The use of mobile devices and their proliferation on government networks are creating new cybersecurity challenges and mobile device management requirements at a time when the threat landscape is larger and more sophisticated than ever before.
This was one of the main takeaways from a recent Government Technology webinar entitled, “Future-Proofing Mobility Management: Overcoming Legacy Hurdles in the Public Sector.”
Moderated by Sean McSpaden, Senior Fellow at the Center for Digital Government and Principal Legislative IT Analyst at the Oregon Legislative Fiscal Office, this webinar explored the shifting mobile landscape across state and local government agencies and the key risks and security threats posed by outdated, legacy government systems.
For this incredibly important discussion, Sean was joined by Bill Harrod, the Public Sector CTO at Ivanti, and Nancy Rainosek, a Senior Fellow at the Center for Digital Government and the former Chief Information Security Officer for the State of Texas. These experts in government technology and cybersecurity wasted little time exploring how mobile adoption has soared across today’s state and local government agencies.
”…when I served as Oregon’s deputy state CIO about a dozen years ago, we had approximately 7,500 mobile devices deployed across the executive branch,” said McSpaden. “I had a conversation recently with our state Chief Information Security Officer, and I believe they have just short of 30,000 devices deployed today.”
That explosion in the number of mobile devices accessing government networks can be a challenge for government agencies, many of which are leveraging outdated systems. As McSpaden explained, “…[M]any state and local government agencies find themselves constrained by outdated systems that really weren’t built for that kind of dynamic mobile workforce. Legacy mobile device management tools and our broader IT infrastructure pose a growing risk to productivity, security, and service delivery.”
The expanding ecosystem of mobile endpoints has increased the attack area for bad actors, leaving state and local government agencies more vulnerable to cyberattacks and breaches. Considering the important role that these agencies play in delivering critical services to constituents, such breaches could have a hugely negative impact.
“[Citizens] expect that the services they receive are safe and secure, meaning the water that comes out of their tap is clean and has the proper chemicals in it, or that when they wake up in the morning, their electricity is going to work,” said Rainosek.
“During my last year at the [State of Texas], we had five water system attacks. Two of them [involved] the cyber army of Russia trying to change the chemical balance in the water. If you lose citizen trust by having somebody who lives on the other side of the world able to go in and access these systems, then we’re lost.”
Fortunately, there are tools that state and local government agencies can utilize to help manage these endpoints and mitigate vulnerabilities.
Leveraging a new generation of highly capable MDM tools
Today, state and local government agencies are almost universally using a patchwork of disparate, legacy mobile device management (MDM) tools to secure and manage the mobile devices and other endpoints interacting with their networks. However, this quilt of siloed, heterogeneous MDM tools all have different capabilities, and each is saddled with its own limitations and shortcomings.
“Legacy tools [are often] separate tools and interfaces for mobile devices versus laptops, desktops, or other network endpoints,” explained Harrod. “[This] makes it much harder for the IT administrators and the security staff to make sure that devices are patched, that they’re current, that they’re free from malware, and that teams have strong and consistent enforcement for access and identity-based controls.”
As Harrod explains, these outdated, disparate MDM tools can leave state and local government agencies vulnerable to cyberattacks in three distinct ways: “First is a lack of effective authentication and authorization controls. Second is the unpatched vulnerabilities [arising] from the continued reliance on outdated technology. Third is ransomware and malicious code, which in many ways results from the first two.”
However, these three vulnerabilities can be mitigated by embracing a modern, unified endpoint management (UEM) solution. These solutions work across all devices that interact with the network, providing IT and cybersecurity teams with a single interface for identifying, managing, patching, and securing all endpoints.
As Harrod detailed, “A unified endpoint management solution is able to identify devices, discover them, and make sure that they are compliant with our security policies before they can access information. [It can also] make sure that they’re patched and leverage artificial intelligence to help remediate threats.”
The sophisticated capabilities of UEM solutions might make them seem like something that only large, federal government agencies and military organizations could utilize. However, the webinar participants made it clear that these solutions are essential across all levels of government.
“We had an incident in 2019 that impacted 23 local governments, and it was all due to poor authentication. That’s where…the rubber meets the road, because I believe the lower you go in government, the more impact you have on the citizens,” said Rainosek. “I interact with my city more often than I interact with my state, and more often than I interact with the federal government. When those services are lost, it can have an impact on the [citizen’s] way of life.”