Modernization a challenge when systems can’t go down, city leader says
Bruce Yuanyue Bi via Getty Images
By
Chris Teale
While agencies want to embrace artificial intelligence and retire legacy tech, it’s difficult when those power vital services that cannot break, a senior official said this week.
States and cities across the country are modernizing their critical and legacy systems and turning to artificial intelligence to help them bring their operations into the future.
But, one city leader warned this week that it isn’t always easy. The systems they are modernizing cannot afford to break down or be left vulnerable to cyberattacks, as those systems might be for benefits payments, permitting, transportation, 311 or other vital services.
Given that, Philadelphia Chief Information Officer Melissa Scott said efforts to modernize can feel a little like “trying to change the wheels on a bike in the middle of a marathon.” But the work remains important, she added.
“We don't have the ability to shut the system off and say, ‘OK, we're going to modernize,’ and when we're ready, we're turning this system off, which gives us a chance in order to migrate, test and do everything that we need to do to make our new systems more modernized,” Scott said during a Future Nation webcast hosted by Route Fifty and Google Public Sector this week. “We have to identify ways to protect and modernize while daily services are going on every day, so that makes it quite difficult.”
Meanwhile, those cyber threats to critical systems remain. Scott said that Philadelphia’s agency workers, like many employees, face the usual targeting like phishing attacks, ransomware and credential threats. And any third-party vendors the city contracts with must deal with their own set of threats and vulnerabilities.
In a bid to stay ahead of those threats, Scott said the city takes a “layered approach,” which focuses on threat prevention and monitoring, as well as employee awareness, incident readiness and system and data protection. That also helps the city keep up with the speed at which those threats are evolving.
“There's a challenge every day, and the more digital we become as a government, the more these threats become more prevalent,” Scott said. “Residents expect services to be available online 99% of the time, especially as we continue to connect our systems within departments, vendors and platforms, so because of that, cybersecurity has evolved from a technical issue into a core part of operational resilience. It's about how we make sure that the essential services continue to be up and available.”
It means that one of the city’s biggest vulnerabilities is its employees, who need to only make one mistake in their work lives to be exploited by bad actors and see an agency or the entire city crippled. Training those employees on proper cybersecurity habits, then, is crucial.
Scott said the city has “found some creative ways” to train its employees, including by gamifying its cybersecurity training. And they also found it helpful to take away features from employees — including internet access — until they take and pass required cyber training. Now, the city has coupled its cybersecurity training with its AI training and had almost 2,000 employees start to learn the basics about how to use these new tools, and to do so safely.
“Why is this important when we think about cybersecurity? Because it is about our data,” Scott said. “How do we protect the data? How do we ensure that employees understand what they should be entering into the tool? That includes being clear about the types of information that they should be entering, as well as how to protect sensitive data”
It seems to be working, too. Scott said employees “are starting to understand that they have a responsibility and to be on the lookout” for phishing emails or other cybersecurity threats. Whereas cyber training previously had an employee completion rate around 65%, Scott said, last year that figure reached 91%, showing how the culture around cybersecurity has shifted.
AI, meanwhile, will be a “force multiplier” both in defending against cyber threats, but also for attackers looking to cause havoc, she said, and training will need to evolve to reflect that. There is still a lot of work ahead, especially to make cybersecurity a key tenet of agency preparedness.
“It's about making cyber security more than a technical function,” she said. “It's really about our workforce development, and how we prepare them for operational resilience, responsible innovation and, more importantly, public trust. I think we forget that, a lot of times, we're here to serve the public, and we're preparing our people here, our employees and everyone to strengthen our systems, putting our city in a better position to prevent, respond to, recover from and withstand those threats.”