Agencies are regularly targeted not only by cybercriminals but also by state sponsored actors
According to Deloitte, governments store significantly more data than the private sector and often keep it on older, more vulnerable infrastructure. Unlike most commercial industries, agencies are regularly targeted not only by cybercriminals but also by state sponsored actors. Consequently, vulnerabilities within the government could result in cyberattacks or cybersecurity incidents that may cause disruption that threaten the country's economy, national security, and the health and safety of the public.
Key Challenges to the Federal, State and Local Government Sector
Protecting Personal Data Integrity
In executing their core functions, government agencies collect enormous amounts of data on citizens. Cybersecurity is vital to the protection of this sensitive, confidential, or highly personal information that government agencies maintain. Personally identifiable information (PII) such as medical records, taxpayer records, and social security numbers, could be misused if stolen. In fact, most developed nations have a comprehensive consumer data protection law to protect their citizens data collected by their government as well as by the commercial sector and an independent agency to enforce compliance with the law. To sustain public confidence, government agencies need to make protecting this information a top priority.
Keeping Vital Services Functioning Despite of a Breach
Information relating to the nation’s infrastructure is an area of particular concern. Over the years, Federal, State and Local Government organizations have lagged in implementing advanced protection systems to safeguard vital information. However, with continued advancement in technology such as the current transformation of the ultra-connected 5G, the critical infrastructure used across key public functions is constantly at risk. Other vital services that are connected, directly or indirectly, to the internet through networks such as transportation grids, communication networks, water systems, and law enforcement and first responders have become increasingly vulnerable to attacks.
Recent Public Sector Data Breaches
Until federal and state governments recognize and understand that upgrades must be made to protect various classes of government information, organizational networks, and communication systems - they will remain an attractive target and data breaches will continue.
Several US government agencies have experienced cybersecurity breaches in the last few years. The 2015 data breach of the U.S. Office of Personnel Management (OPM), which impacted 22 million people is a striking example of vulnerability in the public sector.
The key stolen information included security applications of government employees, among them secret service and military personnel. These security applications are 127 pages and include highly personal information such as mental health history, fingerprints, criminal records, past assignments, financial data, drug and alcohol use, family member data, and work history. US government officials stated that such data could be used to identify US operatives and compromise intelligence networks.
The 2018 ransomware attack of Atlanta, Georgia by the Iranian based SamSam group was the largest successful security breach of security for a major American city by ransomware, potentially affecting up to 6 million people. According to Reuters, it was estimated that a third of the software programs used by the city remained offline or partially disabled. Additionally, legal documents and law enforcement video files were missing. This breach was notable due to the extent and duration of the service outages caused. Many city services and programs were affected by the attack, including utility, parking, and court services. City officials and residents were forced to complete paper forms by hand.
Key Public Sector Vulnerabilities
There are several areas where the public sector at all levels are particularly vulnerable.
Cybersecurity Standards & Compliance
Cybersecurity compliance standards for US government agencies include the Federal Information Security Modernization Act of 2014 (FISMA) and the Cybersecurity Framework, which include specific standards, such as Federal Information Processing Standards 199 and 200 (FIPS 199 & 200). The gold standard for cloud security is the Federal Risk and Authorization Management Program (FedRAMP).
The Cloud Hoppers campaign resulted in eight of the world's largest cloud providers being breached by Chinese cyber spies in a multi-year infiltration.
While agencies fully compliant in those standards are given awards each year, unfortunately audits of federal FISMA compliance for 2018 show 36 problematic findings covering six security control areas in government agencies. Additionally, an audit of 96 agencies showed complete non-compliance with safety protocols in 12 agencies, and partial noncompliance in another 59 agencies.
Public Sector Trends Show Upcoming Security Challenges
Two notable trends indicate the increasing challenges as well as some progress on cybersecurity: ongoing migration of all data to the cloud while standardizing FedRAMP and cloud security protocols across government agencies.
Continued Progress on Public Sector Cybersecurity Is Key
It is easy to take critical public infrastructure for granted. The systems and networks that play a vital role in the operations of basic government services can fade into the background and the citizenry could be excused for assuming that federal, state and local governments are making every effort to protect these assets.
All branches of government are in the front line of a new type of war. It is not only a war against established nations but continuous trench digging war against elusive, decentralized and unpredictable threat actors. Governments need new tools, ammunition if you will, to succeed on this new battlefield. While properly resourcing and developing government response remain a challenge for the public sector at all levels, the wider trends to cloud environments and increasing FedRAMP compliance and security is encouraging.
At CyLogic, we are proud that our flagship product, CyCloud, meets the FedRAMP FISMA HIGH security requirements and has been vetted by Coalfire, the leading assessment organization on the market, as: "Strictly align[ed] with FedRAMP High requirements... for commercial entities seeking the highest level of cloud services and cybersecurity capabilities".
Compromised public-sector information could damage both national security and citizens’ trust. The public sector is responsible for critical systems and infrastructure at the national, state and local level that keeps the country functioning. Without the governments’ ability to provide vital services local and national economies would be severely impacted. According to a Verizon report, the public sector faces more security incidents and data breaches than any other sector. A robust cybersecurity program must be implemented to protect critical operations and infrastructure, including water systems, emergency communication networks, transportation grids, and law enforcement and first responders, from being disrupted or jeopardized.
Predictable Costs with CyCloud
The flexibility of the public cloud comes at a premium: offering on-demand computing resources is not free.
Public Cloud platforms like AWS and Azure offer startups companies, small-medium businesses as well as large enterprises the ability to scale computing services as needed. However, the flexibility of the public cloud comes at a premium: offering on-demand computing resources is not free. Maintaining this flexibility for the customer creates uncertainty and risk for the cloud provider and must be paid for by someone and is factored into the price.
READ more >
Cybersecurity Challenges in The Aerospace and Defense Industry
Many sectors in a modern economy are perceived to be critical to our nation’s economic well being. The aerospace and defense sector is uniquely positioned as it is crucial not only to the economy but also to national security. A cybersecurity breach in this sector could cause direct financial damage, weaken our national defense and competitive position and put lives at risk.
READ more >
The EASE of Use of a Public Cloud, the Data Control of a Private Cloud
A higher level of security than any public cloud provider
Public cloud environments are the king of ease-of-use—they are immediately available and have seemingly endless options. Enterprises move to the public cloud primarily for the flexibility in scaling workloads.
READ more >