Cyber-Security among American Local Governments Donald F. Norris, Anupam Joshi and Timothy Finin University of Maryland, Baltimore County Baltimore, Maryland Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments Why is it important? Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments Number of governments Spending on IT Number of attacks Effect of attacks Cost to the economy Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments Locus of attacks Attack vectors Web Sites Social Engineering Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments No CS or SS literature on local government cybersecurity Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments Method: Focus Group of CIOs and CISOs State of Maryland Baltimore City Baltimore County Howard County Montgomery County Prince George’s County Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local governments Findings cannot be generalized Findings can be used to direct further research Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments Attack – an attempt by any party to gain unauthorized access to any component of an information technology system for the purpose of causing mischief or doing harm. Incident – any event that compromises the confidentiality, integrity or availability of an information asset (Verizon) Breach – an incident that resulted in confirmed disclosure (not just exposure) to an unauthorized party (Verizon) Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments Attacks - 24/7/365 Thousands per day Some will inevitably be successful Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments End user is the problem “Our biggest struggle now is … the human being, our weakest link.” Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments “Running a [phishing] campaign with just three s gives the attacker a better than 50% chance of getting at least one click. Run that campaign twice and that probability goes up to 80%, and sending 10 phishing s approaches the point where most attackers would be able to slap a ‘guaranteed’ sticker on getting a click.” (Verizon, 2013 DBIR) Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments Insufficient funding and staff “IT is … less than two percent of the overall budget. Less than two percent. Yet 100 percent of the people in [the county] are using IT. So, you know, you’re right, you know, we don’t have the resources, we don’t have the manpower. [We] … try and use our money the best way we can and … you’re right, sometimes things can be solved with money.” Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments Governance and federation (executive, legislative and judicial branches and divisions within the executive) “I’ve got responsibility over all three branches of government. However I can’t legally enforce policy, due to the pesky constitution, over the legislative and judicial branches. But I am responsible for their security” Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments Insufficient or under-enforced cybersecurity policies “There has to be someone in charge [and] … there has to be policy … the rules of the road. Not all state and local governments or units within them have appropriate cybersecurity policies and not all implement the policies that they have well.” Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments Actions to improve cybersecurity: Technical Managerial and Policy Governance Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments Technical Cybersecurity tools and practices Vulnerability assessment Two factor authentication and authorization Continually scan and test Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments Managerial and Policy Assess vulnerabilities User training and control Control over external devices Create a culture for cybersecurity Cybersecurity insurance Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments Governance Overcome the federation problem Ensure that all departments and units and their staff comply with policy Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments Conclusions Attacks are constant; some will succeed Technology is under control Human side is vulnerable Managerial and Policy need attention Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security among American Local Governments Future Research Types of cyberattacks Vulnerabilities Current CS policies and practices v. “Best Policies and Practices” Addressing the Gaps Addressing the human element Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016

Cyber-Security at the Grassroots: American State and Local Governments and the Management of Website Security THANK YOU! Prepared for: UMBC Public Policy Forum Baltimore, Maryland April 15, 2016