Jun 11 2024

State and Local Governments’ Cyber Resilience Efforts Face Constraints

Research from CDW indicates that authentication and other tools help IT teams reduce risk.

Eighty-nine percent of state and federal government IT and security professionals feel somewhat or very confident about the visibility they have into their cybersecurity landscape — yet a number are facing funding, talent and other challenges, according to a new research report from CDW.

A third of the government technology and security professionals who participated in a recent survey conducted by CDW say that their organization’s approach to cybersecurity doesn’t include sufficient budgetary resources. Some specifically mentioned that they had experienced budget uncertainty and restrictions.

More than a fifth of respondents report that their IT security team is understaffed. However, 30 percent of government IT and security professionals say that staffing needs aren’t fully understood within their organization, and more than a third say that a lack of staff makes their position very or somewhat stressful.

“A lot of organizations are experiencing pain because the security workforce is not large enough, so staffing issues tend to pervade,” says Stephanie Hagopian, vice president of security for CDW. “Automation is definitely seen as the No. 1 way to contend with those challenges — if you automate, you need fewer people — and zero trust is being seen as a pillar to driving that automation further.”

A zero-trust approach, which requires all network users to be authenticated and repeatedly validated, can help ensure, for example, that employees can access the correct applications and data without personnel having to manually provision and deprovision users.

“It reduces the burden on the service desk staff, because they typically have to field all these ticket requests that come in, reset passwords and manage access,” Hagopian says. “Identity management automates a lot of that.”

Ninety percent of survey respondents say they’ve achieved some level of zero-trust adoption.

Click the banner below to access the CDW proprietary research report.


Adjust the Employee Experience to Support Engagement

More than one government IT professional mentioned that hiring and holding onto skilled personnel can be complicated, and some noted that managing comprehensive security measures has been difficult as a result.

Entities in various industries might benefit from upskilling experienced staff members, Hagopian says.

“A lot of respondents said they needed better enablement and training for their people,” she says. “You retain your staff by ensuring that they have a broad set of skills and that they’re working on high-value tasks. Training is really essential so that people are equipped to handle the tough stuff.”

For breach prevention purposes, for instance, analysts who run an organization’s security operations center must be prepared to filter all of the associated data and identify what is and isn’t real, Hagopian says.

“You have to understand how to do root cause analysis and problem-solving,” she says. “The vast majority of our customers need to uplevel their staff and convert IT generalists into security professionals because there aren’t enough out there in the industry. It’s true workforce development; CDW does all that.”

Although 27 percent of survey respondents currently aren’t outsourcing any security model components, leveraging external providers to handle some of the work can keep employees from feeling overloaded — and allow them to focus on more meaningful tasks and career advancement opportunities, according to Buck Bell, who leads CDW’s Global Security Strategy Office.

More than three-quarters of state and federal government IT professionals (77 percent) say that offering a clear path to be promoted to other cybersecurity roles is an effective way to hold onto IT security staff members. Sixty-seven percent believe that providing opportunities for certification and education can have a similar effect.

“Everybody wants to feel like their work matters,” Bell says. “Looking at the 80,000th false incident from some system is not only stressful, it’s just deadening. Your attention span goes away. Things like job rotation can help people gain additional experience; putting together some kind of training strategy to help them develop their careers is a huge value-add for companies looking to retain staff.”

READ MORE: A report advises how to build a more resilient government workforce.

Gain Insights from Security Platforms

Most organizations are using between 50 and 99 security tools or platforms; government respondents in CDW’s survey ranked security information and event management solutions as the most effective for improving environment visibility.

The technology and security professionals also identified encryption, data security, and network security tools and services as having been particularly helpful to their organization and cybersecurity initiatives.

Using multiple tools might add some operational complexity: 34 percent of government IT officials say they’ve found integrating all of their security solutions at least somewhat difficult.

Yet having more tools in place tends to mean that organizations are more confident in their visibility level, according to the survey findings.

To help agencies successfully select and use solutions, Bell recommends referencing guidance from the cybersecurity frameworks available from organizations including the Center for Internet Security and the National Institute of Standards and Technology.

“These can be quite helpful because they give you an operating framework around security to understand what toolsets are key in an environment,” he says. “The question you ask then is, functionally, are we doing that? If not, why — and is it necessary? That leads you to find where the gaps are and how to fill them.”

DISCOVER: Augmented network security supports government remote work.

Position Agencies to Avoid and Recover from Attacks

Data breaches can cost state and federal governments a substantial amount: 47 percent of IT and security professionals say the downtime they experienced from a data breach in the past five years resulted in expenses of $1 million to $10 million. Fourteen percent of CDW’s survey respondents had to spend more.

Currently, 84 percent of government IT and security officials feel their organization is either somewhat or very prepared to respond to a cybersecurity event.

A considerable number of government IT officials, however — 30 percent — say their organization has yet to experience a data breach.

Regardless, federal and state governments should operate under the assumption they’ll be breached at some point and pay close attention to both defense and containment measures, Bell says.

“We’re seeing attacks against critical infrastructure targets that are incredibly novel and difficult to detect,” he says. “Operational downtime is a huge risk, but there’s something even more important: the basic sense of trust that tends to be compromised when a breach occurs. How an organization responds — with solid planning, war-gaming of worst-case scenarios and the communication that’s associated with recovery — will determine whether that recovery is successful.”

Natee127/Getty Images

Learn from Your Peers

What can you glean about security from other IT pros? Check out new CDW research and insight from our experts.