Centralize Cybersecurity, Share Widely

State government is a house with many, many windows, and it relies on all its agencies to keep those windows shut tight. While one person in the basement may lower the storm windows, another person in the kitchen may crack a window for some air. Neither has any knowledge of the other's actions because of the historically siloed nature of government.

As the cybersecurity threat landscape grows ever more hostile and sophisticated, it makes sense to take advantage of economies of scale and centralize many security services. Without doubt, there will always be a need for security boots on the street in state agencies. But by centralizing many core utility services, Minnesota hopes to provide all of our state agencies with best-of-breed tools and security processes.

The first centralized security service that we rolled out was vulnerability and threat management. Designed with assistance from many security professionals across Minnesota agencies and housed in our main data center, the solution provides continuous vulnerability assessments of some 150,000 computers, including those at our state colleges and universities. Before this implementation, few state agencies had the technical or fiscal wherewithal to design and implement their own vulnerability management solution.

Now security professionals simply use a web browser to schedule and manage their vulnerability scans, harnessing the power of a single solution that is shared by all. IT workers also receive timely information about threats with actionable steps to mitigate them.

Beyond leveling the security playing field across all agencies, other benefits of centralized cybersecurity solutions include:

• Lower cost: Adopting shared solutions costs a fraction of what it would take to implement stand-alone solutions agency by agency. Shared solutions are also far more cost effective to maintain after the initial implementation.
• Deeper expertise: Channeling all efforts on targeted security solutions helps develop a community of experts who can share their knowledge and best practices. Minnesota hosts dedicated e-mail lists for users of specific products, such as the standard endpoint encryption solution, and we also offer product training.
• Improved security, with metrics to prove it: Giving all agencies access to state-of-the-art tools, coupled with defined processes and training, ultimately yields better security. With enterprise vulnerability management, government leaders in Minnesota now can track metrics such as their Average Host Score from month to month. They also can see the security posture of their agency in relation to other agencies, something that was not possible in the past.
• Increased policymaker support: Policymakers are becoming increasingly agitated with the lack of collaboration between government entities. Demonstrating real wins, such as the shared vulnerability and threat management solution, proves to policymakers that government leaders can successfully join forces to leverage taxpayer dollars to their fullest extent.

Our focus is to actively engage our customers to design security offerings with components that can be built once and shared by all. Collaborating and sharing: When it comes right down to it, it really is that simple.