In this first of a 4 part series examining the escalating threat from nation state cybercriminals towards state & local governments and the safe haven of migration to the cloud, we examine the severity and sophistication of the current cybercrime landscape and the specifics factors that render government agencies increasingly vulnerable to cyberattacks.
Why State & Local Governments are the Front Lines in the Escalating Cyber War
Nearly half of local governments are experiencing daily cyberattacks and both the frequency and severity of these attacks are escalating. Of equal concern, according to a nationwide survey of local government cybersecurity officials, 58.4% of local governments are unable to even determine who is attacking their systems!
These findings underscore a growing and potentially catastrophic issue impacting state and local governments: the ever-increasing sophistication of cybercrime syndicates vs. the constrained budgets and skills shortage of conventional government cybersecurity operations.
Recent reports by CBS’ 60 Minutes and The Register reveal that cyberthreats have malevolently evolved from the isolated actions of disenfranchised ‘hackers’ into sophisticated criminal and intelligence gathering syndicates, many of which are allegedly sanctioned by nation states using criminal groups as proxies. In terms of intelligence gathering, state and local government agencies represent particularly fertile hunting grounds for these ‘cyber mafias’ with large population databases sufficient to facilitate comprehensive identity theft and social engineering profiles. In fact, a 2016 report from CyberRisk monitor BitInsights confirmed that government agencies are the second most frequent target of ransomware attacks, second only to our resource constrained and vulnerable academic institutions.
So, why are government agencies especially vulnerable to these attacks, and what can be done to stymie these cyber extortionists? Let’s start with a summary of the root causes:
Why State & Local Governments are Increasingly Vulnerable to Cyberattacks
Lack of dedicated budget resources for cybersecurity limits both the human and technical resources required for government agencies to properly defend both systems and data against deep pocket cyber syndicates. A 2018 Deloitte-NASCIO Cybersecurity Study of State Chief Information Security Officers cites a lack of sufficient cybersecurity budget as the top barrier in addressing cybersecurity challenges. Across State IT budgets, enterprise cybersecurity receives a mere 1-2 percent of fund allocation with almost half of all states lacking even a dedicated budget line item for cybersecurity.
Given the rapid escalation of the threat, there is a substantial shortage of qualified cybersecurity personnel available to lead the defense. Competition for experienced talent is particularly intense amongst the financial sector, private sector tech, and national security organizations, relegating state and local government agencies far behind the pack in the race to recruit qualified cybersecurity workers. 71% of State CIOs surveyed by NAISCO confirm an inability to attract and retain top-tier security and privacy talent as their second biggest barrier in addressing cybersecurity impacts, second only to the increasing sophistication of the threats (82%).
The increased sophistication of cyberattacks consistently stands out as the most worrisome factor for state & local governments looking to effectively marshal their defenses against an arsenal of threats that include ransomware, hacktivism, phishing, DDOS attacks, and more—all disguised within an ever-evolving array of delivery models and concealment tactics. To drive the exponential growth of these ‘cyber mafias’ and thus expand the global reach of their attacks, cybercriminals are now utilizing the dark web to distribute ‘packaged’ attacks that are easily deployed by less experienced hackers; incentivizing global participation in coordinated attacks via an extortionist ‘gig economy.’
61% of states do not have a program for managing privacy compliance and 54% do not have a formal process in place to deal with information privacy complaints. (Source) Strict adherence to privacy compliance best practices, including formal policies on the destruction of personal information, is a core pillar in the defense against ‘big data’ cyberattacks.
Growing citizen demands for increased data transparency, 24/7 service delivery, and multichannel service accessibility creates a cyberthreat Catch 22—the more that data is made accessible to citizens; the more potentially vulnerable this data is to prospective cybercriminals.
Government agencies overly reliant on older legacy systems invite the increased potential for cyberattacks, with older technologies often lacking both the platform sophistication and ongoing threat assessment support required to stay one step ahead of state sponsored cyber syndicates.
The sheer frequency of threat responses demanded by the current reality of daily cyberattacks puts government network security teams on the back foot, with current threat monitoring dominating time and resources. This leaves scant resources for the more proactive work of data loss prevention, regulatory compliance, risk management, and other equally crucial security duties.
While outsourcing has proven effective in mitigating many of the factors articulated above, more than half of US states have yet to outsource crucial cybersecurity functions.
If this sounds dire, it should. The threat is real, severe, and the urgency to deal with it is increasing with each passing day.
The good news is, there is a solution to each-and-every one of the cybersecurity challenges mentioned above that are currently threatening our state and local government agencies.
In the next article in this series, we’ll show you that solution. More importantly, we’ll show you how your government agency can easily plot a path to this more secure, safe and sustainable solution. The best news of all? It’s more cost effective and cost sustainable than the current model.
Looking for more information? Subscribe to our CX blog below to stay in the loop on the latest news, best practices and emerging trends in government technology.
