How Can Local Governments Improve Cybersecurity?

TL;DR

State and local governments can improve cybersecurity by establishing clear governance, prioritizing risks, sharing security services, protecting sensitive resident data, and securing executive support. Because responsibilities, infrastructure, and budgets vary across jurisdictions, each government must coordinate agencies, education, public safety, workforce development, and incident response while maintaining continuous awareness among employees.

Transcript

Great. Really nice of you to all come out and, uh, have this discussion. I'm very excited about this discussion this morning. Um, I think this is a really important issue in cybersecurity. I think, um, and it's not just-- we're not just gonna talk about being a small town problem. We're really talking about state and local government and how to rea... Read More

Key Insights

• State and local governments face the same evolving threats, commodity hardware and software vulnerabilities, and cybersecurity incidents as other organizations, but differing governance structures and constrained resources complicate how they organize and fund their defenses.
• Cybersecurity governance varies significantly among states because responsibility, budgeting, and infrastructure ownership are distributed differently. Municipalities and universities may use state networks in some jurisdictions but operate independently in others, limiting the usefulness of a single governance model.
• Resource constraints affect cybersecurity prioritization because states often balance their budgets and work within formal appropriation cycles. Federal funding sources, including FEMA grants, can supplement state cybersecurity investments when governments understand how to use them effectively.
• State governments hold extensive personally identifiable information about residents, including records associated with births and taxes. Effective protection requires identifying where that information is stored, determining whether it is encrypted, and controlling who can access it.
• Distributed administration makes statewide security difficult because numerous agency heads, CISOs, and acting security leaders may have different responsibilities and levels of training. Maintaining consistent protection therefore requires continuous coordination, support, and attention across agencies.
• Shared security services can allocate cybersecurity attention according to agency risk. Virginia adopted this model after recognizing that agencies differed in their volumes of personally identifiable information, public web presence, and resulting need for specialized protection.
• Employee awareness is a central control because Virginia's enterprise network served about 86,000 people on a typical day, and one harmful click could create a major problem. Security education must therefore accompany technical and governance measures.
• Executive leadership helps cybersecurity priorities cross organizational boundaries. Virginia formed a cyber commission and relied on the governor's stated commitment to coordinate public safety, education, technology, and other responsibilities managed by different cabinet secretaries.

Questions & Answers

Q: How can local governments improve cybersecurity with limited resources?

Local governments can improve cybersecurity by prioritizing their highest risks, clarifying responsibility for infrastructure and data, and considering shared security services. They can also use available federal funding, including FEMA grants, to supplement local or state investment. Because every jurisdiction has a different governance structure, leaders must select an approach that fits their networks, agencies, budgets, and ownership arrangements.

Q: Why is cybersecurity governance difficult for state governments?

Cybersecurity governance is difficult because responsibilities, budgets, and infrastructure ownership vary across states. In some jurisdictions, municipalities or universities use state networks, while in others they do not. State systems are also distributed among many agencies and leaders. These differences make it difficult to identify one optimal model and require each state to coordinate security according to its own structure.

Q: What sensitive information must state governments protect?

State governments must protect extensive personally identifiable information about residents and other people connected to the state. The transcript specifically identifies information associated with where someone was born and where someone pays taxes. Protection begins with determining where that information is located, whether it is encrypted, and which people or systems have permission to access it.

Q: How does a shared services model support government cybersecurity?

A shared services model centralizes or coordinates security capabilities across a distributed government environment. Virginia adopted this approach after recognizing that agencies did not require identical levels of cybersecurity attention. Some held more personally identifiable information or operated larger web presences than others. Shared services allowed the state to consider those differences while securing its broader enterprise network more effectively.

Q: Why should cybersecurity be treated as a public safety issue?

Cybersecurity should be treated as a public safety issue because state government has a fundamental duty to protect the safety, welfare, and information of its citizens. States must continue everyday governing, education, and workforce responsibilities while preparing for cyber incidents. That preparation can require coordination with law enforcement and National Guard entities, placing cybersecurity beyond a narrowly defined information technology function.

Q: How should states prioritize competing cybersecurity needs?

States can prioritize cybersecurity needs by creating a coordinating body, securing executive commitment, and bringing together officials whose responsibilities cross agency and cabinet boundaries. Virginia formed a cyber commission for this purpose. The governor's designation of cybersecurity as a top priority gave cabinet members and agency heads a common direction for evaluating infrastructure, education, public safety, workforce, and awareness needs.

Q: Why is employee cybersecurity awareness important in government?

Employee awareness is important because technical controls cannot eliminate the risk created by everyday user actions. Virginia's enterprise network had about 86,000 people using it on a typical day, and the secretary of technology described the state as one click away from a serious problem. Continuous public awareness and employee education therefore form an essential part of statewide cybersecurity management.

Q: How can states make cybersecurity programs last across administrations?

States can make cybersecurity programs more durable by putting foundational building blocks in place before an administration ends. These include governance, shared services, education, workforce preparation, infrastructure protection, public awareness, and executive coordination. Without that institutional foundation, a succeeding administration may need to rebuild missing capabilities or attempt to catch up while cyber risks continue evolving.

Summary & Key Takeaways

• State and local governments face many of the same threats, software vulnerabilities, and incidents as other organizations, but their governance structures create additional complexity. Responsibilities, budgets, and infrastructure ownership differ among states, municipalities, universities, agencies, and public safety organizations, making a single universal cybersecurity model difficult to define and apply.

• Governments hold extensive personally identifiable information connected to residents, births, and taxes. Protecting it requires knowing where the data resides, whether it is encrypted, and who can access it. Distributed agencies, uneven cybersecurity expertise, constrained budgets, and differing levels of risk make consistent security management especially difficult across a state enterprise.

• Virginia addressed its distributed environment through shared security services and a cyber commission that coordinated priorities across cabinet secretaries and agencies. Executive support was critical because the governor identified cybersecurity as a top priority. The broader goal was to create durable capabilities spanning infrastructure, education, workforce development, economic development, public awareness, and public safety.