Cybersecurity for Government: Lessons from the Front Line
During the time it takes you to read this article, somewhere in the United States, a governmental entity will probably be the victim of a cyber-attack. This article highlights the areas that are most impactful, based on experience in dealing with cyber-attacks against governmental entities.
October 12, 2018 at 12:00 PM
8 minute read
This article appeared in Cybersecurity Law & Strategy, an ALM publication for privacy and security professionals, Chief Information Security Officers, Chief Information Officers, Chief Technology Officers, Corporate Counsel, Internet and Tech Practitioners, In-House Counsel. Visit the website to learn more.
During the time it takes you to read this article, somewhere in the United States, a governmental entity will probably be the victim of a cyber-attack. Whether on telephone systems, voter rolls, customer service facilities or infrastructure, cyber-attacks against governmental entities are becoming more commonplace and, increasingly, more destructive.
As bad actors realize that corporations have beefed up their security and resilience against cyber-attacks, criminals have begun to focus on governmental entities, which are often less prepared and more vulnerable than their corporate brethren.
Realizing that governments serve many purposes for their citizens, it is often difficult to fully understand the scope of the possible vectors that are vulnerable to cyber-attack. Governments must place cybersecurity on their lists of priorities for funding, often competing for attention with schools, police and public safety, sanitation, parks, roads and water delivery. It is against this list of fundamental priorities that governments have often placed cybersecurity on the back burner.
That said, given the destructive nature of current attacks, governments across the country are reprioritizing and devoting more resources to cybersecurity. Recent attacks in Colorado, Georgia, Texas and many other jurisdictions underscore the necessity for governments to take a proactive stance toward cybersecurity awareness, training, infrastructure and funding.
There are many things that governmental entities should do in this increasingly dangerous data-driven world to ensure cybersecurity. This article highlights the areas that are most impactful, based on experience in dealing with both large and small cyber-attacks against governments and governmental entities.
This list is by no means exhaustive, and true cyber preparedness is an involved process that should be viewed as a marathon and not a sprint.
|Policies and Procedures
Perhaps the first step in cyber preparedness is to understand what you should be doing, when and how. Central to this is the development of policies, plans and procedures with respect to cyber preparedness.
I often recommend to governmental entities that they have a cyber preparedness assessment performed. This assessment will look at the entity's current state of preparedness and identify potential vulnerabilities. A good assessment will also review the entity's current policies and procedures, and cyber incident response plan — if there is one.
Speaking of response, all governmental entities should have a cyber plan in place. This dictates step-by-step instructions to employees in the event of a cyber-attack. Tabletop exercises are a valuable tool designed to stress test the cyber preparedness plan. These simulate an attack and give employees the ability to practice responding to a mock attack before it happens.
As anyone who has ever served in the military will tell you, the best time to figure out how you would react to live gunfire is not on the battlefield with bullets whizzing by your head.
|Physical and Environmental Security
Governments should always understand where their IT infrastructure is located and the security around it. Often, networks are built piece-by-piece over the years, with elements of these networks often housed in various buildings and rooms.
In major cities and state governments, these infrastructure pieces may be miles apart and nowhere near each other. In many cases, almost no one within an organization truly knows the full scope of what physical assets are deployed on their network, let alone its architecture.
As such, a map of your network infrastructure and architecture is essential to both securing the network and to any type of response during an attack.
Once you know where your infrastructure is located, you should go about making sure that those locations are secure. Only those employees with the proper credentials should be allowed physical and virtual access to your IT infrastructure. Additionally, you should remember that vendor access should be strictly controlled.
|Personnel
Despite all of the threats that occur against your network and IT infrastructure, employees are still the most used vector to attack an entity and are the biggest vulnerability.
Whether it is an employee clicking on a link to a malicious website, putting an infected thumb drive into a computer or becoming a victim of more advanced phishing techniques, employees provide the quickest and most expedient route to your network.
As such, you must make certain that employees only have access to the information and network areas that are needed to perform their job functions. Ongoing training for employees around cybersecurity and cyber awareness is a must. You should strive to create a “culture of security.”
At the end of the day, regardless of how much you spend on infrastructure security, if your employees click on a malicious or infected link, your investment might be for naught.
|Disaster Recovery and Business Continuity
Most governmental entities have disaster recovery plans in the event of a natural disaster or a major incident such as a terrorist attack. However, most of these plans do not take into account any type of cyber-attack or cyber incident.
From a disaster recovery and business continuity standpoint, responding to a cyber-attack can be dramatically different than responding to a natural disaster, criminal incident or attack.
For example, in many cyber events, outside resources will need to be quickly called upon and put into play. If these resources have not been identified prior to an incident, you will find yourself trying to locate the necessary resources instead of responding to the attack. Like most things, the quicker you can address the problem, the better the outcome will usually be.
To this end, governments should retain the necessary guidance and experience in order to make certain that their disaster recovery and business continuity plans take cyber preparedness into account.
In my experience, many municipalities don't realize the scope and breadth of their systems. Whether it is call centers to assist constituents, the judicial system, delivery of water services, sanitation, public works or police and other public safety services, almost all services provided by governments are connected through IT systems. An attack on these systems has shown the ability to shut down these essential services.
Lastly, make certain that you understand the processes that each department uses to deliver its services. In a catastrophic attack, you might have to implement manual processes to continue the delivery of essential services until you get your systems back up and running.
Again, these processes should be discussed before an attack takes place.
|Back-up, Back-up, Back-up
Perhaps the greatest resilience tool for a government is an adequate, safe and secure backup of its data.
In the event of a major cyber or ransomware attack, the ability to quickly and safely restore data will be the difference between being down for a few hours or down for weeks — or longer). Backups should generally be housed off-site in a secure facility.
I have seen backups that have been infected in attacks as well as backup plans that are not comprehensive. In the event of an attack, both will severely limit your ability to provide essential services to your constituents without interruption.
|Conclusion
In short, the ability of a government to respond to a cyber-attack, as well as its ability to be resilient to an attack in the first place, depends upon proper planning.
While these insights are not comprehensive, they outline some basic steps that should be taken prior to a cyber-attack.
Due to the increasing connectivity of our world, cybersecurity now touches all aspects of governmental services. While governments must prioritize their spending and budget items, cybersecurity must also be a higher priority than it has been in the past.
Roy E. Hadley, Jr. is an attorney with Adams and Reese (Atlanta) who serves as independent counsel to companies, governments, and boards on cyber matters, helping them understand and mitigate legal risks and exposures to protect themselves and those they serve. He has previously served in the corporate roles of general counsel and chief privacy officer, as well as special counsel to the president of the American Bar Association and special assistant attorney general for the state of Georgia. He may be reached at [email protected].
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllCalifornia Becomes 2nd State to Give Brain Waves Data Privacy Protections, With Mixed Reaction
Former FBI Cyber Expert on How AI Will Exacerbate Law Firms' Wire Transfer Vulnerabilities
Trending Stories
Who Got The Work
Clark Hill members Vincent Roskovensky and Kevin B. Watson have entered appearances for Architectural Steel and Associated Products in a pending environmental lawsuit. The complaint, filed Aug. 27 in Pennsylvania Eastern District Court by Brodsky & Smith on behalf of Hung Trinh, accuses the defendant of discharging polluted stormwater from its steel facility without a permit in violation of the Clean Water Act. The case, assigned to U.S. District Judge Gerald J. Pappert, is 2:24-cv-04490, Trinh v. Architectural Steel And Associated Products, Inc.
Who Got The Work
Michael R. Yellin of Cole Schotz has entered an appearance for S2 d/b/a the Shoe Surgeon, Dominic Chambrone a/k/a Dominic Ciambrone and other defendants in a pending trademark infringement lawsuit. The case, filed July 15 in New York Southern District Court by DLA Piper on behalf of Nike, seeks to enjoin Ciambrone and the other defendants in their attempts to build an 'entire multifaceted' retail empire through their unauthorized use of Nike’s trademark rights. The case, assigned to U.S. District Judge Naomi Reice Buchwald, is 1:24-cv-05307, Nike Inc. v. S2, Inc. et al.
Who Got The Work
Sullivan & Cromwell partner Adam S. Paris has entered an appearance for Orthofix Medical in a pending securities class action arising from a proposed acquisition of SeaSpine by Orthofix. The suit, filed Sept. 6 in California Southern District Court, by Girard Sharp and the Hall Firm, contends that the offering materials and related oral communications contained untrue statements of material fact. According to the complaint, the defendants made a series of misrepresentations about Orthofix’s disclosure controls and internal controls over financial reporting and ethical compliance. The case, assigned to U.S. District Judge Linda Lopez, is 3:24-cv-01593, O'Hara v. Orthofix Medical Inc. et al.
Who Got The Work
Attorneys from Cadwalader, Wickersham & Taft and Pryor Cashman have entered appearances for Diageo Americas Supply d/b/a Ciroc Distilling Co. and Sony Songs, a division of Sony Music Publishing, respectively, in a pending lawsuit. The case was filed Sept. 10 in New York Southern District Court by the Bloom Firm and IP Legal Studio on behalf of Dawn Angelique Richard. The plaintiff, who performed as a member of producer Sean 'Diddy' Combs girl group Danity Kane and later his band, Diddy - Dirty Money, claims that she was financially exploited by Combs and subjected to inhumane working conditions. Among other violations, Richard claims that Combs required group members to remain at his residences and studios, deprived them of adequate food and sleep and forced them to rehearse for 36 to 48 hours without breaks. The case, assigned to U.S. District Judge Katherine Polk Failla, is 1:24-cv-06848, Richard v. Combs et al.
Who Got The Work
Mathilda McGee-Tubb and Kevin M. McGinty of Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, as well as Jesse W. Belcher-Timme of Doherty, Wallace, Pillsbury & Murphy, have stepped in to defend Peter Pan Bus Lines in a pending consumer class action. The suit, filed Sept. 4 in Massachusetts District Court by Hackett Feinberg PC and KalielGold PLLC, accuses the defendant of charging undisclosed 'junk fees' on top of ticket prices during checkout. The case, assigned to U.S. District Judge Mark G. Mastroianni, is 3:24-cv-12277, Mulani et al v. Peter Pan Bus Lines, Inc.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250