The threat landscape is changing for cities
As with all industries, threats change often, and groups like CISA and the FBI are now stepping in to alert government agencies of all sizes to ongoing and new threats, such as the recent MOVEit vulnerabilities being actively exploited by Russian hacking groups. Alexander Heid, chief research officer at SecurityScorecard, says his company, under the auspices of CISA, has been used by federal and local agencies to scan their IP addresses for related exposures. This is part of a suite of solutions shared with the CISA for use in government agencies for these types of cases, he adds.
The top threat Heid has uncovered in their scans against government agencies of all sizes continues to be ransomware, which amounted to nearly 90,000 IP addresses in US government agencies that were fully victimized. “There are 50 states just in the US, and within those states there are many more municipalities and townships. They were early internet adopters, so they’re going to have the oldest vulnerabilities and the largest attack surface. Unfortunately, they also have lower budgets, so they need to take advantage of federal and state resources,” he adds.
Brad LaPorte, advisor for Lionfish Technical Advisors and a former Gartner Analyst who specialized in ransomware, agrees, adding that ransomware still runs rampant in local government agencies because their small budgets, legacy systems, and lower cybersecurity maturity level makes them softer targets than other organizations.
Why work for a city or municipality?
Because of these low budgets, city and municipal agencies have more trouble competing in the hot cybersecurity job market, so it takes a special type of person to want to work for these agencies. Like Harper, who’s won several awards for his global work on digital trust and Internet policy for developing regions, Andrew Alipanah, chief ‘innovation’ security officer for the city of Riverside, California, says he is drawn to the public sector out of a sense of service.
“Yes, the private sector pays more. But, for me, it’s a personal thing: I’ve been working in city agencies for a long time and find satisfaction in being a public servant,” he explains. “That said, there are cities and then there are cities. Riverside is a beautiful city, and one of the more competitive cities where pay and benefits are better than many other municipalities.”
Alipanah took advantage of the fast-track career path leading to management, starting out as IT specialist for the City of Brea, where he wore many hats. He then moved into the role of senior information technologist at the Orange County Probation Department, then SEC Ops manager at the County of Orange, and, most recently to his current role. Sometimes, he refers to this career trajectory as a recruiting point, explaining: “It’s a matter of what you want to get out of cybersecurity as a career, whether it be hands-on or leadership.”
