Cyber Risks for Government Agencies Are on the Rise. Why Security Is Still an Uphill Battle

State and local government and education organizations (also known as SLED) were always at risk from cyberattacks, but the rise of generative AI has increased those risks significantly. Attackers are far more sophisticated than they’ve ever been, utilizing phony emails and even deep faked phone calls to trick unsuspecting employees into granting them access to systems.

During the first eight months of 2023, malware attacks on government organizations increased year over year by 148 percent, ransomware incidents by 51 percent and endpoint security services incidents—such as data breaches, unauthorized access and insider threats—by a staggering 313 percent, according to the 2022 Nationwide Cybersecurity Review. Schools were also heavily victimized by cyber attacks, with more than 1,300 publicly disclosed cyber incidents since 2016, reports K12 Security Information Exchange (K12 SIX). That “equates to a rate of more than one K-12 cyber incident per school day being experienced by the nation’s public schools.”

It is truly a scary environment, and it’s never been easier for attackers to wreak havoc with remote workforces, BYOD and data in the cloud.

Government and education organizations are battling against these increased threats with limited budgets and competing for the best cybersecurity staffers against companies that can offer better pay. According to data published in Axios, the average private sector cybersecurity role pays 14 percent more than public sector jobs. Another challenge in the public sector, especially with schools, is dealing with staff who are not technically the most savvy. Then there’s the digital elephant in the room: resistance to change. Employees feel comfortable with their familiar processes and worry that new solutions could render their work—and them—less valuable.

So, what if a government or education organization doesn’t have the budget or resources to get the cybersecurity talent and tools they need? Here are three other avenues they can take to be safe.

1. Pool resources at a state level

Licenses for cybersecurity products can be purchased at the state level, then rolled out to their “constituents.” For this to work, state-level officials have to overcome any resistance to change. They need to make sure that every agency, from the Department of Corrections to the Department of Transportation, is on board with whatever tool they’re using. That’s a challenge because each of these departments might be doing something different for security. They have their own staff. Their email addresses are different. But this way, everyone can benefit while keeping costs down.

2. Push for continued grant money

In 2022, the Biden Administration announced $1 billion in funding for a state and local cybersecurity grant program. The program was heralded by cash-strapped government and education organizations for allowing them to implement basic security protocols as well as gain access to state-level resources, as mentioned above. However, there are concerns among state and city leaders that the funding will not be fully dispersed, threatening ongoing cybersecurity efforts. It’s vital for ongoing cybersecurity efforts that this grant program not only runs its course through its intended four years, but continues on in some form going forward.

3. Lobby for cybersecurity legislation

Around the country, leaders at the state, city and county level are working with their legislatures to pass laws that mandate certain cybersecurity protections. For example, Connecticut enacted legislation in 2023 that “establishes a cybersecurity task force” that will develop strategies and coordinate cybersecurity efforts among the state’s agencies and other entities. This is a promising development for Connecticut, but much more cybersecurity legislation failed than passed last year. It behooves both public and private sector cybersecurity leaders to work with their elected officials on stronger cybersecurity programs.

Reactive action is the most expensive path

All three of these avenues insist on taking proactive action to stop cybersecurity threats before they become large problems. We don’t need to look too far back to see the havoc that breaches cause to a city or state’s population, and the subsequent expense of either paying a ransom or fixing the problems they caused. A ransomware attack on the City of Dallas last year led to spending of $8.5 million in taxpayer money on software, hardware, the hiring of forensics experts, in addition to two years of credit monitoring for people affected by the breach.

With the right cybersecurity resources, it’s likely Dallas could have avoided the attack and not incurred such a large expense. Many tools on the market, including those that proactively manage software vulnerabilities, can ultimately save government and educational organizations money by stopping breaches before they happen.

The United States allocates a significant budget to physical security, but cybersecurity is overlooked and underfunded. To deal with this critical frontier, cybersecurity solution providers need to work with government and educational agencies to keep their data secure and protect the people they serve. The landscape is becoming more and more dangerous. Agencies need to ante up, or risk their organizations and constituents paying the consequences.

About the author

Sarah Gray is the Director of Product Marketing at Adaptiva, a Global Leader in Autonomous Endpoint Management.