Lessons learned from whole-of-state cybersecurity efforts

More than two years into the $1 billion State and Local Cybersecurity Grant Program, hundreds of millions of dollars have flowed to states to help them invest in long-term cybersecurity planning through a whole-of-state approach.

The fruits of their labor are starting to show. In late February, for instance, New York announced it would use nearly $6 million of its federal funding to create a new cybersecurity grant program to help its local governments. The program is intended to expand access to cyber tools, information, resources and services, with the state using its purchasing power to directly procure “best-in-brand” services to provide to localities.

And guests from Maryland, North Dakota and the city of Dallas shared in the first episode of Route Fifty’s new Innovation Spotlight series that aired Tuesday what they’ve learned so far in implementing the whole-of-state approach, which prioritizes greater information sharing and partnerships between the different levels of government and private industry.

Route Fifty’s Chris Teale (left) interviews cybersecurity leaders. Left to right: Bill Zielinski, Dallas’ chief information officer; Michael Gregg, North Dakota’s chief information security officer; Netta Squires, Maryland’s director of local cybersecurity.

The federal cyber grant program, a first-of-its-kind investment in cybersecurity established under the bipartisan infrastructure law, requires states to put a cybersecurity plan in place in partnership with various levels of government.

Most states are in the middle of standing up their whole-of-state programs. But the three state and local tech leaders in Tuesday’s Spotlight episode agreed that information sharing between the various levels of government has been among the most important aspects of the approach. With adversaries not respecting jurisdictional boundaries when they attack, they said, states need to work better with their localities, school districts, utilities, businesses and others to face them down.

Those information-sharing groups include multistate coalitions like the Multi-State Information Sharing and Analysis Center and the Joint-Cybersecurity Operations Command Center, as well as state-level groups, commissions and task forces where leaders can convene with their own local governments, utilities and others.

“Our adversaries are not waiting for monthly meetings,” said Netta Squires, Maryland’s director of local cybersecurity. “They are talking to each other all the time in these other forums. Our defense mechanisms, our analysts need to be able to talk to each other at the same speed.”

In the early days of cyber planning, Michael Gregg, North Dakota’s chief information security officer, said he went on a “listening tour” to meet with the state’s cities, counties, schools and other subdivisions to form a “common vision” of the problems they face, and ways to deal with them.

“It’s easy to come up with solutions,” he said, “but it’s hard to define problems. When you spend time with those individuals, and you can start to define the problem and understand what the problem truly is, then you can start to put together the vision as far as where you want to be.”

For cities, having the buying power of the state and a willingness for it to provide various services, tools and resources can be immensely helpful. It all speaks to that greater sense of collaboration and being part of a “coalition of the willing,” said Bill Zielinski, Dallas’ chief information officer.

“I’m always looking for opportunities where there’s tools or capabilities or services that I can leverage and use because I need to stretch my dollars as far as I possibly can,” he said.

The whole-of-state strategy looks slightly different in all three states. 

In Maryland, a Statewide Security Operations Center is tasked with monitoring threats, while there is a smorgasbord of committees and task forces to connect state leaders with other parts of government. Laws imposed various requirements on local and state agencies, including the need for cyber plans and assessments and to meet minimum standards.

North Dakota signed a unified cybersecurity approach into law in 2019, making the cyber team responsible for all the branches of government, albeit under its existing budget and staffing.

And Dallas will be part of a series of centers throughout the state to provide on-the-ground support through security monitoring, threat sharing and training. 

But there are challenges for states as they navigate their own whole-of-state approach, including when it comes to sharing resources or tools. Even as states provide centralized services, integrating those offerings with other levels of government can be difficult as they may be incompatible with something a locality already uses. Squires said the “federated” nature of technology, where “everyone does their own thing,” can make it tough.

One way to ease that is for states to embrace the risk and authorization management programs like FedRAMP and its state-level equivalent, StateRAMP. Those programs ensure cloud services and other software adhere to standardized security requirements. Using RAMP-approved services can help remove worries about a software’s security posture, which could be a barrier to adoption.

“It actually is making us more consistent,” Zielinski said.

As with every discussion in government, the issue of stretched finances looms large. That is especially complicated in states like North Dakota, which sets its state budget every two years, so must work in those constraints.

Some parts of government, like the public schools, may only have a certain “window” in which changes can be made, Gregg said, something that is made even more difficult by the technical debt that exists everywhere, such as older, customized systems or poorly written code.

“It’s not like private industry, where you can go back and easily ask for more money or something else that you need,” Gregg said. “[You’re] managing that people, process, technology, understanding when and how you can change it, and then staffing, getting the right people in.”