Real Dangers of the Higher Risks Local Governments Face with Limited Resources for Information Security
Tags: Local Government, Government, Information Technology, Information Security, Risk

Data protection is critical for any organization and governments are not immune. LGITs have to manage and serve data across a variety of availability needs. LGIS teams have to make sure that data not only adheres to federal regulations, but also their local state and city laws. Just like no two organizations are alike, neither are two cities.

If some of these systems are disrupted, lives are at stake.

Not all the data is sensitive enough to fall under regulations, but that in itself can create problems. Governments are public and citizens can request releases of information through their various state laws regarding government disclosure. These requests are different in scope from the Freedom of Information Act (FOIA) requests used with the federal government. Each state differs on what information can be requested, which can create complications. For example, some state laws do not specify that data related to information technology systems can be redacted. Luckily, my state does have a provision to protect IT information, so when we receive a release of information for all our email addresses or all our database structures, we can deny those requests. One thing you can do for your local government as a security professional is read your state laws regarding the release of public information and send recommendations to your state representative to make those laws more secure.

Some of our information is confidential, especially within the public safety departments. The data collected by them is very attractive for all sorts of bad actors. To compound on that, most of that critical data needs to be accessible on a mobile terminal and around the clock. For example, the police and sheriff deputies need to be able to pull up all information collected on a suspect vehicle which could list cautions officers need to take before approaching. Without reliable access to that data, their lives are on the line. In this situation, not only is the data confidential, but it requires the highest availability. It doesn’t matter if you are a major metropolis of millions of people or a rural town of a dozen: The demand for reliable intelligence is the same. The infrastructure required to support that system is not significantly cheaper for the small town as opposed to the large city. According to Wikipedia, when counting populations that start around 100,000 citizens, 63% of municipal governments have less than 199,999 citizens. That leaves a lot of uncounted smaller towns that still have high cost government and public safety needs, but much more limited resources since the tax base is smaller.

Moving away from public safety, local governments also have critical infrastructure systems that need particularly special care to implement securely. Vehicles used in disaster recovery situations, like snow plows, require automatic vehicle location (AVL) and global positioning systems (GPS) to quickly and reliably offer services. Water and wastewater treatment plants require industrial control systems (ICS). The complexities in ICS security require specialized information security knowledge. This knowledge is unique enough that SANS now offers a catalog of courses focused solely on ICS security. When related to local governments who pay lower wages and have trouble adding information security positions, being able to hire and retain an ICS security specialist is out of reach for many municipalities.



The types of threats against governments are largely on par with the private sector. There is a slight increase in the risk of hacktivist campaigns, but business email compromises and ransomware are still very popular. What is different from much of private sector is that the systems needed to keep a city or town running require higher availability or the results can be disastrous. If some of these systems are disrupted, lives are at stake. In my previous article, I pointed out how LGIT and LGIS departments are already forced to hire less people and at lower wages than the private sector, but now we can see that this just increases the risks. In order to properly manage it all, you need staff with specialized knowledge of high availability systems and industrial control systems. Since wages are low, most municipalities have to hire less experienced staff and train on the job. With such critical systems, things get missed. Infrastructure is implemented incorrectly. And things can go unpatched.

How do we fix things so we can lower risks while working within the reality of limited resources? Next week I will share my thoughts on why the government model is failing its LGIT and LGIS departments while stealing some ideas from the private sector that, while a bit radical for the old school mentality prevalent in local government, might be the ticket towards better security.