Findings are presented as a numerical score – much like a credit score – making it easy for everyone to understand how well the municipality can withstand an attack. Because time is of the essence, these insights are captured in near real-time so that security gaps can be rapidly identified and city leaders can make quick and effective decisions about risk reduction.
Continuous monitoring with security ratings is a beneficial approach for municipalities with decentralized or distributed security programs, which range from city hall to local schools. This method enables the measurement of the overall effectiveness of the security program, rather than a siloed approach to security management and measurement.
4. Scale security monitoring to third parties
As the SolarWinds supply chain attack showed, third parties pose a significant cyber risk to government entities. Although the federal government was the main target of that hack, smaller organizations are just as susceptible to these attacks and must up their game. Simply reviewing a third-party’s cyber security policies and protocols isn’t enough – deeper and continuous cyber security assessment of their security postures is needed.
But with small IT departments and restricted budgets, it’s not always easy for local governments to scale third-party risk management programs across the hundreds of contractors that support municipal services.
Fortunately, security ratings can also be applied to third-party networks.
Before a prospective supplier is selected, municipalities can use security ratings to get an instantaneous snapshot of each potential vendor’s security posture. During onboarding, acceptable risk thresholds can be established and incorporated into contracts, much like an SLA. If the vendor’s rating falls below that score anytime during the relationship, an alert is generated and the appropriate department can engage the vendor to initiate remediation.
The great thing about using security ratings for third-party cyber risk management is that the capability allows cities to flexibly scale their vendor risk assessments with ease, no matter how large their vendor portfolio.
5. Update policies for employee devices and remote access
In today's digital age, many professionals have the flexibility to work from home or while on the go. While this can be convenient, it also poses a security risk. With more personnel working outside the traditional network perimeter, municipalities must also factor updated policies and network security guidelines for remote and home-based access into their cyber security plans.
Actions include tightening firewall and VPN policies and monitoring the network for unusual activity. Users should be encouraged to embrace easy-to-implement security measures, such as always using secure connections, regularly applying patches, and practicing strong password hygiene.
Mitigate risk with a proactive municipal cyber security plan
There are other elements to a layered cyber security strategy that we haven’t mentioned here, such as endpoint security, intrusion detection, access control, and secure backups. Each is important, but as cyberattacks get more sophisticated, defense strategies must also evolve.
In today’s high-risk environment, municipal leaders must find ways to discover hidden security issues, continuously monitor risk, and educate users about how they can protect themselves – and their cities – from cyber threats while working remotely. Threat actors are stealthier and more persistent; municipalities must be prepared.
