IT Security Policy Best Practices for Local Government

According to a report by the Brookings Institute, most government agencies lack IT security policies.

A lack of a good government security policy can open agencies to many different risks. As demonstrated by the story of Bingham County, a security breach can shut down government servers and costs thousands of dollars to repair.

In other cases, a cyber attack can result in the theft of sensitive data including Social Security numbers, credit card information, and medical records. At the very least, a security breach can damage a government’s reputation and public trust.

When it comes to effective information security in government, municipalities face several challenges:

Constantly changing and adapting security threats

Technology changes rapidly, and so does cybercrime. Cyber attacks are becoming increasingly complex and intense.

A report by the FBI found that in 2016, there were 4,000 ransomware attacks every day. That was a 300% increase from 2015, and the report concluded that new variants of ransomware are constantly emerging.

This makes government IT security challenging. Old firewalls or malware software may have gaps. And an outdated government security policy can leave employees unaware of potential security issues.

Confusing regulations

Local governments handle a lot of responsibilities. Different government departments have to comply with various federal and state regulations for information security. These may include regulations from HIPAA, the IRS, FBI, FSSA, and more.

Along with federal regulations and standards, municipal governments also must comply with state laws governing data security.

All the regulations and standards can be a lot for IT team to keep up with. The flood of suggested frameworks, tips, and best practices are not always helpful or clear and can create more problems than they solve.

Poor funding

In a 2016 survey by NASCIO and Deloitte, 80% of state governments said that funding was their top challenge in government information security.

Another study found that, in most state and local governments, cybersecurity makes up less than 5% of the IT budget. Private enterprises usually spend more than 10% of IT budgets on cybersecurity.

This is problematic. With cyber threats growing in number and complexity and more sensitive information going digital, information security is increasingly important.

Government IT departments need more money to do everything they need to do to protect critical information and systems. If the efforts aren’t properly funded, it’s difficult to stay on top of all of the security regulations and best practices.

Personnel

Municipal governments often have a small IT team, and may not have an IT security expert on staff. IT personnel may not be familiar with all the information security regulations. And with no one person overseeing cybersecurity measures, important aspects of cybersecurity in government call fall through the cracks.

But often, the IT team is not the problem. The vast majority of government data breaches come from internal mistakes by employees.

Well-intentioned, but technologically unaware employees will always be the biggest security threat to any organization, including local government agencies. They may use weak passwords, click on phishing scams, or access an unsecured website.

Cybersecurity technology can be helpful in government information security, but there’s only so much it can do. Firewalls can block harmful viruses and malware, but they can’t protect against employee mistakes.

The most effective way to limit local government information security risks is by creating and implementing good government security policy. Government cybersecurity policy and procedures establish a foundation for security best practices. They help ensure that every employee is aware of risks and actively working to protect government computers, networks, and sensitive information.

A good policy management software such as PowerDMS can help government IT managers create, update, and distributed good security policies to all employees.

Acceptable use policy

IT policies should set clear parameters on the type of content government employees are permitted to access from their work computers. This includes social media use, personal accounts, and prohibited websites.

As we wrote in our post about Updating Your Acceptable Use Policy, this is about more than just making sure employees aren’t browsing Facebook on company time. A good AUP limits liability risks by clearly prohibiting employees from illegal online activities.

Plus, as we wrote in the post, “Acceptable use policy and training help your employees know how to spot a phishing scheme and how to avoid downloading viruses onto their computers. Informed employees can protect your company network from dangerous malware.”

Bring Your Own Device (BYOD)

Nowadays, employees are used to constant connectivity. Lines between personal and professional use of computers and mobile devices can easily get blurred.

Many local government agencies don’t have the budget to provide work mobile devices to employees. So employees often end up using their personal phones for government business. This can be risky, as it gives the agency less control over information security.

A Bring Your Own Device (BYOD) policy can help put some protection measures in place. These policies may include restrictions on personal devices use for work purposes, password requirements, and measures for reporting stolen or compromised devices.