The Rise of Statewide Cybersecurity

View This Article in BOSS Magazine

Once again, Connecticut is on the leading edge of digital transformation – this time in cybersecurity

In 2021, when we last spoke with Jeffrey Brown, CISO for the State of Connecticut, he was at the beginning of an extraordinary journey, overseeing the state’s digital transformation — the linchpin of Governor Ned Lamont’s mission to create an all-digital state government, a first in the nation.

Now, Connecticut is taking advantage of a first-of-its-kind cybersecurity grant program designed to address risk to information systems across the nation’s state, local, and territorial governments. The grant is administered through the Department of Homeland Security as part of the Biden administration’s Bipartisan Infrastructure Law. “This is an amazing opportunity that we've never really had before,” Brown told BOSS.

The state’s cybersecurity strategy outlines four basic goals and objectives, including ensuring the state information systems are secure, increasing outreach to public and private sectors, addressing the cyber skills shortage, and preparing for increasing cybersecurity attacks with resiliency planning.

“We’ve made tremendous strides,” Brown noted. “We're doing pretty well when we talk about state government under the executive branch, but our focus is also on the rest of the state.”

That “whole of state” focus emphasizes collaboration across government, knocking down silos of information and processes to connect the government and its citizenry more consistently. When it comes to digital transformation, some state governments only deal with their executive branch and large, highly visible executive branch agencies such as the Department of Motor Vehicles or Department of Social Services.

In terms of cybersecurity, the approach isolates municipalities, towns, cities, and tribal entities from much-needed progress. Thanks to whole-of-state, Connecticut now has the support and tools to strengthen those information security processes and systems. “While our focus has always been looking inside the government, suddenly we're looking outside to the municipalities, towns, cities and tribal lands, and we want to make sure they have what it takes for the project to be successful,” he said.

In a small-town government, it’s not unusual to have one person dealing with the entire town’s needs, including IT, and they may not have the time to address cybersecurity. “They don't have the resources, so this is an opportunity to make a big difference across the entire state by not only funneling resources, but also being able to make sure that all of these different municipalities and towns have some idea of what they should be thinking about, what they should be worried about, and which things are going to move the needle in a way that makes them better defended.”

One of the greatest challenges inherent in managing grant money is the speed at which it disappears, so Brown and his team make sure that every project they approve has non-transitory value. Sustainability is another important principle. The state has been leveraging the Connecticut Education Network (CEN), the state’s premier provider of high-performance internet services since 2000. CEN provides reliable, low-latency, high-speed networking and security services, and serves as a public sector ISP for the state.

“Much of our public sector traffic all flows through a single place, so when we look at a shared services model and building up CEN we have a great distribution mechanism,” he explained. “CEN covers 100% of public schools, 95% of private schools, and much of the municipal internet services needs. That’s about two thirds, so there's a third that we have to kind of solve for as well. Shoring up CEN is a golden opportunity for us to quickly and easily get things done that are sustainable over the long term.”

Brown and state CIO Mark Raymond have an instrumental role in governing the grant money.

“If a town submits a project, we review it, make sure that it makes sense, is sustainable and also that it's not duplicative,” he said. “We can't build a comprehensive program for every single town and municipality, so we need to really make sure what we're doing matters.”

Brown has also instituted a monthly meeting where, upon signing an NDA with the state, any interested party can participate. “It's one of many ways that we reach out to municipalities,” he said, noting that they also have regional coordinators and staff providing assistance. “We really are going to be working very closely with the towns, making sure they know that there's resources available for them and helping them where we can.”

While a number of partners at the federal level are providing much needed support to the initiative, the Connecticut National Guard is playing an especially important role. For several years, the Guard has been assessing cybersecurity in many of the state’s 169 towns, which grants the state visibility into cybersecurity at the local level.

The hard data that the Guard collects for the state has helped to see what is needed on a local level, such as endpoint detection and response and security and vulnerability management, valuable cyber insights that many other states are unable to glean.

Brown also works with Connecticut CyberHub, a workforce development initiative run in partnership with the iQ4 Corporation and SDG, with support from private sponsors, which accelerates the development of cyber skills through formal education and hands-on internship experience for students at the high school, community college, university, and adult education levels.

According to Doug Casey of the state’s Department of Administrative Services, the intent of CyberHub is to help these learners up-skill or re-skill to a new career, as well as to fill the shortage of cybersecurity experts in the state. “In addition to helping students qualify for jobs in cybersecurity, the CyberHub also reduces the cost of finding, developing, and retaining cybersecurity talent in the State of Connecticut for public and private sector organizations,” he said.

The effort supports the National White House Cyber Security Strategy’s mission to put a cyber career in the reach of every capable American. The strategy focuses on getting students industry standard credentials quickly and placing them into the workforce, helping to end the industry’s ongoing talent drought.

As for how other states will handle their whole-of-state cybersecurity programs, Brown is confident that everyone will carve their own path. “It is just an amazing opportunity to really start making a difference where it matters most – which is with the little guys.”