States flex cyber leadership muscle

New Jersey recently joined the list of states addressing statewide cyber threat protection through educational and readiness initiatives that aim to protect infrastructure, networks and businesses, as well as state government itself.

According to a 2014 research study by the Center for Digital Government regarding the increase in cyber threats in state and local government, the severity of advanced threats has been underestimated by IT and security personnel in government agencies, with only  11 percent saying that their organization was very prepared for incident response following a breach.  To make matters worse, 40 percent of respondents said their agency has seen an increase in the number of cyber incidents.

To battle statistics like this, Gov. Chris Christie recently signed an executive order establishing the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC), which will be a liaison between the public and private sectors for sharing information and real-time situational awareness, performing cybersecurity threat analysis and coordinating with federal and other state agencies.

This executive order extends the state’s homeland security mission from the physical to the virtual, Chris Rodriguez, director of New Jersey’s Office of Homeland Security, said at the recent FireEye Government Forum.

Officials of all levels can report incidents; gather both cyber threat alerts and mitigation techniques; and monitor sector-specific threat analysis and recent cyber activity through NJCCIC. Information sharing is a focal point, Rodriguez said, and it can be an effective tool for mitigating the attacker’s advantage.

NJCCIC will also recommend cyber security protection best practices to both agencies and industries and promote collaboration and coordination between the sectors, as over 90 percent of New Jersey’s critical infrastructure is owned by the private sector. But threat information sharing can’t be legislated, Rodriguez said. “Getting out to the private sector, building the relationships and building the trust that they will share information with the government is a key challenge that we still face and that we still work on every day.”

The Christie administration also plans to share cyber threat real-time awareness locally, to citizens, local governments, businesses and infrastructure owners and operators.

According to Rodriguez, the state’s Office of Homeland Security “has now assumed the cyber security mission.”

New Jersey's move came roughly a month after Virginia set up the nation's first state-level Information Sharing and Analysis Organization – a response to President Barack Obama's February executive order encouraging information sharing.   Virginia also has a Cyber Security Commission that draws together public and private sector experts, leaders and administration officials in order to identify and report threats, promote awareness and provide guidance regarding Virginia’s cyber security.

To spread awareness, the commission reaches out those at the municipal level through town hall meetings that bring state and local government leaders together with business and university leaders to develop recommendations that will help to position Virginia as a leader in cyber security.  

Lately, however, Virginia’s commission is focusing on the intersection of technology and public safety.

Specifically, Gov. Terry McAuliffe recently announced a public-private working group with the Virginia State Police aimed at safeguarding citizens and public safety agencies from potential cyber attacks on automobiles. This group will investigate technology that can be used by law enforcement to detect if a vehicle’s computer system has been breached or is under attack.

“The creation of this working group demonstrates the Commonwealth's willingness to tackle complex challenges and forge cross-boundary collaborations,” said Secretary of Technology Karen Jackson. “Both are attributes necessary to keep Virginia at the forefront of cybersecurity.”

States are also looking to cybersecurity education to help protect public and private assets. The Virginia Cyber Security Commission is tasked with providing recommendations for K-12 educational training programs that foster early cyber security awareness and build a foundation for a solid cybersecurity workforce.

At the FireEye Government Forum, Rodriguez and Jackson discussed the importance of young hires in building cyber threat resilience in government. Tools and tactics like allowing workers to bring their own devices to work and offering opportunities to travel help excite millennials and keep them on staff. exas, meanwhile, took different tack in 2014 with the launch of the Texas InfoSec Academy, a statewide cybersecurity educational program developed by the Department of Information Resources aimed at training technology professionals specifically in cybersecurity.

The program offers six areas of study, ranging from writing secure code to technology management leadership. The curriculum pulls from courses originally developed by the Department of Homeland Security as part of its National Initiative for Cybersecurity Careers and Studies.

The academy is open to state agencies and institutes of higher education, and as of April 2015, is home to 175 enrollees representing 82 organizations, according to Thomas Johnson, a Texas Department of Information Resources chief customer officer.  

Eventually, student security officers will earn various certifications and move on to help better secure the state.

Many states have also held cybersecurity exercises as a part of a statewide protection and awareness solution. Delaware’s annual cyber exercises, for example, have ranged from tabletop activities to joint efforts by business managers and technical participants from local government. Kansas has made public the scenarios it designed for local governments about hacking attacks and their consequences.

Last year, New York Independent System Operators hosted a statewide Critical Infrastructure Cybersecurity Exercise for utilities and local governments, and Michigan’s Cyber Initiative will involve agency executives in its cybersecurity exercises.