State CISOs up against a growing threat environment with minimal funding, report finds

Dive Brief:

State governments across the U.S. are facing a more sophisticated and complex cybersecurity landscape than ever before, and CISOs in many of those states say they don’t have enough funding to protect their computer systems and critical infrastructure, according to a report released by Deloitte and the National Association of State Chief Information Officers.
State-level CISOs are being asked to protect computer networks that rely on legacy technology and limited IT-security budgets, according to the report. Among the top concerns for these states is the protection of local utilities and water infrastructure, where staffing is limited. The technology is often not up to date and sophisticated state-linked threat groups also actively target these systems.
Nearly 2 in 5 state-level CISOs say they are not getting the financial support they need to combat these threats. While federal budgets allocate about 10% to 12% of IT spending to cybersecurity, just 6% of respondents said their IT budget allocation was larger than 10%.

Dive Insight:

State and local governments have faced an increased threat of both criminal ransomware and state-linked attacks in recent years. In some cases, threat groups have exploited legacy technologies, including older computer systems and dependent on out-of-service or otherwise unpatched software.

“Out of the top five barriers, the top of the top five barriers is legacy technology and the challenge of putting protection provisions around them,” said Srini Subramanian, a principal at Deloitte, the company’s Global Government and Public Services consulting leader and co-author of the report.

Just last week, the Cybersecurity and Infrastructure Security Agency reiterated warnings about hacktivists targeting drinking and wastewater utilities in the U.S. Local operators often rely on aging technology, use devices that are either unpatched or otherwise exposed to the internet and are still using default passwords.

Many have failed to enable multifactor authentication.

One recent investigation delved into the Suffolk County ransomware attack linked to AlphV/BlackCat in 2022. The threat group exploited a vulnerability in Log4j and took advantage of aging computer systems, firewalls that were bypassed and local officials ignored FBI warnings about active threat signals prior to the attack.

The state of New York has taken multiple steps in recent years to strengthen its cyber posture, including naming a statewide cyber chief and launching a statewide cyber strategy.

The Department of Homeland Security last month allocated $280 million to the State and Local Cybersecurity Grant Program.