Unlike road maintenance, public health initiatives, and education spending, cybersecurity isn’t always top of mind when thinking about local government budgets.
However, as three Colorado communities recently impacted by cyberattacks can attest, allocating funds for cybersecurity in local government programs is essential.
Cyberattacks on local governments and public agencies may not get the same press coverage as some high-profile security breaches, but these organizations are fighting an ongoing battle against cyber threats that they are often ill-equipped to win.
Local governments are popular targets for hackers because they provide a high payoff for low effort. Many local governments have a limited budget for cybersecurity, so they aren’t running the latest threat detection and prevention technology. This lack of a secured perimeter paired with the huge amount of sensitive personal information housed in government databases creates an open invitation for cyberattacks.
So how can we ensure cybersecurity initiatives get the funding needed to prevent data breaches, ransomware attacks, and other cyber threats that can expose residents’ personal information, shut down essential services, and require an expensive recovery effort?
Let’s look at how cybersecurity is funded in your current budget, what common cyber threats local governments need to watch out for, how to prevent becoming a cyberattack victim, and what types of technology and services to include in your cybersecurity program budget.
How to Prioritize Cybersecurity in Local Government
What do you know about your cybersecurity program? Start with the basics.
- What does your current cybersecurity program cost?
- How does cybersecurity align with your community's priorities?
- What additional tools or resources are needed to make it more robust?
- What level of cybersecurity are you required to provide through mandates?
- What level would you choose to provide if resources were prioritized for this program?
- What percentage of your population is impacted by a security breach?
All of these questions and more can be answered with priority-based budgeting data!
Common Types of Cyberattacks Targeting Local Governments
There are many types of cyberattacks. Here are a few of the most common threats local governments encounter:
- Malware: Malicious software—often delivered through email attachments or links—that encrypts data, corrupts files, blocks user access, or steals information.
- Ransomware: Malware that encrypts data and files and requires the payment of a ransom in exchange for the decryption key.
- Phishing: A social engineering scam that lures victims through emails, texts, or calls allegedly from known senders that trick the recipient into sharing account numbers, login credentials, or other sensitive information.
- Brute force: An attack that takes a forceful “trial-and-error” approach to guess login information, encryption keys, or other credentials and gain access to a network or IT system.
- Zero-day: An attack that exploits a recently discovered vulnerability that hasn’t been patched.
- Denial of Service (DoS): An attack that disables a website or server by hitting it with a huge amount of traffic in a short period.
Recovering from a security breach, like the ransomware attack that hit Atlanta in 2018, can cost millions of dollars. But for local governments and public service agencies, the financial costs are just part of the recovery process. Repairing reputational damage and restoring public trust may take years and can’t be added as a line item in the budget.
Best Practices for Preventing a Cyberattack
Anti-virus and malware detection software are essential tools for preventing successful cyberattacks, but there are additional steps you can take to keep your network and data secure:
- Require multi-factor authentication.
- Segment your network.
- Enforce password policies.
- Implement an identity and access management framework.
- Install patches and updates immediately.
- Add endpoint protection.
- Backup data regularly.
- Create a disaster recovery plan.
Educating and training staff on cybersecurity policies and best practices is one of the most important steps you can take to maintain your security perimeter.
Research shows that human error is the leading cause of security breaches. So even with security measures in place, it only takes one employee clicking on a malicious link or opening an infected file to infect your organization’s network or expose sensitive data.
Cybersecurity Technology and Services for Local Governments
Effective cybersecurity in local government requires a variety of tools and services. Allocate funds in the budget for essential solutions, including:
- Network security monitoring
- Encryption
- Web vulnerability scanning
- Penetration testing
- Antivirus software
- Network intrusion detection
- Firewall tools
The Cybersecurity and Infrastructure Security Agency has compiled a list of free tools and services for local governments and other organizations to reduce risk and strengthen the US cybersecurity infrastructure.
Make Cybersecurity a Priority in 2023
Thousands of cyberattacks occur each day, and they are getting more destructive and expensive to resolve. Prioritizing cybersecurity in local government budgets will help ensure adequate funding for the creation and maintenance of an effective cybersecurity program. Using priority-based budgeting is a great way to ensure your cybersecurity resources are aligned with growing demand.
Additionally, working with partners that understand and prioritize security is a smart decision for governments building strong infrastructures that will meet cybersecurity needs both now and in the future.
To learn more about priority-based budgeting and how this approach creates real change within communities, download our e-book, Top Four Local Government Services That Need a Budgeting Overhaul.
