STATETECH: What were the most significant findings for state and local government?
MARRÈ: More than half of the respondents reported that they are not at all prepared, or only somewhat prepared, to detect and recover from election-targeted cybersecurity incidents. There is a lot of room for improvement for cities, counties and states as they prepare for the 2024 elections.
Folks straddling both IT and security responsibilities feel overwhelmed, overburdened and underbudgeted. More can be done to help these great folks at the local and state levels to feel prepared, and to actually be prepared, for the election and all of the cybersecurity issues that they will face.
STATETECH: What were some of the top cyber concerns that election officials raised?
MARRÈ: There is rising concern over artificial intelligence-powered threats. Both disinformation campaigns and phishing attacks are potentially supercharged by these ubiquitous generative AI tools.
These AI tools can now be used to produce very realistic articles, social media posts, even images and audio files, all of which can allow malicious actors to inject misleading narratives or fabricated stories.
The second concern is about AI-assisted phishing attacks. Many breaches are accomplished through social engineering, particularly phishing. AI tools can help make the grammar perfect and make it look like a completely legitimate email. That makes phishing attacks very powerful.
STATETECH: In what ways are state and local teams feeling unprepared?
MARRÈ: About a third of respondents said that their budgets are somewhat inadequate or very inadequate for the task of helping to protect and secure the election. About half of respondents also said that they had not received election-specific cybersecurity awareness training, or they didn’t even know if they had received that training.
Overall, it’s incredibly important that local and state governments increase their cybersecurity measures before and during election season.
STATETECH: What steps should state and local officials be taking now?
MARRÈ: You can conduct security awareness training for everyone who’s going to be involved in the election — and actually everyone who’s in government — because they all could be targets of phishing attacks or something like that.
This training is going to be similar to the basic cyber hygiene training that we provide to everyone: Be aware of phishing campaigns and make sure that you don’t click on links or open attachments from unsolicited emails.
LEARN MORE: Localities are defending against elections-related cyberattacks.
They could also conduct tabletop exercises. How would we react to a major disinformation campaign? How would we react to a successful phishing campaign or ransomware attack? The folks in IT or security can write these up, and they will help you identify where your strengths are and where you need to shore up some of your processes and technologies.
If they can get some budget, they can reach out to a partner who does Security Operations Center as a Service. It’s an affordable way to get get 24/7 monitoring, which can really help small state and local governments to increase their security. The best value-add vendors can help increase your security significantly.
STATETECH: Do you have any closing thoughts for our readers?
MARRÈ: We have a lot of work to do as we face these new AI-based attacks, and it’s good to hear that many of our state and local leaders are concerned. Awareness is very important, and I feel like we have the awareness now.
There’s a readiness to increase security, to improve our processes and to use technology to make sure that we’re doing all we can to be resistant and resilient.
