Despite Increased Awareness, Cybersecurity Challenges Persist For State and Local Governments
mai.bond007 / Shutterstock.com
Translating technical language and developing staff were among the key difficulties described by security professionals speaking in Washington, D.C. on Wednesday.
When Michael Roling took over as the state of Missouri’s chief information security officer about six years ago, he didn’t have much to work with.
“I had no budget and four staff,” he said.
That’s changed now.
These days, Roling’s office has 12 employees and about $6 million in annual funding. “We got there by selling the story,” he explained at an event in Washington, D.C. on Wednesday. That sales pitch took place in late 2012 and early 2013 and involved making a clear case to the state legislature about the cyber-risks Missouri faced. It resulted in a new budget line item for cybersecurity.
But there’s more than just new-hires and additional cash behind the Show Me State’s evolving approach to securing its computer systems.
“I’ve seen this change in security culture,” Roling said. “From one where it was present, but not necessarily the most important thing we can do. To today, where it’s discussed in the boardrooms, it’s discussed between developers, it’s discussed between administrative assistants. That’s been huge.” He added: “It is baked into everything that we do.”
Roling was among the participants taking part in a panel discussion that focused on how cybersecurity programs in state and local government and education systems are maturing. It was held at this week's FireEye Cyber Defense Summit.
The panelists generally acknowledged that awareness of cyber-threats was growing within the organizations they work with.
But they also touched on some of the hurdles that they continue to encounter.
Communicating risk was a top challenge highlighted by Dave Weinstein, director of cybersecurity for the New Jersey Office of Homeland Security and Preparedness. The office provides intelligence on cyber-threats to a range of organizations that span the private sector, law enforcement and state government. Presenting this information in a way that is useable, and which can help these organizations take action to combat threats, isn’t always easy.
“Translating the ones and zeros into nouns, adjectives and verbs, so to speak, is always a challenge at the state level,” he said.
William Perry, chief information security officer for the California State University Chancellor's Office, said as cyber-threats have changed, money has flowed more freely for one-time technology purchases. But taking full advantage of new investments can be hard when “you don’t have the year-over-year income to hire the staff.”
And even when the money for staff is available, government salaries are typically not on par with what the private sector can offer.
“The Chicago market is really hot for security, and I can in no way, shape or form pay anything near the private industry,” said Ricardo Lafosse, chief information security officer for Cook County, Illinois, where Chicago is located.
To recruit staff, Lafosse said his office emphasizes the different types of technologies that people will be exposed to and what they’ll be able to learn on the job.
Freud Alexandre, enterprise architect and security manager for the city of New Orleans, has also experienced some struggles on the staffing front.
“We need to do a better job of developing people,” he said, “Training more people to be the analysts, the project managers in the security office, to grow the program a little bit better.”
In terms of cybersecurity vulnerabilities, Missouri’s Roling pointed to a lack of awareness about threats on the part of state employees. “Our biggest challenge has been securing the human,” he said. “They are not always the most receptive when it comes to awareness. They do not necessarily know what’s right and what’s wrong.”
There are also instances when cybersecurity troubles for state and local governments can materialize in unexpected ways.
When a white police officer shot and killed an unarmed black teenager in the St. Louis suburb of Ferguson, Missouri last year, the unrest and protests that followed the incident were accompanied by cyberattacks against the state, according to Roling. “It tested our tools,” he said. “It validated the direction we were going. But it also showed some of the shortcomings.”
Bill Lucia is a Reporter for Government Executive’s Route Fifty.
NEXT STORY: Campaign Finance Transparency Already Getting an Update in Illinois