A Cybersecurity Primer for Local Leaders

Why It’s Important, What to Know, and What to Do

By Alondra Berroa, Program Associate and Meghan Cook, Program Director, Center for Technology in Government, University at Albany, State University of New York

Counties and local entities are increasingly vulnerable to cyber threats and continue to fall victim to a range of cyber attacks. Protecting against a cyber attack is an effort that requires a unified approach from the entire county including executives, administrators, legislators, supervisors, information technology (IT) and security staff, department heads, counsel, and employees. It’s a misnomer that protecting the county is only for IT and security leaders. It is a countywide challenge that requires a countywide approach.

But in order to do that, it is helpful for everyone within the county to have a basic understanding of cybersecurity, cyber preparedness, and their role in their county’s cyber risk management and incident responses.

At a workshop and meetings at NYSAC Fall Seminar, county leaders identified a long list of cybersecurity concerns, including: tracking the cyber threat environment, making sure critical data is protected, knowing the best way to allocate scarce funding, what skills to recruit to boost security, the specific vulnerabilities facing their county, the financial impact of a cyber breach, and what questions to ask of their IT team. In response, county leaders asked NYSAC to develop resources that could improve their basic information of cybersecurity, with specific attention on what county leaders can and should do. NYSAC reached out to the Center for Technology in Government at the University at Albany to assemble a statewide advisory team and develop a Cybersecurity Primer for County Leaders. CTG UAlbany, an award-winning research institute with expertise in building capability among government leaders, was the/a natural choice to develop this important piece of work.

The Cybersecurity and Infrastructure Security Agency (CISA) defines cybersecurity as “the art of protecting networks, devices, and data from unauthorized access or criminal use and the practice of ensuring confidentiality, integrity, and availability of information.” As governments carry out critical operations and services, protecting all assets has become an increasingly complex and continuous effort but one that needs attention and resources.

The Cybersecurity Primer for County Leaders, available on NYSAC’s website, is geared for all the non-technical leaders within a county that must play a role as part of their county’s protection team. It sets forth industry accepted cybersecurity frameworks described in layman’s terms and was created so that every official and county employee, regardless of technical background, can work in a unified approach with their IT and security leaders. As NYS counties are already working to safeguard against cyber attacks, this Primer is another tool to help all county employees become part of the team.

Over the course of several months, CTG UAlbany, NYSAC, and the Statewide Advisory Team curated information from expert cybersecurity organizations, discussed pressing questions with county leaders, and incorporated input and expertise from government and cybersecurity leaders to develop the Primer. NYSAC Deputy Director Mark LaVigne described the Primer as “a direct response to the needs expressed by NYS’s county leaders as they looked to build their understanding and their colleagues' understanding in the complex environment of cybersecurity.”

Hackers and malicious adversaries have gotten more sophisticated and are increasingly targeting local governments. In short, the time for a county leader to enhance their own cyber knowledge and understanding is now. J. Ramon GilGarcia, Director of the Center for Technology in Government (CTG UAlbany) said “The Cybersecurity Primer for County Leaders is a launching point to increase cybersecurity awareness among all local government officials and employees. With CTG UAlbany’s expertise in research-to-practice translation and NYSAC’s commitment to county leaders, this Primer brings together a combination of technical and policy information with actionable guidance so that leaders can better understand and manage their own cyber risk.” The Primer has basic information set forth in three sections:

• Why Cybersecurity Should be a Priority for County Leaders.

This includes a NYS story with facts and figures on cyber incidents to date;

• Common Cybersecurity Questions and Answers. This includes real questions asked by NYS county leaders and curated responses; and

• Top Three Cybersecurity Preparedness Actions for County Leaders. This includes what cyber preparedness actions county leaders might be doing now if they are not already.

Also included are three appendices including Cybersecurity Terms and Definitions, Cyber Resources by Organization, and a list of references and websites used to develop the primer.

At Nationwide® , participant priorities are our priorities.

From enrollment through retirement, our people, tools and education support participants so they can confidently make smart decisions.

To find out more, contact:

Brendan Morrison - Program Director 617-686-8990 morrib16@nationwide.com www.nrsforu.com

Absolute Auctions & Realty, Inc.................................... 33 Auctions International, Inc............................................ 50

Barton & Loguidice ........................................................ 59 C.O.D Deliveries LLC..................................................... 23

Calcaterra Pollack LLP..................................................... 6

CANARX......................................................................... 17

Capital Markets Advisors, LLC...................................... 55 Centrica Business Solutions........................................... 27

Collar City Auctions Realty & Mgmt, Inc. ................... 46 Fiscal Advisors & Marketing, Inc.................................. 55 IEM.................................................................................. 40

LaBella Associates............................................................. 4

Municipal Electric & Gas Alliance Inc.......................... 40 Nationwide...................................................................... 50

N.K. Bhandari, Architecture & Engineering, P.C......... 23 New York Power Authority............................................ 54 NYCLASS........................................................................ 57

NYMIR............................................................................ 21

NYSHIP........................................................................... 51

NYSTEC ............................................................................ 4

PERMA.............................................................................. 2

PFM ................................................................................. 45

PKF O'Connor Davies, LLP........................................... 18

ProAct, Inc...................................................................... 41

SMRT............................................................................... 56

Siemens Industry, Inc..................................................... 12 Systems East, Inc............................................................. 60 Tectonic Engineering Consultants, Geologists & Land Surveyors, D.P.C. ............................................................ 37 three+one ........................................................................ 30

UnitedHealthcare............................................................ 38

Wendel............................................................................... 6

Workday ............................................................................ 3

Did You Know?

• NYSHIP is available to virtually all public employers across New York State

• Over 800 counties, cities, towns, villages, school districts and special districts participate in NYSHIP

• More than 1.2 million public employees, retirees and their families have health insurance through NYSHIP

A unique health insurance plan developed for New York’s public employees

For additional information regarding The Empire Plan or the Excelsior Plan, public employers may visit our website at www.cs.ny.gov or email the Public Employer Liaison Unit (PELU) for the New York State Health Insurance Program at PELU@cs.ny.gov.