The Work-from-Home Vulnerability
After the arrival of COVID-19 in the United States, 69% of U.S. workers were working remotely by April 2020. While more people are getting back to the office, there were still a large number of people still working either remotely or going hybrid by September. In conjunction with this rise in remote work in state and local governments, cyberattacks against these institutions were up 50% in 2020. According to a study published by MalwareBytes, where over 200 managers, directors and C-suite executives in information technology were surveyed, 24% said they covered unexpected costs following the implementation of a remote work schedule to address cybersecurity breaches. Additionally, 20% of respondents reported that their workplaces faced a security breach due to remote work. As a significant amount of employees return to in-person work, and many employers instate a hybrid work schedule, cybersecurity has become a priority for information technology government employees.
Research published by Mandiant, a U.S.-based cybersecurity firm, found that at least six states were hacked between May and February by a Chinese state-sponsored espionage group. City and county governments are also prime targets for cyberattacks. To some hackers, municipalities are “low-hanging fruit,” given the combination of mismanaged networks and troves of information like voter records, social security information, and more. New Orleans Chief Information Officer Kim Lagrue stated in the Washington Post, “Cities are vulnerable to attacks because we don’t have resources in the same way that the private sector does. That makes us more attractive targets.” Not only does this lack of resources make cities and local governments more appealing to hackers, but recovery from such attacks takes more time. The city of New Orleans was the target of a cyberattack in December 2019, shortly before the COVID-19 pandemic gained a foothold the U.S. As staff worked around the clock to ensure the city recovered from the attack, they were hit with all the challenges that came with COVID-19. It eventually took approximately one year and over $5 million for the city to recover. The city of New Orleans has yet to determine how much money they can recover from this loss.
The Necessity for More Employees Dedicated to Cybersecurity
Cybersecurity should be a priority in state and local governments across the country. Agencies have lacked the necessary funding, a miscue magnified by the pandemic. Municipalities, specifically, have struggled with low retention in IT jobs, with many qualified individuals leaving for higher salaries in the private sector.
However, funding towards technology services in state and local governments have recently increased as of November. Under the federal infrastructure package, $2 billion was allocated to cybersecurity — $1 billion of this budget is specifically designated for the State, Local, Tribal, and Territorial (SLTT) Grant Program which will provide cybersecurity aid to these institutions.
Now that these agencies are receiving this money, state and local governments are beginning to see the value in investing in IT jobs across the country. State and local governments must prioritize retention and hiring of IT talent that can help mitigate past cyberattacks and prevent new ones. Roles like Chief Information Officer (CIO), Chief Information Security Officer (CISO), and Chief Technology Officer (CTO) will lead the way in developing and implementing solid technology infrastructure to safeguard government systems. These leadership roles will be in charge of creating teams that improve their security protection. As New Hampshire CIO Denis Goulet stated, this new funding presents a “unique opportunity” and that governments should “modernize legacy and outdated IT systems, improve our cybersecurity posture and invest in technologies to enhance how our citizens interact with their governments.”
