There are two basic elements of technology that every municipality must have. Most places already do this, but it doesn’t hurt to highlight them.

The first is an expert to advise you and your governing body on technology issues. As with other experts you hire—a police chief to advise you on law enforcement concerns or an engineer to advise you on infrastructure issues—you must be able to trust the expert you hire in this case to give you their best advice based on a clear understanding of your municipality and its use of technology.

The second is data and system backups: to have sound and regularly tested procedures for data and system recovery. It is critical that you establish and execute policies that fit your organization’s level of technological complexity; not doing so is gross mismanagement.

You must routinely test your backup procedures to make sure they are working properly. That will give you confidence they will work when you experience a cybersecurity breach, ransomware, or a disaster incident. Your expert should decide what your backup regimen should be.

By now, every municipality should have those in place. If not, you’re late! Get that done, then come back to the rest of this article.

For the rest of you, now what? The answer: develop tech fitness. A technologically fit agency has sound technology management policies; its employees are regularly trained in cyber hygiene (security awareness) practices; and it competently manages delivery of its technology services, including cybersecurity prevention and incident mitigation.

Over the years various technology organizations have developed frameworks that organize and structure cybersecurity practices. The Center for Internet Security’s Critical Security Controls is the most well-known of these standards. While their details may be challenging for smaller organizations to implement, the concepts of tech fitness track the main points of the CIS and other frameworks very well.

Each municipality needs to decide the best approach for their community based on their technology profile and risks. This link will give you a head start on the other elements if you want to get ahead. This rest of this article focuses on ensuring a critical element; that your staff is trained to avoid creating a cyber incident.

Cyber Hygiene/Security Awareness

Whatever you call it, employees need to be trained and periodically reminded how to act responsibly when opening emails, clicking on attachments and links, constructing passwords, and avoiding fake websites. Your tech expert should help assess your needs and develop the best way to approach training.

The best approach is to enroll employees in an online program that provides video training modules with monthly quizzes and periodic penetration testing using test phishing emails. Keep in mind that the best services may also be the most expensive. Municipalities will need to sift through providers and the wide range of services they offer to meet local needs.

Make sure the training includes the use of mobile devices as well as desktop, laptop, and handheld devices. Don’t forget to involve non-office workers as well: public works, police, fire, and inspections personnel all use computers in some way and need to be trained.

There are also low-cost alternatives. These include the following:

• Subscribe to the SANS Institute monthly OUCH newsletter and send them to staff. SANS is an internationally known cybersecurity training and education organization. OUCH is free; sign up for it here.

• Take advantage of resources from your cyber insurance carrier. Today, every organization needs cybersecurity insurance protection. Most insurers, especially those that provide cybersecurity coverage, provide training and educational materials for employees.

• Use online training videos (i.e., search YouTube). Many organizations (including local governments) have posted training programs online. Do a web search for “cyber security awareness employee training videos” to find videos that might meet your needs.

• Use employee-led in-service training at staff meetings. Ask staff members to take turns developing short presentations each month or quarter. Reinforce the content of the latest OUCH newsletters. Discuss cybersecurity in the news and how it could affect your organization.

• Stopthinkconnect.org is a U.S. government cybersecurity resource with a wide range of cyber security resources (printed, website, video).

• Partner with your local board of education, county colleges, and other area agencies. Everyone needs training. Leverage staff, volume, and consistency.

• A cybersecurity vendor, Total Defense, maintains a Security Tips of the Day website. Not every entry may be relevant for your organization, but it can serve as a useful source of information to disseminate to your staff.

Establish formal cybersecurity training policies, put someone in charge of them, and include them in routine risk management training. Keep training records; you may need to provide documentation of employee training when filing an insurance claim in response to a successful cyber attack. Many local government self/joint insurance funds and insurance companies provide portals or online systems to track employee training. Take advantage of them.

Don’t forget new employees; they should take some form of cyber hygiene training as part of their onboarding.

Ongoing training doesn’t have to be just organization related; you can include guidance for parents of K-12 students, how security affects families and nonprofit groups, etc. Since most employees and their families encounter online technology outside of work, developing their understanding of the risks and responsibilities of using their devices has value. It will help protect the entire community and may lead to increased awareness in related areas as well. It may also provide some good use case discussions for your organization. The stopthinkconnent.org site has resources for specialized groups.

Finally, take advantage of your local library. Most libraries are involved in technology training in some way. They may be a resource you can leverage. And if yours doesn’t do tech training, encourage them to. Most state (and national) library associations can provide guidance on how to approach this.

 

MARC PFEIFFER, an ICMA Life Member, is a marginally retired New Jersey town administrator and state agency manager. He is currently a senior policy fellow and assistant director at Bloustein Local, a unit of the Center for Urban Policy Research at Rutgers University. (marc.pfeiffer@rutgers.edu)