Adjust the Employee Experience to Support Engagement
More than one government IT professional mentioned that hiring and holding onto skilled personnel can be complicated, and some noted that managing comprehensive security measures has been difficult as a result.
Entities in various industries might benefit from upskilling experienced staff members, Hagopian says.
“A lot of respondents said they needed better enablement and training for their people,” she says. “You retain your staff by ensuring that they have a broad set of skills and that they’re working on high-value tasks. Training is really essential so that people are equipped to handle the tough stuff.”
For breach prevention purposes, for instance, analysts who run an organization’s security operations center must be prepared to filter all of the associated data and identify what is and isn’t real, Hagopian says.
“You have to understand how to do root cause analysis and problem-solving,” she says. “The vast majority of our customers need to uplevel their staff and convert IT generalists into security professionals because there aren’t enough out there in the industry. It’s true workforce development; CDW does all that.”
Although 27 percent of survey respondents currently aren’t outsourcing any security model components, leveraging external providers to handle some of the work can keep employees from feeling overloaded — and allow them to focus on more meaningful tasks and career advancement opportunities, according to Buck Bell, who leads CDW’s Global Security Strategy Office.
More than three-quarters of state and federal government IT professionals (77 percent) say that offering a clear path to be promoted to other cybersecurity roles is an effective way to hold onto IT security staff members. Sixty-seven percent believe that providing opportunities for certification and education can have a similar effect.
“Everybody wants to feel like their work matters,” Bell says. “Looking at the 80,000th false incident from some system is not only stressful, it’s just deadening. Your attention span goes away. Things like job rotation can help people gain additional experience; putting together some kind of training strategy to help them develop their careers is a huge value-add for companies looking to retain staff.”
READ MORE: A report advises how to build a more resilient government workforce.
Gain Insights from Security Platforms
Most organizations are using between 50 and 99 security tools or platforms; government respondents in CDW’s survey ranked security information and event management solutions as the most effective for improving environment visibility.
The technology and security professionals also identified encryption, data security, and network security tools and services as having been particularly helpful to their organization and cybersecurity initiatives.
Using multiple tools might add some operational complexity: 34 percent of government IT officials say they’ve found integrating all of their security solutions at least somewhat difficult.
Yet having more tools in place tends to mean that organizations are more confident in their visibility level, according to the survey findings.
To help agencies successfully select and use solutions, Bell recommends referencing guidance from the cybersecurity frameworks available from organizations including the Center for Internet Security and the National Institute of Standards and Technology.
“These can be quite helpful because they give you an operating framework around security to understand what toolsets are key in an environment,” he says. “The question you ask then is, functionally, are we doing that? If not, why — and is it necessary? That leads you to find where the gaps are and how to fill them.”
DISCOVER: Augmented network security supports government remote work.
Position Agencies to Avoid and Recover from Attacks
Data breaches can cost state and federal governments a substantial amount: 47 percent of IT and security professionals say the downtime they experienced from a data breach in the past five years resulted in expenses of $1 million to $10 million. Fourteen percent of CDW’s survey respondents had to spend more.
Currently, 84 percent of government IT and security officials feel their organization is either somewhat or very prepared to respond to a cybersecurity event.
A considerable number of government IT officials, however — 30 percent — say their organization has yet to experience a data breach.
Regardless, federal and state governments should operate under the assumption they’ll be breached at some point and pay close attention to both defense and containment measures, Bell says.
“We’re seeing attacks against critical infrastructure targets that are incredibly novel and difficult to detect,” he says. “Operational downtime is a huge risk, but there’s something even more important: the basic sense of trust that tends to be compromised when a breach occurs. How an organization responds — with solid planning, war-gaming of worst-case scenarios and the communication that’s associated with recovery — will determine whether that recovery is successful.”
