Being part of a group is usually a good thing, unless it places you in the relatively small but growing number of local government leaders whose municipal websites have experienced cyber attacks. In August 2016, the U.S. Department of Homeland Security’s website warned, “The growing number of serious attacks on essential cyber networks is one of the most serious economic and national security threats our nation faces.”
A new wave of cybersecurity attacks are a growing concern to the public sector because they threaten open access to government data so crucial to citizen engagement.
Cybersecurity threats in general keep city technology teams awake at night. A cyber incident is the violation of an explicit or implied security policy. In general, cybersecurity threats that are commonly recognized as being in violation of a typical security policy include, but are not limited to:
- Attempts, either failed or successful, to gain unauthorized access to a system or its data
- Unwanted disruption or denial of service
- Unauthorized use of a system for processing or storing data
- Changes to system hardware, firmware or software characteristics without the owner’s knowledge, instruction or consent
Turmoil has been caused by Distributed Denial of Service (DDoS) attacks, which are attempts to interrupt access to websites and networks by overwhelming them with artificial traffic from multiple sources. Attackers target a wide variety of important resources, from city websites to banks and news portals, presenting a major threat to open data initiatives. A new report from cybersecurity firm Imperva reveals a 211 percent year-over-year increase in global DDoS attacks.
Protecting data has become an hourly effort for many government IT teams. In 2015, one Louisiana parish tracked a hacker to a university in China. “We’re all scared to death about security,” the parish’s head of technology said in a recent report. “If I lose sleep, that’s where I lose it.”
According to Verisign/ Merrill Research, one-third of all downtime incidents are attributable to DDoS attacks and the public sector is among the “Top 3 Industries Targeted.”
On the local level, DDoS attacks on law enforcement, fire departments and other emergency services are a growing concern. Website downtime is disruptive. In times of crisis, it can be life threatening.
Developing a cybersecurity strategy sounds overwhelming, but progressive government website developers are working on security solutions to outpace DDoS and other emerging threats. Many work with trusted vendors, suppliers and advisors to build safeguards into their infrastructure and data hosting systems to make municipal websites as secure and safe as possible.
So what does an effective cybersecurity plan for local government look like? What are some of the critical security controls? Among the most important considerations are:
- Service Level Agreements
Remote hosting by a reliable vendor who backs up its promises with a Service Level Agreement (SLA) is one way to ensure reliable and dependable website availability and security. Providing a highly reliable hosting environment with quality service is a top priority for Vision. Our SLA, updated in September 2015, includes a 99.9 percent uptime standard. In developing the SLA, the Vision team researched and benchmarked the SLA’s of leading private-sector hosting providers. The result? If Vision fails to achieve 99.9 percent uptime in any calendar month, the company will issue credits on a sliding scale based on the actual monthly uptime.
- Disaster Recovery
Because no hosting platform can ever be 100 percent secure or safe from an unintended outage, redundancy is a critical factor to look for in any local government IT partner. The best hosting platforms incorporate a primary data center along with at least one secondary data center located in a geographically diverse location to provide redundant coverage. In the event of any outage impacting the primary data center, the back-up data center could be activated and website visitors will be able to access your website without interruption through the alternative data center. Another important feature of a strong disaster recovery solution is having processes in place to detect and respond to security or outage incidents quickly.
- Data Replication
The frequency with which your hosting provider replicates your data is also an important consideration. In the event of a catastrophe, a prolonged timeframe between each data replication, could cause many hours of work and important information to be lost. At Vision, we replicate client data every 15 minutes.
For most municipalities, setting up reliable and secure DDoS mitigation systems on their own can be prohibitively expensive. In 2015, one Florida city, whose website suffered a DDoS attack by the hacker collective Anonymous, spent $430,000 on software, hardware and consulting fees to recover and protect their data from future attacks.
In contrast, a government website development company can leverage its expertise and experience across all of its customers to provide automated protection and economies of scale.
Now is a good time for every municipal government IT leader to examine the hosting environment for his or her website. Here are some questions you should ask:
- How strong is the core infrastructure that hosts your site?
- What are your assurances for system uptime?
- Are you protected by a data recovery program?
- How quickly would your site be brought back on line in the event of a failover?
- How much data or work effort would be lost in the event of shifting a backup data center?
- How is your website being protected against DDoS attacks?
The Bottom Line
Investing in cyber defense and enlisting a reliable and proficient cybersecurity partner is cheaper than sustaining a major attack. With cyber attacks occurring at all levels of government, every municipality is at risk. The good news is that with a sound technology policy, training, awareness and the right partner, you can mount an effective cyber defense for your government data and municipal website.
Ashley Fruechting is the Senior Director of Marketing for El Segundo, Calif.-based Vision, a leading developer of software for local government with more than 700 government, non-profit and education clients across the U.S. and Canada. For more information visit www.visioninternet.com.