to protect their networks and their data.
For more information on state and local cybersecurity, check out this issue brief from Government Business Council.
This content is made possible by our sponsor. The editorial staff of Route Fifty was not involved in its preparation.
NEXT STORY: 5 Keys to Digital Services Transformation