Cybersecurity for Government: Lessons from the Front Line

This article appeared in Cybersecurity Law & Strategy, an ALM publication for privacy and security professionals, Chief Information Security Officers, Chief Information Officers, Chief Technology Officers, Corporate Counsel, Internet and Tech Practitioners, In-House Counsel. Visit the website to learn more.

During the time it takes you to read this article, somewhere in the United States, a governmental entity will probably be the victim of a cyber-attack. Whether on telephone systems, voter rolls, customer service facilities or infrastructure, cyber-attacks against governmental entities are becoming more commonplace and, increasingly, more destructive.

As bad actors realize that corporations have beefed up their security and resilience against cyber-attacks, criminals have begun to focus on governmental entities, which are often less prepared and more vulnerable than their corporate brethren.

Realizing that governments serve many purposes for their citizens, it is often difficult to fully understand the scope of the possible vectors that are vulnerable to cyber-attack. Governments must place cybersecurity on their lists of priorities for funding, often competing for attention with schools, police and public safety, sanitation, parks, roads and water delivery. It is against this list of fundamental priorities that governments have often placed cybersecurity on the back burner.

That said, given the destructive nature of current attacks, governments across the country are reprioritizing and devoting more resources to cybersecurity. Recent attacks in Colorado, Georgia, Texas and many other jurisdictions underscore the necessity for governments to take a proactive stance toward cybersecurity awareness, training, infrastructure and funding.

There are many things that governmental entities should do in this increasingly dangerous data-driven world to ensure cybersecurity. This article highlights the areas that are most impactful, based on experience in dealing with both large and small cyber-attacks against governments and governmental entities.

This list is by no means exhaustive, and true cyber preparedness is an involved process that should be viewed as a marathon and not a sprint.

Policies and Procedures

Perhaps the first step in cyber preparedness is to understand what you should be doing, when and how. Central to this is the development of policies, plans and procedures with respect to cyber preparedness.

I often recommend to governmental entities that they have a cyber preparedness assessment performed. This assessment will look at the entity's current state of preparedness and identify potential vulnerabilities. A good assessment will also review the entity's current policies and procedures, and cyber incident response plan — if there is one.

Speaking of response, all governmental entities should have a cyber plan in place. This dictates step-by-step instructions to employees in the event of a cyber-attack. Tabletop exercises are a valuable tool designed to stress test the cyber preparedness plan. These simulate an attack and give employees the ability to practice responding to a mock attack before it happens.

As anyone who has ever served in the military will tell you, the best time to figure out how you would react to live gunfire is not on the battlefield with bullets whizzing by your head.

Physical and Environmental Security

Governments should always understand where their IT infrastructure is located and the security around it. Often, networks are built piece-by-piece over the years, with elements of these networks often housed in various buildings and rooms.

In major cities and state governments, these infrastructure pieces may be miles apart and nowhere near each other. In many cases, almost no one within an organization truly knows the full scope of what physical assets are deployed on their network, let alone its architecture.

As such, a map of your network infrastructure and architecture is essential to both securing the network and to any type of response during an attack.

Once you know where your infrastructure is located, you should go about making sure that those locations are secure. Only those employees with the proper credentials should be allowed physical and virtual access to your IT infrastructure. Additionally, you should remember that vendor access should be strictly controlled.

Personnel

Despite all of the threats that occur against your network and IT infrastructure, employees are still the most used vector to attack an entity and are the biggest vulnerability.

Whether it is an employee clicking on a link to a malicious website, putting an infected thumb drive into a computer or becoming a victim of more advanced phishing techniques, employees provide the quickest and most expedient route to your network.

As such, you must make certain that employees only have access to the information and network areas that are needed to perform their job functions. Ongoing training for employees around cybersecurity and cyber awareness is a must. You should strive to create a “culture of security.”

At the end of the day, regardless of how much you spend on infrastructure security, if your employees click on a malicious or infected link, your investment might be for naught.

Disaster Recovery and Business Continuity

Most governmental entities have disaster recovery plans in the event of a natural disaster or a major incident such as a terrorist attack. However, most of these plans do not take into account any type of cyber-attack or cyber incident.

From a disaster recovery and business continuity standpoint, responding to a cyber-attack can be dramatically different than responding to a natural disaster, criminal incident or attack.

For example, in many cyber events, outside resources will need to be quickly called upon and put into play. If these resources have not been identified prior to an incident, you will find yourself trying to locate the necessary resources instead of responding to the attack. Like most things, the quicker you can address the problem, the better the outcome will usually be.

To this end, governments should retain the necessary guidance and experience in order to make certain that their disaster recovery and business continuity plans take cyber preparedness into account.

In my experience, many municipalities don't realize the scope and breadth of their systems. Whether it is call centers to assist constituents, the judicial system, delivery of water services, sanitation, public works or police and other public safety services, almost all services provided by governments are connected through IT systems. An attack on these systems has shown the ability to shut down these essential services.

Lastly, make certain that you understand the processes that each department uses to deliver its services. In a catastrophic attack, you might have to implement manual processes to continue the delivery of essential services until you get your systems back up and running.

Again, these processes should be discussed before an attack takes place.

Back-up, Back-up, Back-up

Perhaps the greatest resilience tool for a government is an adequate, safe and secure backup of its data.

In the event of a major cyber or ransomware attack, the ability to quickly and safely restore data will be the difference between being down for a few hours or down for weeks — or longer). Backups should generally be housed off-site in a secure facility.

I have seen backups that have been infected in attacks as well as backup plans that are not comprehensive. In the event of an attack, both will severely limit your ability to provide essential services to your constituents without interruption.

Conclusion

In short, the ability of a government to respond to a cyber-attack, as well as its ability to be resilient to an attack in the first place, depends upon proper planning.

While these insights are not comprehensive, they outline some basic steps that should be taken prior to a cyber-attack.

Due to the increasing connectivity of our world, cybersecurity now touches all aspects of governmental services. While governments must prioritize their spending and budget items, cybersecurity must also be a higher priority than it has been in the past.

Roy E. Hadley, Jr. is an attorney with Adams and Reese (Atlanta) who serves as independent counsel to companies, governments, and boards on cyber matters, helping them understand and mitigate legal risks and exposures to protect themselves and those they serve. He has previously served in the corporate roles of general counsel and chief privacy officer, as well as special counsel to the president of the American Bar Association and special assistant attorney general for the state of Georgia. He may be reached at [email protected].