Tag: municipal
County and Municipal Executive’s Guide to Cybersecurity
Cybersecurity Myths
by Jeffrey Morgan
Information and cybersecurity are somewhat mythical subjects and many misconceptions abound. Here are a few examples of the many myths surrounding cybersecurity:
- Information and cybersecurity programs are built on technology.
- Cybersecurity programs are expensive.
- Information and cybersecurity programs should be managed by Information Technology staff.
- The greatest cybersecurity threats come from outside your organization.
- Your IT staff would be able to detect a breach or other anomaly.
Do you believe in any of these myths? If so, keep reading because all five of these statements are false.
Why should municipal executives care about cybersecurity?
Information and cybersecurity problems cost money.
According to the 2018 Ponemon Institute Data Breach Study[i], the average total cost of a data breach is $3.86 million. Data breaches aren’t the only type of devastating cybersecurity problem and global costs for ransomware are expected to reach $11.5 billion[ii] in 2019. Malware can quickly bring a halt to your business activities and we have seen municipal services brought down for over a week because of infections that were a result of failure to follow policies and procedures.
Non-fiscal consequences of information security problems may have a more significant long-term impact on your organization than fiscal consequences and may include loss of reputation and litigation.
Cybersecurity incidents are a reflection of organizational management.
Information Security disasters are almost always a reflection on organizational management and the worst time to find out that you didn’t have a comprehensive cybersecurity program is in the aftermath of a breach. Most cybersecurity events occur for one of three reasons:
- People didn’t do what they were supposed to do (i.e. patching, backing up, checking logs).
- People did something they weren’t supposed to do (i.e. using inappropriate web sites, inserting flash drives, opening links on phishing e-mails).
- People have no idea what they are supposed to do (lack of policy, procedures throughout the organization).
Knowing what your staff is doing is a basic management responsibility. Show me a cybersecurity incident, and I will show you a chain of supervision and management failures that go all the way to the top of an organization.
Boards and governing bodies are beginning to see it this way too, and currently, senior C-level executives lose their jobs in roughly one-third of breaches[iii] and other cybersecurity events.
Quite simply, information and cybersecurity are management responsibilities and good information security programs require ongoing management attention. Managers don’t need to be cybersecurity or technical experts; they do need to ensure that appropriate controls, policies, and procedures are in place. Your IT department isn’t the solution; management principles are.
What fails in cybersecurity incidents and breaches?
Depending on what research you read, somewhere between 60 and 90 percent of cybersecurity problems are caused by human error. In my experience, 90 percent sounds about right, although it could easily be closer to 100 percent. This all fits right in with W.E. Deming’s theory that 94% of problems in an organization are a result of management failures.
Major information breaches occur daily and only a small percentage of these make headline news. The most infamous of these include Equifax, Marriott, Yahoo, Target, and Anthem. In many local governments and smaller enterprises, the cybersecurity programs are not sufficiently robust to even identify whether a breach has even occurred.
A small sampling of 2018 information security incidents from the county and municipal sectors includes:
- City of Atlanta
- St. Lawrence County, New York
- Adams County, Wisconsin
- Otsego County, NY
- 50 central New York school districts
What most breaches have in common is that technology didn’t fail – people failed. Policies, procedure, and management failed. In the Equifax breach, someone failed to apply current patches to servers with known vulnerabilities. The CEO, Richard Smith, lost his job over the incident, but he wasn’t the culprit who failed to patch. He did handle the incident poorly, though.
If you take a proactive approach to cybersecurity, you have control over what you do and how you do it. However, in the aftermath of a breach, you may find your organization under investigation by the US Office of Civil Rights if the breach involved PHI and criminal charges may be involved as well. Your response may be dictated by state and federal regulators and you will have lost control of the process. A proactive approach to cybersecurity is clearly more desirable.
How would you handle a breach?
How would your organization be able to identify a breach? In the case of Adams County, WI the breach went on undetected for over five years and resulted in the disclosure of PHI and PII of over 250,000 residents. Five years! Would your staff be able to detect a breach?
Would you know how to respond to a breach? When it comes to cybersecurity, you must know how to respond to disasters before they happen and developing an incident response plan is part of the process of building a comprehensive information security program. A disciplined approach forces you to think about everything so that when a disaster of some sort does occur, you are prepared to deal with it immediately. However, if you have taken a comprehensive approach to cybersecurity, a disastrous problem is far less likely to occur. And, if it does occur, the response and cleanup is considerably easier.
Should cybersecurity programs be built on technology?
Most information and cybersecurity programs are caused by people, so why are most cybersecurity programs built on technology? The foundation for a great cybersecurity program is policy and procedure.
Often, when I talk to executives and managers, their response to information from me is something like, “Wow. This is great information. I’ll show it to my IT people.” This is a pretty clear indication that they didn’t hear anything I just presented. This is understandable; most managers have been conditioned to believe that information security is an IT responsibility.
As an executive, you will be held accountable for a serious cybersecurity incident, especially if the problem was caused by lack of policy, procedure, and management oversight.
Is cybersecurity an IT responsibility?
The conventional wisdom in local governments is that information and cybersecurity are functions that should delegated to an IT Director or CIO. As is the case with most conventional wisdom, this view is wrong.
Cybersecurity is often treated as a form of black magic where wizards practice their secret arts in the data center. In reality, the processes, procedures, and activities that your staff should be performing routinely are well-known and widely published. Are your staff members following these publicly available standards?
Over the last several decades, many comprehensive standards and frameworks for information and cybersecurity have grown and matured. These frameworks have been developed by large workgroups of brilliant people who have devoted their professional careers to the study of information security. Local governments rarely implement these frameworks and instead rely on ad hoc programs designed by staff members untrained in information security practices and procedures. None of these standards or frameworks recommends delegation of cybersecurity to IT staff; all of them recommend comprehensive approaches that include the participation of directors, executives, and senior managers in building a comprehensive plan.
The good news is that this problem is simple to fix. Building a solid, standards-based cybersecurity program is a team effort and the majority of controls that should be implemented are not technical in nature, but administrative.
Major components of a cybersecurity program
How do you know if you have a standards-based cybersecurity program or an ad hoc one? It is easy to identify a real cybersecurity program and six elements distinguish a comprehensive program from a poor one:
1. Comprehensive Security Policy. For most municipal governments, this document should probably consist of 25 or more pages and at least 40- 50 policies, but probably many more. Good security policies are typically developed over a long period of time
2. Acceptable Use Policy. This document describes standards for using company-owned resources, ownership, reporting requirements, etc. but may also address the use of social media, work-at-home policies, and a great deal more.
3. Risk Assessment Report. Risk assessments are a requirement of every standards-based security framework. If you don’t have a relatively current risk report, your security program doesn’t meet the standards of any generally accepted information security framework.
4. Documentation. Extensive documentation demonstrating compliance with your organization’s security policy should be readily available at all times. Do you have evidence that backups are validated? Are logs checked? Excellent documentation is a required component of a true information security program.
5. Management participation. Participation of directors and senior managers in an information security program is a requirement. For most county and municipal governments, managing and understanding the scope of information and the regulatory requirements are beyond the knowledge, skills, and abilities of the IT staff.
6. Accountability. A good cybersecurity program requires participation of staff and management throughout the organization. Responsibility and accountability for the many tasks must be clearly documented so everyone understands their part.
There are many moving parts to a good cybersecurity program and the formula for it looks something like this:
Standards, Frameworks, and Regulations
There is no reason for the existence of ad hoc information security programs, especially in the public sector. There are numerous generally accepted and widely available frameworks for building a comprehensive information security program. These are either free or dirt cheap and they describe exactly how to build an information security program in any organization. A comprehensive approach is not expensive and there are not necessarily capital expenses involved.
You can use any of the following documents to begin building a comprehensive information and cybersecurity program.
ISO/IEC 27001[iv]
This is the international standard for building an information security program. It is available from the ANSI web store for $138. It is roughly 30 pages and describes exactly how to build a comprehensive security program for any organization from scratch.
NIST Framework for Improving Critical Infrastructure Cybersecurity[v]
This framework was created by NIST (The National Institute of Standards and Technology) and it is a risk-based approach to developing a cybersecurity program. It is available for free.
HIPAA Security Rule[vi]
The HIPAA Security Rule is a federal regulation (45 CFR parts 160, 162, 164) for protecting PHI, but it can also be used as a framework for building an information security program. If you have PHI (most counties do) to protect, you could start your program by building it on HIPAA and then use one of the other frameworks to supplement what HIPAA misses. A common misconception about HIPAA is that it is an onerous regulation that is difficult to comply with. In truth, HIPAA sets a low bar and you will definitely need to supplement a HIPAA compliance program with additional policies and procedures.
Action Plan – How to build a cybersecurity program – first steps
Building a comprehensive, standards-based cybersecurity program is a straightforward process. In general, we recommend an approach something like this:
- Establish
a governance committee.
The membership of your governance committee should include people who are expert in various aspects of the information you maintain. For a county government, this might include the county recorder, corporate compliance, public or mental health, human resources, the county attorney, and information technology. A senior executive and a board member should also be on the committee. - Get a risk assessment.
Risk assessment is an absolute requirement. If you have someone on the staff skilled in this, you can do it internally. If your organization has never gone through a risk assessment process, you should contract an outside firm for the first one unless you have staff members who are capable of objectively performing one. Risk assessments should be carefully scoped. - Create an asset inventory
A complete, current inventory of all your information assets including digital data, applications, physical information (paper records), and hardware is an absolute requirement. Most local governments don’t have this information in detail that would stand up to any kind of audit. - Create a
comprehensive security policy.
A primary responsibility of your governance committee will be to draft a comprehensive security policy that addresses your organization’s unique needs relative to risk. The policy should be approved by your governing board. You can and should build your program on any of the three frameworks described above. You’ll have to decide which one is the most appropriate depending on your unique business requirements. - Create a
risk management plan
The risk assessment process will identify many shortcomings in your information security program. It is the responsibility of your board and senior executives to identify risk appetite and priorities for risk mitigation.
How much work does it require?
Does all you have read so far sound straightforward and simple? It is.
There is no reason for any local government agency not to implement a comprehensive cybersecurity program. While the steps are simple, it may not be easy to implement and the problems you encounter are more likely to be administrative and procedural rather than technical. Technical implementation of a cybersecurity program is the easiest part; getting the management structure right is much more difficult.
If you proceed down the path to standards-based cybersecurity, you may find that it takes six months to a year to put all the policy and procedural components into place, get a risk assessment, make a plan, and implement it, but this all depends on the availability of resources and your commitment to the project.
How much does it cost?
Building a security program on standards and best practices may require no capital expenditures but it requires time and attention from managers throughout your organization. In general, local governments don’t lack the funding for technical controls and many of them already have all the required technology in place. What local governments are generally missing are clear policies, procedures, and accountability.
Getting Help
If you would like assistance with your program, give us a call. We provide comprehensive management services for information security and can help you through every step of the process. Visit our website for more information on our services for local governments.
For a detailed multimedia overview of cybersecurity in local
government, watch our video, Cybersecurity,
risk, and liability in local government.
[i] 2018 Ponemon Institute Data Breach Study.
[ii] Top cybersecurity facts, figures and statistics for 2018.
[iii] One-third of data breaches led to people losing jobs.
[v] NIST Framework for Improving Critical Infrastructure Cybersecurity
by 
Cyber week – free risk assessments for counties and city governments
Get a free risk assessment for your county or municipal government organization.
Have you ever had an information security risk assessment? Risk Assessment is the cornerstone of a solid, standards-based information and cybersecurity program. If you don’t have a risk assessment, you don’t have a cybersecurity program.
© Copyright Jeffrey Morgan, 2018
3 ways to improve your organization’s IT services
What are the 4 characteristics of great IT services and how can you ge there? I provide three ways to improve your IT services. Watch my 7-minute video on improving your IT services. This video is for county and municipal executives and managers, public sector board members, and small and medium business owners and managers.
© Copyright Jeffrey Morgan, 2018
by
Software Procurement on-time and on-budget
Are you asking the right questions?
So, you are looking for new enterprise or departmental software or some other type of major system. Maybe you are looking for a new ERP system, an EHR, a 311 system, or an EDMS? Maybe you need a major hardware upgrade as a solo project or as part of a new system project?
You might have already had discussions with vendors, or possibly you even know which product you want to purchase. Perhaps you are planning to purchase the ERP from TBQ International for manufacturing because that is what everyone in your industry uses and it seems like a safe bet. Or all of your neighboring Counties use O’Riley Technologies, so you think it will work for you. Maybe you called Bill, the Public Health Director from your neighboring County and he says Navajo Software makes a great EHR product and that is a good enough recommendation for you. You just want to get the project done.
The big problem with word-of-mouth recommendations is that YOU will be the one responsible for the success or failure of the project – the people who casually advised you will have amnesia about their recommendations if the project fails.
Regardless of where you are in the process, let’s step back and start over from the beginning.
60% of Projects Fail
According to the Project Management Institute, 60% of projects fail. Based on my own observations, the success rate for municipal software projects is probably lower than 40%. Government agencies rarely publicly or even privately admit that a project failed. Spectacular, expensive failures occur in the private sector as well, and the corporate landscape is littered with the carcasses of dead software projects where managers and executives have been forced into early retirement because of outrageous multi-million dollar cost overruns or outright failures.
Projects don’t succeed or fail by accident and you want to be overseeing one of the minority of projects that actually succeed. Whatever decision you make, your organization will be bearing the fruit of or suffering the consequences of your decision for the next 15 – 20 years, or longer. Large systems become a generational legacy, especially in the public sector. Regardless of the type of system you are seeking, the approach to purchasing the system should be the same. You need a rigorous methodology that incorporates staff buy-in and proven techniques for getting the features you need to make better business decisions. That system and the vendor’s culture must mesh successfully with your organizational culture. The vendor will be your business partner for the life of the product and thirty year old systems are not unusual in the public sector.
Why Projects Fail
Here are some common reasons why large software projects fail:
• Top Down management, planning and execution.
• Failure to identify and enumerate specific business goals and objectives.
• Failure to understand current, “as is” business processes.
• Failure to comprehend and plan for the entire scope of the project.
• Weak communication and stakeholder management.
• Failure to establish end-user buy-in.
• Failure to account for organizational culture.
• RFP doesn’t match your requirements for software and services.
• Underestimating the services required to configure the product.
• Underestimating or omitting training.
• Failure to plan for implementation.
• Insufficient or poor project and stakeholder management.
• Lack of Experience.
Over Budget!
I recently read a report written for a manufacturing organization written by a Big 4 consulting firm. The report was extolling the virtues of a top-down management approach to the company’s ERP project. The project was already over budget by $15 Million and the meter was still ticking. I suppose the consulting firm was scrambling for excuses for their disastrous management of a project that will eventually come in 300% – 500% over budget.
I couldn’t disagree more with the Big 4 firm when it comes to top-down management of large projects.
Inside-Out Management
You can’t build airplanes in the air and you don’t build a pyramid starting from the top. Large software procurement and implementation projects must be built from the ground up with a strong foundation that results from giving the stakeholders who will actually be using the system a prominent seat at the table. Yes, you need strong executive support for a major software/business reengineering project, but executives may never use the system. If you don’t build a robust foundation provided by the people who actually understand the granular level of all the organizational business processes, the project will be difficult, seriously over budget, or may fail completely. Succeeding at these types of project requires top-down, bottom-up, and inside-out management. You must examine every aspect from every angle.
Lack of Experience
Lack of experience is another major reason why large system projects fail. Large system procurement and implementation projects are events that occur only once or twice in the career of many employees in the public sector. If you are an executive in a very large public sector organization, you may have full-time professionals who specialize in software procurement and implementation projects. However, there are 3033 County governments in the United States, over 19,000 municipal governments, and nearly 14,000 independent school districts. The vast majority of these organizations cannot afford to employ experienced full-time system procurement and project specialists. If you are an executive in this real world of municipal government, what do you do?
The Role of Organizational Culture
Even when expert, internal resources are available, there may be cultural issues in organizations that can make projects involving significant change impossible. I once worked on a project for a Fortune 100 company that employed a large staff of professionals who could theoretically have performed the large migration project they were undertaking. However, their institutional culture made it impossible for them to complete the project. The ultra-stratified management structure and extreme risk aversion made the execution of such a project impossible for them to implement internally and they had to contract a small army of risk-tolerant consultants to do the work.
RFP’s From the Internet
Unfortunately, many organizations begin the process of software procurement with an RFP. Even worse, they sometimes use an RFP that was downloaded from the Internet and written for another organization with different requirements, different business processes and an entirely different organizational culture. The truth is, the same piece of software that works for your neighboring county, school or city may not work for you. There are hundreds of commercially available ERP products for municipal governments. When you factor in Utility Systems, Public Safety Systems, Records Management Systems, Tax Collections Systems, Traffic Management Systems, Public Health Systems, Code Enforcement Systems, and the like, there are thousands of products from which to choose. How do you navigate such a massive set of choices?
The Solution
Following a rigorous and disciplined methodology for the procurement process will vastly increase the probability of a successful outcome. Maybe you already have a system that works well. Below is a summary outline of the system I have used and honed since my first large software procurement in 1996. If you are experienced at software procurement and implementation projects, this information may seem to be self-evident. However, considering the number of failed municipal software projects I have seen, the message hasn’t really gotten out yet. Notice that the RFP finally comes up in Step 8.
- Draft a Project Charter
- Establish a Procurement Committee & Appoint a Project Manager
- Conduct a Business Process Review
- Identify and Document Goals, Objectives and a Preliminary Budget
- Conduct a Needs Assessment
- Analyze and document your Information Technology Infrastructure
- Document Environmental Factors and Organizational Culture
- Draft and release an RFP (Request for Proposal) or RFB (Request for Bid)
- Review Proposals and Prepare a Short List for Demonstrations
- Site Visits – Customer and Vendor HQ
- Hold Software Demonstrations & Select a Solution
- Negotiate and execute the Contract
One of the primary objectives should always be the improvement of the quality of services in your organization and you should be aware of some of the project risks and political ramifications.
I cover the entire process here. Please feel free to e-mail me if you have comments or want to discuss software procurement in your organization. If you take a sensible and cautious approach using all due diligence, your project will certainly be a success.
If you want to talk about your project, send me an e-mail at jmorgan@e-volvellc.com.
Copyright © Jeffrey Morgan 2015, 2018
by
Cybersecurity in county and municipal government
Information security and cybersecurity are huge problem areas in county and municipal governments. In this six-page article on the subject, I cover the information every county and municipal leader should know including a summary of problems, barriers, specific solutions, and resources. The free document is available here. The intended audience is CEO, CAO, CFO, COO, County or city manager, county commissioner, city council member, or other senior management personnel in the public sector. This is a reprint of my two-part article published in CIO.com last year.
Click below to download.
Have questions?
Want to talk about information security in your organization? Click on the link below to e-mail me and schedule a time to talk.
Don’t hesitate to e-mail me. Initial consultation are free.
© Copyright Jeffrey Morgan, 2018
by
Digital transformation in the public sector
I loathe the term digital transformation (DX). Implicit in the term is that there is something technological about it, something digital; a one-time event you can buy or outsource.
I think we should start calling it management transformation (MX). If your management team is doing its job well, the digital transformation never stops. The success or failure of a digital project is a testament to management performance, and digital transformation is a naturally occurring byproduct of excellence in management.
What is digital transformation?
Technology is a means to accomplish business goals, not an end in itself. Unfortunately, much of the extant information on digital transformation identifies technology as the goal. I think this is the wrong approach.
The best definition of digital transformation I have encountered appears in a 2014 MIT Sloan Management Review article and defines it as “the use of technology to radically improve performance or reach of enterprises.” For the purposes of the discussion that follows, let’s understand that digital transformation is really about improving performance rather than implementing technology.
Take a look at this county technology plan and you’ll find meaningless slogans like, “to be a digital county – ready for today and prepared for tomorrow.” The document is full of buzzwords and comes up short in terms of addressing specific, clearly defined business objectives. Technology is presented as the goal rather than as a vehicle for achieving business objectives. The language always puts technology first, with a vague objective appearing to be an afterthought.
On the other hand, this solid county business plan demonstrates that its management team has a strong understanding of how to achieve business goals and improve performance through the thoughtful application of technology.
Exacerbating the problem are vendors willing to sell their version of DX before explaining that managers must completely reevaluate all their assumptions and processes in order to make a new business solution really deliver value. In organizations where due diligence isn’t a cultural value, the harsh realities of an initiative only see daylight once an iron-clad contract has been signed.
Successful transformation of any kind requires management transformation first. The digital part is easy; the management part is an enormous challenge because managers rarely see themselves as part of the problem. Organizations that pursue technology rather than measurable business objectives are the ones most in need of management transformation.
Some standard scenarios
In one typical scenario, a senior manager wants to replace his or her antiquated enterprise application suite with a new one. In county and municipal agencies, this may mean replacing a 30-year-old midrange system. The business processes on which the current system is based may have roots in the 1950s or earlier and all the business functions rely on indefensible manual processing.
Other scenarios might include just about anything – a 311 system, highly automated zoning and code enforcement, or even something as mundane as reengineering payroll, AR and AP functions.
You sit down at the kickoff meeting and someone, maybe everyone, says, “We want to do everything exactly the same as we do it now; we just want new software.” This isn’t a transformative vision. If your management team shares this attitude, they are overseeing dysfunction and decline rather than leading. Buying a product and expecting performance gains to magically appear is delusional.
The correct way to approach these projects is to identify the business, management, and process problems first, establish goals and objectives, and then start thinking about technological solutions that can meet the business requirements. Technology should come last, not first.
In addition to avoiding change at any cost, many local government agencies overemphasize the role of technology and IT in transformational projects. Digital transformation isn’t a technology initiative; it is a core business initiative and should be managed appropriately with the board and senior management providing leadership, oversight and accountability.
Digital quicksand
Digital projects can quickly become quagmires, the $2.1 billion ACA website being a perfect example. The UK’s National Health Service EHR disaster dwarfed that with a £12.7 billion loss. These losses are frequently blamed on technology, but tech is rarely the problem. Digital project failures are management failures.
I recall one agency that had over 50 concurrent initiatives and projects underway in a single department and they weren’t doing any of them well. As a result, they were throwing boatloads of cash at the problems rather than stepping back and changing their approach by thoughtfully analyzing their objectives and business processes and pursuing a shared vision.
How to get started with management transformation
The MIT Sloan article quoted above identifies nine elements of DX in three major groups: transforming the customer experience, transforming operational processes, and transforming business models and the ideas presented might make a good foundation for your transformation. The authors stop short of telling you how to do it, so I provide the following suggestions for embarking on your own transformational project.
Be brutally honest
Total honesty in management teams is rare, but it’s a requirement to pull off a systemic transformation.
Focus on performance improvement and quality rather than technology
Even the best technology won’t inherently improve performance – that’s the role of management. Figure out how to improve quality and performance. Keep experimenting, brainstorming, and rethinking as you work through the project and don’t compromise until it is absolutely necessary.
Take a holistic view of the entire organization
For your transformational efforts to produce quantifiable results, the management team must share a common vision of what DX will look like in your organization. They need to be able to see the whole picture with all the moving parts in place. The best managers know how to do this, but most managers need to work hard to imagine what a completely transformed operation will look like once the initial transformation cycle is complete.
Understand current and future processes before applying technology
Apply technology only after understanding all your processes, goals and objectives. Your ideal business models and processes should drive technology, not the other way around.
Banish assumptions and sacred cows
In order to be truly transformational, give up all your assumptions about how business gets done and don’t leave changing even a single aspect of your processes and operations off the table.
Are you ready?
Is your management team up to the task? If they are, you probably already have digital transformation happening. If not, start working on your management transformation, first.
© Copyright Jeffrey Morgan, 2018
This article was first published in CIO.com at https://www.cio.com/article/3247305/government/digital-transformation-in-the-public-sector.html
Whitepaper: HIPAA as a framework for county/municipal cybersecurity
Free Whitepaper download for County/Municipal executives.
http://e-volvellc.com/HIPAA_Whitepaper.pdf
HIPAA as an umbrella for county/municipal cybersecurity
Image courtesy of: https://www.prohousedemolitionsbrisbane.com
Are you a covered entity?
Basing a county/municipal information security (infosec) and cybersecurity framework on HIPAA is a logical choice, especially if you have one or more covered entities (CE) in your organization.
How do you know if you have or are a CE? If some department or division within your organization is a healthcare provider, a health plan or a healthcare clearinghouse, they are a CE. If you have clinics, doctors, psychologists, clinical social workers, chiropractors, nursing homes or pharmacies, you are a CE [i]. Moreover, many counties have divisions or departments that function as accountable care organizations (ACO), managed care organizations (MCO), healthcare clearinghouses or health maintenance organizations (HMO). These are all common functions, especially within large county governments.
Are you in compliance?
If anything described above applies to your county or municipal organization, one or more divisions of your organization is a CE and is required to be in compliance with both the HIPAA Security Rule and the HIPAA Privacy Rule.
In my experience, most county governments that have covered entities are out of compliance. Where does your organization stand?
I suspect what often happens is that executives look at something like information security policy requirements and say:
This has tech words in it. IT handles tech stuff. Therefore, I’ll turn it over to IT to handle.
What a huge mistake. An organizational policy dealing with the manner in which information is handled, regardless of whether or not HIPAA regulations apply, requires communication and coordination with legal, HR, IT, information security, risk management, archives, county clerks and other divisions within your organization. It’s not a tech issue; it’s a high-level, interdisciplinary executive function. It is an information governance (IG) issue, and it shouldn’t be handed off to your IT director or CIO to address unilaterally.
Trust but verify
There are a number of reasons why IT should not be delegated sole responsibility for organizational information security. For one, a successful information security program requires checks, balances and oversight. Trust but verify! A successful program also requires expert knowledge of departmental business processes that often exceeds the knowledge of the IT staff. Moreover, if your department heads have equivalent status within the organization, it is not appropriate for a CIO or IT director to unilaterally dictate policy to his or her colleagues of equal status. There are far too many IT departments that have adversarial relations with their end users because of their autocratic and often illogical decrees. Information security requires a team approach with executive and board oversight.
Extend HIPAA to your enterprise
If you have covered entities in your organization and have limited or nonexistent enterprise security policies, I would recommend that you consider building your entire enterprise information security policy on the HIPAA Security Rule in order to raise the entire organization up to that that level while also getting compliant with federal law.
Why? It is highly probable that your organization uses shared facilities, shared IT infrastructure and shared services. Multiple information security levels create a significant management challenge and are certain to cause chaos and confusion. Multiple security stances will lead to security gaps and ultimately to breaches. Keep it simple and operate at the highest standard using generally accepted, good practices.
Develop your policy with the HIPAA Security Rule
There are two major components to HIPAA, the Privacy Rule and the Security Rule. For the purpose of this discussion, only the Security Rule matters, but we’ll definitely discuss privacy another day.
The original HIPAA Security Rule document, 45 CFR Parts 160, 162 and 164 Health Insurance Reform: Security Standards; Final Rule, is 49 pages of small print. However, the meat of the document is contained within the final six pages and includes a handy matrix on page 48 (8380 of the federal register).
The security standards in HIPAA are broken down into three sections, each of which has multiple layers and sub components:
- Administrative Safeguards (9 components)
- Physical Safeguards (4 components)
- Technical Safeguards (5 components)
These three major areas break down into at least 43 separate policy areas where your organization must build safeguards, including risk analysis, contingency planning, backup, passwords, HR sanctions and terminations, disaster recovery, encryption and many more.
Using the components in the matrix should enable you and your IG committee to quickly generate a suite of security policies and procedures that, when implemented and enforced, will vastly improve your current information security stance.
These are all policy areas that must be addressed as a matter of good practice whether or not you are a covered entity. This is why HIPAA is an excellent starting point for municipal governments that are infosec policy deficient.
Next Steps
1. Find out where your organization stands in terms of information security policies and procedures.
2. Find out whether or not you have covered entities in your organization. Must you comply with HIPAA? Are you compliant?
3. Meet with your IG committee to discuss your findings.
4. If you don’t have an IG committee — start one!
5. Download and review the HIPAA Security Rule. Use it to build your organization’s information security policies.
6. Use either the PDCA (Plan, Do, Check, Act) approach or the DMAIC (Define, Measure, Analyze, Improve, Control) approach to maintain continuous improvement.
7. Begin building a culture of security in your organization.
We’ll continue the discussion next week, so check back then.
References
[i] Covered Entities and Business Associates, U.S. Department of Health and Human Services.
This article first appeared in cio.com at http://www.cio.com/article/3188667/governance/hipaa-as-an-umbrella-for-countymunicipal-cybersecurity.html
© Copyright Jeffrey Morgan, 2017
by
County and municipal cybersecurity
The cybersecurity risk to local government
Weak or nonexistent cybersecurity programs represent a massive organizational risk to county and municipal government agencies in the United States. County and municipal executives are often unaware of these risks because they assume that their IT Director, CIO, or an external vendor is managing security and addressing the risks. It is rare that such an assumption is correct.
While the Ponemon Institute[i] found that “federal organizations have a stronger cybersecurity posture than state and local organizations,” the Brookings Institute[ii] concluded that “the vast majority of public agencies lack a clear cybersecurity plan.” Much of the available research is based on small samples and I believe that these studies may understate the scope of the problem. Based on my 23 years of working with public sector organizations, I can state with confidence that most lack any cybersecurity plans at all.
Your job as a municipal executive is to provide leadership and management in order to get the big picture right throughout your organization. What follows is advice on how to ensure that an appropriate cybersecurity program is established and functional in your organization. I recommend that you, the municipal executive, assume high-level responsibility for cybersecurity oversight. You don’t need to know the technical details, but you must know whether or not the appropriate frameworks, infrastructure, policies and procedures are in place and working correctly.
Definitions
The need for information security is as old as civilization and possibly as old as life on earth. Information Security (Infosec) was invented to protect the first secret – whenever and whatever that was. Infosec is not solely a human artifact — my Great Dane always felt the need to maintain security concerning the location of his favorite bones and dead woodchucks. Techniques, methods and models for protecting information haven’t changed all that much and the methods of cybersecurity are largely based on models for protecting physical information.
Information Security refers to the discipline and processes to protect the confidentiality, integrity and availability of all your information regardless of form. Cybersecurity is a subset of information security and applies to digital data. In this article, I may use them interchangeably even though they are not, but counties and municipalities need an Infosec plan that includes cybersecurity.
Municipal data – a pot of gold
County and municipal networks are treasure chests overflowing with priceless gems. Mortgage documents, deeds, births, deaths, ugly divorces, medical records, social security numbers, and military discharge documents are among the many types of publicly accessible documents that may contain PII (Personally Identifiable Information), PHI (Protected Health Information), or other sensitive information. Constituents turn over all this information naively assuming that you are doing everything in your power to protect it from theft and misuse. Are you a worthy steward of this treasure?
Root causes and obstacles
Let’s discuss eight of many root causes of failure to establish appropriate information security programs in local government organizations. Subsequently, we’ll move on to a methodical, practical approach you can initiate immediately to improve your cybersecurity posture.
Personnel
“A lack of skilled personnel is a challenge at both federal and state and local organizations.”[iii] One problem is that many public sector IT Directors and CIO’s don’t have the knowledge, training and background to plan and deliver acceptable, standard’s based comprehensive information security programs. They are often unaware of widely accepted standards, guidelines and frameworks that are readily available, so cybersecurity planning is often amateur and homebrewed. Moreover, HR and hiring managers often don’t understand the required skills[iv] and look for the wrong people.
The largest municipal agencies may employ a CISO (Chief Information Security Officer) but the vast majority of public sector organizations do not have a dedicated information security executive and staff, nor should they necessarily require one.
IT staff members are rarely trained in or even familiar with relevant statutory compliance requirements. I have come to expect a deer in the headlights look from public sector CIO’s and IT staff when inquiring about security policies, privacy policies and other matters of security and compliance. Questions about HIPAA Security Rule compliance, for instance, are almost always met with “What’s that?”
A jumble of regulations
Municipal organizations may have dozens of departments, divisions, or lines of business with varying regulatory requirements from numerous federal and state agencies. Municipal governments do a lot. They may be involved in building bridges, managing traffic signals, providing water, waste, electric and sewer services, supervising elections and recording deeds while providing physical and mental health services and dental care.
A typical County government may have to comply with regulations like HIPAA[v] (Health Insurance Portability and Accountability Act) and 42 CFR[vi] while also complying with policies from CJIS[vii] (Criminal Justice Information Systems) in addition to compliance with state regulations from organizations such as an Office of Mental Health, or Department of Health. Additional requirements for records management from State Archives agencies add to those complexities and often contradict other regulatory requirements.
Shared Infrastructure
Departments with vastly different information security and regulatory compliance requirements often coexist on a shared network where the security posture is designed for the lowest common denominator rather than for the highest. Often, municipal IT staff members don’t have clearly defined policies and procedures for reviewing information such as security logs and system events. Even if they do record these events, their stance is usually reactive rather than proactive.
Silos and turf wars
Counties and municipalities may have highly distributed management structures which function as silos rather than as a cohesive team. In some states, the silos may be a “feature” of constitutional government where elected officials manage some departments and may not be accountable to central executives. One result of this is that a county executive, and consequently County IT, may not have global control of IT and information security because other elected officials choose not to cooperate. Some real world examples I have seen include:
- County Judges and their staff members refuse to sign and abide by acceptable use policies.
- County Sheriffs refusing to cooperate with an IT security audit claiming their security policy and processes are “secret.”
- Social Services commissioners unilaterally declaring that HIPAA regulations don’t apply to their operations.
Silos in organizations create massive gaps in security management. When multiple parties are responsible for security, no one is responsible.
Most security problems are internal
90% of breaches occur because of an internal mistake[viii] and 60% of breaches are a result of internal attacks[ix]. Unfortunately, county and municipal information security programs often treat outside threats as 100% of the problem rather than focusing on more probable internal threats.
Budget
Insufficient budget is often used as an excuse for low quality IT services and lack of security in public sector organizations. It’s usually a red herring. In my experience, there is no correlation between budget and quality in the public sector. I have seen small, low-budget organizations build excellent security programs and have also seen large organizations with eight-figure tech budgets fail to establish even the most elementary components of an information security program. A cybersecurity program will cost money, but it doesn’t have to bust your budget.
Political Hiring
In local government, critical management positions are often filled based on political considerations rather than quality of candidates. Expertise in information security should be a major component in your CIO’s toolkit.
Tech versus strategic thinking
If you think in terms of technology, stop it! I am always a little suspicious of industry professionals who fall in love with a particular technology. Technology is rapidly replaced or superseded so think strategically instead. There is no such thing as a technology problem; there are only business problems. Identify and solve for the business problem and the appropriate technical solution will reveal itself.
Start with Information Governance (IG)
What’s the first step in establishing your cybersecurity program? It has nothing to do with cybersecurity.
Information Security and cybersecurity must be components of your overarching Information Governance (IG) Program, overseen by an interdisciplinary team with executive support. Treating cybersecurity as a standalone program outside of the context of your organization’s information universe will produce a narrow approach. Do you currently have an IG program?
I can hear some grumbling right now. “Jeff, when do we get to the important stuff?”
IG is the important stuff. There are no silver bullets. There are no miracle pills that will address your information security requirements. No miraculous hardware or software will magically keep your information safe unless you have the right policies in place. There is some real work to do here and the P-things are the most effective tools to pack for your InfoSec journey. You will develop these from your IG Program:
Policies Processes Procedures
Protocols People
What is information governance?
I like Robert Smallwood’s succinct definition of Information Governance: “security, control and optimization of information.“[x] In order to develop sound InfoSec and cybersecurity programs, you must know what you are protecting and why you are protecting it. The purpose of the IG program is to map, understand and manage your entire information universe. The map you create will serve as the foundation for your information security programs.
In a municipal government organization, an IG committee may include legal, HR, records management, IT, finance, and auditors, as well as other departments. Let’s say your municipality has a public health clinic, recorder of deeds, personnel/payroll and a sheriff. This means you have medical records, prisoner health records, recorded 911 calls, police reports, mortgage documents, confidential personnel records, payroll records, social security numbers and a lot more. The people with special knowledge about the nature and disposition of all this information must be on your committee.
In some organizations, information and security policy is developed at the whim of the CIO or IT Director. Is that IT Director expert in statutory requirements and industry best practices for all the areas mentioned above? I doubt it. This is why you need a cross-functional team to map the universe and make a comprehensive plan.
Establishing a comprehensive information security program
Once you have begun building your IG foundation and framework, your Infosec and cybersecurity requirements will be much clearer. Also, IG, Infosec, and Cybersecurity are not one-time activities. They require a process for continuous improvement like PDCA (Plan, Do, Check, Act) or DMAIC (Define, Measure, Analyze, Improve, Control). Get something in place first, and then continue to improve it. Attempting to get it perfect from the start will only result in implementation delays. This job never ends but it gets much easier once a solid foundation has been built.
Information Security Management Systems (ISMS), Frameworks and Standards
Once you have a comprehensive understanding of your information universe, develop security policies and programs for implementation and enforcement of those policies.
Use an existing framework. Designing comprehensive information security programs is more complicated than installing firewalls and anti-virus software and there is a great deal to think about.
There are many freely available information security tools in addition to standards and frameworks that require payment or membership in an organization. You can build a successful security program using only free tools, but my crystal ball is on the fritz today so I can’t see which tool is best for your organization. I wish I could tell you there is a one-stop shop, but there isn’t. You will have to evaluate your situation, do the research and make informed decisions about the best approach for your organization. Following is a brief discussion of some of them.
NIST
The National Institute of Standards and Technology (NIST) provides an enormous quantity of information and the gateway to it is available here. NIST’s Framework for Improving Critical Infrastructure Cybersecurity is available here and a new draft was release in January of 2017. Their Cybersecurity Framework Workshop starts on May 16, 2017 in Gaithersburg, MD if you would like to attend and learn more about it. You can also view a webcast with an overview of the Framework. In their words, “The core of the framework was designed to cover the entire breadth of cybersecurity . . . across cyber, physical, and personnel.“[xi]
NIST also provides three Special Publication (SP) series: SP800 deals with Computer Security, SP1800 contains Cybersecurity Practice Guides, and SP500 covers Computer Systems Technology.
SP800-53, Security and Privacy Controls for Federal Information Systems and Organizations will likely be an essential part of your planning process if you are building upon NIST.
HIPAA
If a division of your public sector organization provides clinical services, it might fit the definition of a covered entity (CE). If so, that division is required to comply with applicable federal regulations including the HIPAA Security Rule. The regulation provides a clear, jargon-free framework for developing information security policies and programs. While it won’t address all the requirements for a municipal cybersecurity program, it can help you build a solid foundation for your security programs. I don’t have any official data on HIPAA Security Rule compliance in municipal organizations, but my personal experience is that it is extremely low. Is your CE compliant? If not, why not bring your entire organization up to HIPAA standards?
I have worked extensively with HIPAA regulations and NIST products for nearly 2 decades and I like them a lot. If they are not a good fit for your organization, there are other resources, including the following three.
ISF
The Information Security Forum (ISF) publishes the Standard of Good Practice for Information Security, available free to ISF members.
ISO
The International Organization for Standardization (ISO) publishes the ISO/IEC 27000 family of standards for Information security management systems. ISO products are not inexpensive, but in the overall scheme of things you might find them to be a reasonable investment. Organizations can certify through accredited registrars, which can also be an expensive process.
ISACA
ISACA publishes COBIT5, “the leading framework for the governance and management of enterprise IT” which provides an integrated information security framework as part of a larger IT governance framework. According to Joseph Granneman, “It is the most commonly used framework to achieve compliance with Sarbanes-Oxley rules.”[xii]
The role of vendors
Trusted vendors can be helpful in building your programs, but overreliance on vendors for security advice is a suboptimal approach. While they may be knowledgeable about many aspects of your industry, only you and your cross-functional IG team truly understand your business requirements. Their job is to “sell you stuff” but they will generally draw the line at writing policy and taking responsibility for overall information security in your organization. If there is a major breach or some other catastrophic security event in your organization that becomes public, you are the one whose picture will be in the paper.
Summary – one step at a time
Take a few simple steps to improving your cybersecurity infrastructure:
- Establish an IG committee and program.
- Discover and map your information universe.
- Establish an information security framework and security policy.
- Develop and implement your cybersecurity plan, based on the above.
- Use a cycle of continuous improvement.
Note:
This article first appeared in two parts in my CIO.COM column at:
County and Municipal Cybersecurity Part 1
County and Municipal Cybersecurity Part 2
A continuation of the subject appeared in:
Hipaa as an Umbrella for County/Municipal Cybersecurity
References, Resources and Further Reading
Four critical challenges to state and local government cybersecurity efforts. Government Technology. July 17, 2015.
The need for greater focus on the cybersecurity challenges facing small and midsize businesses. Commissioner Luis A. Aguilar, October 19, 2015. US Securities and Exchange Commission.
How state governments are addressing cybersecurity. Brookings Institution. Gregory Dawson and Kevin C. Desouza. March 2015.
World’s oldest hacking profession doesn’t rely on the internet. CNBC
Four critical challenges to state and local government cybersecurity efforts. Government Technology. July 17, 2015.
Human error is to blame for most breaches. Cybersecuritytrend.com.
Cisco 2017 Annual Cybersecurity Report.
Endnotes
[i] The state of cybersecurity in local, state and federal government. Ponemon Institute. October 2015.
[ii] The vast majority of the government lacks clear cybersecurity plans. Brookings Institution. February 3, 2015. Kevin C. Desouza and Kena Fedorschak.
[iii] The state of cybersecurity in local, state and federal government. FCW.
[iv] Cybersecurity unemployment rate at zero. SC Magazine. Doug Olenick. September 2016.
[v] HIPAA Security Rule, Combined Text.
[vii] CJIS Security Policy Resource Center
[viii] IBM X-Force 2016 Cyber Security Intelligence Index
[ix] The biggest cybersecurity threats are inside your company. Harvard Business Review. Marc van Zadelhoff. September 19, 2016.
[x]Information Governance for Executives. Robert Smallwood. 2016 Bacchus Business Books.
[xi] National Institute of Standards and Technology.
[xii] IT security frameworks and standards: Choosing the right one. Joseph Granneman, Techtarget.com. September 2013.
More Information
If you found this information useful, or would like to discuss cybersecurity in your organization in more detail, please feel free to e-mail me at jmorgan@e-volvellc.com. I would be glad to discuss your situation.
This article first appeared in cio.com at http://www.cio.com/article/3184618/government-use-of-it/county-and-municipal-cybersecurity-part-1.html
© Copyright Jeffrey Morgan, 2017
by
County and Municipal Cybersecurity Whitepaper
Free Download – County and Municipal Cybersecurity Whitepaper:
http://e-volvellc.com/County_Municipal_Cybersecurity.pdf
Recent Comments