What SLED Leaders Need to Know About the Current State of Cybersecurity

All right, TGIF, it is that time again. Welcome to In Case You Missed It, GovTech's government technology news roundup, where we take a look at some of the biggest GovTech news from the past week. We give you our thoughts on what it means for government citizens in the market. I'm Dustin Haisler, joined again by Joe Morris, and today we'll have a special guest from Google Cloud, Chris Hein. He's the head of computer engineering for the public sector at Google Cloud, which brings us to today's sponsor. Joe, tell us who that is.

Yes, today's episode is brought to you by Google Cloud. Google's products, including Google Cloud, can help government agencies improve citizen services, increase their operational effectiveness, and deliver proven innovation. Google Cloud's helped many governments worldwide respond to the pandemic, but their customers also include the Chicago Department of Transportation, the cities of Los Angeles and Chattanooga, state of Arizona, and many more. Make sure to check out the URL that's on your screen now for more information.

Absolutely. So we're going to chat with Chris momentarily, but as usual, let's first talk about the GovTech news items that captured our attention from the week that was. Now, sticking to our theme of cybersecurity, cyber has been hot. out in the market. And so let's look at some of these stories. So Joe, I know this one was one that got your attention earlier in the week. This was CISA issuing an emergency directive over some widely used software. This seems to be, you know, a recurring thing as we're starting to see more zero-day attacks and more supply chain attacks. But tell us why this one caught your attention.

Yeah, I think a couple of things. One, obviously following all the legislation that's going on, all the efforts between collaboration between the federal government and state and local government, we saw a directive that came out that applied to the federal government regarding, you know, a whole suite of software, but in that directive it said, hey, public sector agencies at large, pay attention to this directive, and if you're using these pieces of software, you also want to follow these steps and make sure that your entities are secure.

Yeah, and I think this is an important thing to follow because those federal directives have direct implications on state and local government. You're not immune as well, even though you may not be eligible to have to follow all of those directives, you should definitely take note of it to ensure that you're keeping in mind what, what these directives are saying and how they might be applicable to your stack from a technology standpoint. So along those lines, we also know that there's been a ton of conversation and chatter just around this legislative landscape and regulatory landscape. And when you think about compliance and privacy and other things, you know, security is a big part of this as well, as we know. states that are getting ready to go back into session in 2023. There's a lot of chatter already happening on how cybersecurity is going to pop up and be a major theme and a major focus area for these states. And this is an important area of focus as well because we have so many competing standards that exist. I mean, of course we have our infrastructure certifications, but then you have states that have kind of preempted their own versions of GDPR like California and Colorado that have direct implications on how we manage data. And so Joe, I'd love to get your thoughts on this one too. What do you envision kind of going forward in these data privacy laws and, you know, maybe where they intersect cybersecurity?

You know, it's really interesting, right? We've talked about the potential here for 31 different flavors of data privacy laws and cybersecurity laws. And in fact, just 10 days ago, Connecticut signed their own new law around personal data privacy that will take effect July 1st, 2023. But they join, to your point, California, Nevada, Virginia, Colorado, Utah, states that have data privacy legislation on the books. And we all know that there's a whole host of others that have pending legislation, and they all have different flavors. They're close. In the case of Connecticut, it's close to California but not quite. So if you're a vendor servicing this market, you want to make sure that you can make all these adjustments to comply with the various laws of each state. And that in itself can be complex. So that's, I think, one of the reasons why you're seeing this call for a federal standard towards data privacy.

Yeah, we fully anticipate the feds will eventually connect the dots on some of these disparate policies. So definitely continue to follow what's happening in the EU and the implications here on the market. As we know, GDPR created a whole set of activities here around privacy legislation. But, you know, keep in mind these privacy policies, these regulatory policies will have implications on how you secure and manage data. And so it's just something to definitely keep your eyes on going forward. Now the week ended with some big news as well. So this was another article that kind of stood out to us, not related to the cybersecurity side of things, but on the compliance side of things. We heard big announcement that Civic+ was buying Optimir, and Optimir recently had come out of Monsito and Archive Social. And, and so looking at how all of these things kind of came together, Joe, what do you make of this one?

Well, a tremendous commitment to the resident and the citizen, right? I think you look at the their long history in terms of the web portals at Civic Plus, but now they've built out such a platform that's focused on the resident, and these— this acquisition of Optimir really reflects that commitment.

And I think it also shows we're seeing a lot of market maturity for companies like Civic Plus that are looking at kind of getting close to the system of record and continuing to enhance that system of record. They had recently— or not recently, but historically— had bought Laserfiche and other capabilities here. So Exciting to see, you know, this news in the market and where this takes this unified stack of capabilities going forward. So that was the news that was. Joe, tell us about our guest for today.

All right, we're gonna welcome Chris Hein to the show. Chris, you've been— he's been with Google now for nearly a decade helping states and local governments use the cloud. By his own admission, he's passionate about disruptive technology, SaaS, and scotch. Maybe we should have had an after-hours show on In Case You Missed It and tapped into his expertise there, but All jokes aside, welcome to the show, Chris.

Thank you. I mean, it is Friday, so it's pretty close to 5 o'clock on a Friday. So I feel like scotch is at least a good, a rational place to go after talking about cybersecurity.

Absolutely. That'll have to be our in-case-you-missed-it after-hours or happy-hour discussion. So for next time. But maybe to start, I'd love for you to share a little bit with our audience about your background and your role at Google Cloud.

Yeah, absolutely. Thank you. As mentioned, my name is Chris Hein. I'm the Director of Customer Engineering for our state, local, and education practice. And so generally speaking, what that means is I run a team of folks that their goal is really to help the different states, localities, higher ed institutions to really figure out like, okay, Google does all these amazing things and it's a big company that does ridiculous stuff. What of that could translate into the public sector world, right? How could they use some of those same technologies to better serve their constituents, to have more operational efficiency? And so my team is really intended to understand the kind of the complexity of the technology that they're dealing with today, and then what are some of the ways that they could extend that, they could do better with it. So, you know, we work across all 50 states and really have had a good chance to you know, try to make a difference in how they all operate. So that's kind of my team and what we've been working on the last couple of years.

Yeah, that's great. And, you know, we know cybersecurity is an important topic. We talk about it all the time on this show. It's the number one priority across the board, but it has been a moving target in an evolving landscape. And, you know, these threat vectors continue to shift and agencies have to respond appropriately to that. So, you know, I'd love for you to maybe dive into what you see as some of the current security challenges and emerging threats, you know, as you work with agencies across the country. What are some of the ones that are, you know, most common that our agencies are dealing with today?

Yeah, good question, Dustin. And, you know, if you think about it, to your point of it becoming the, the most, you know, talked about point, um, I was surprised. I actually was, was meeting with some governors this week, and like without any prompting, one of the only topics that they brought up was cybersecurity. So like even at governor levels, uh, this is definitely something that is, that is top of mind right now. So, you know, in terms of what some of the challenges are, you know, across agencies, and I would say this scales differently depending on which kind of audience we're talking about, because I think that there's, you know, our state levels that have their own CISOs and they have a fairly broad program and a broad responsibility set. And for them, I think a big challenge tends to be that, you know, we're kind of operating in this now hybrid mixed world. Right, where, you know, folks are— some are working from the office, some are working from home, some are working from a Starbucks. And your security model has had to really shift from what you could have expected 2 years ago to what you could expect now. And so being able to look at, you know, 10,000, 20,000, you know, government employees and saying, hey, we want to try to make sure that all of them have the right security and that the right ability to do the jobs they need to be able to do. While being in this odd hybrid world where I can't assume you're gonna be on my corporate network at all times. So I think that's kind of the first big bucket is just, you know, hybrid world with a workforce that's all over the place. How do you deal with that? Secondary challenge at that big kind of state level is just the fact that you're now being attacked by nation states, right? We're looking at this and seeing this as something that this is not simply you know, you working against a hacker who happens to have a, you know, a computer science degree. Like, these are professionals that work in very high technology sectors. And so that means that the response has to be almost similarly high. And that's really difficult because of the fact that, you know, I was talking to some folks this week about just the difficulty in hiring, you know, cyber professionals right now. It's really difficult. It's a hard market to get people. And so I think there's a lot on that kind of just dealing with the scale of the issue as it is today. And then one last kind of component of it is then when we talk about the kind of the locals market, we talk about folks that deal in the cities and the K through 12 institutions. This is where you've got like one IT person and she's already responsible for all the rest of the work in terms of keeping the systems running. And now she also has to somehow think about like, not getting hacked by, you know, Russia, right? Like, that's a huge problem set to put in front of somebody like that. And so that's where I think that there is kind of a, just a whole different challenge of how do we, you know, as a public-private partnership, make sure that we're making it possible for folks that are in those smaller IT environments to still have really high levels of security.

It's fascinating, right, this whole conversation, because this morning I was reading an article talking about ransomware and how the payments for ransomware have actually increased by 70% as of 2021, which is in itself a whole other, maybe other episode. But as you cover SLED and you talked about some of the dynamics between states and locals and K-12s and higher ed, are you seeing the threats that these specific organizations or public sector agencies are dealing with? Are they dealing with them the same way? Are they the same threats that are impacting them all? Is everybody a target kind of of the same vector, or are you seeing some nuances between those government programs?

Yeah, it's a really good question, Joe. I think there's definitely differences, right? I think that you're seeing some of the less sophisticated customers, you know, the K through 12, some of the smaller cities, even some smaller states, you know, they're still primarily— their number one attack vector is just going to be phishing, right? Just going out, trying to get a username and a password, and from that, finding areas to, you know, whether they can get in and lock down some servers with ransomware, that tends to be where we're still seeing a tremendous amount of activity. You know, I do think that on some of the more sophisticated governments, they've done a much better job of implementing multifactor authentication, right?

Mm-hmm.

They're getting to the point where that's less of the number one concern. It's still a really big concern, but it may not be the overall target. And so there, What we're starting to see is also some of the really targeted attacks. And those are the types of things where they're going after supply chain issues, right? You were kind of posting and talking in the intro there about, you know, the kind of news of the day being, hey, you need to make sure that you're worrying about whether these things are patched and whether you're closing off some of these security holes. And that tends to be where some of the more sophisticated places are getting challenged is that they've been operating these systems that usually don't require a lot of maintenance, and those have been sitting in the back server room for the last 10, 15, 20-plus years. And that creates this challenge of how do you keep those things up to date? How do you protect a system where you didn't even realize that there was a vulnerability in it? And so I feel like some of the— some more— some folks that have already kind of closed, you know, put their fingers in the dike in terms of some of the phishing attacks, those folks are still getting hit because they have high-value Information, as you mentioned, we're paying out a ridiculous amount of money in ransomware on a daily basis. And so there's, there's a reason for folks to find these, these holes. And so it becomes harder and harder to keep them all plugged, even at the multiple levels of sophistication. That's great.

You know, I think when you look at what we're seeing in terms of the CIO priority lists and what's trending from an investment standpoint, and particularly the lessons learned over the last 2 years, Cloud has played such a critical role in government's response and then obviously recovery, but what role does the cloud play in mitigating the risk in terms of the security challenges that you've walked us through so far?

Yeah, I think what we've seen there is, you know, kind of where I was just going with the, you know, these legacy systems that are on-prem, they haven't been updated much, you know, they might be on hardware that is no longer on a supported hardware system, right? the operating system is no longer supported. And so one of the just immediate benefits of cloud is that you get to abstract away a huge level of your security stack, right? Because basically when you, when you come to Google, when you come to the other hyperscalers, you have that opportunity to say, hey, Google is protecting its own data centers to the level to make sure that Google is never hacked, right? So you get to kind of take and inherit that level of trust at that underneath stack of saying, hey, Google's going to make sure that when there are threats that come out that are at the VM layer, Google's going to take care of that incredibly fast because of the fact that it threatens us too. You get to inherit a little bit of that from us. From a migration perspective, simply moving to the cloud does uplevel that basic level of security. Then once you've done some of those movements, the other nice thing that you get out of that is that the cloud tooling for being able to do threat detection at scale is just really, really good, right? A lot of that is now built in natively into products like Google Cloud where we can basically watch your network on your behalf using some of the same machine learning algorithms that we do to protect ourselves. to look for things like, uh, you know, Bitcoin mining happening on your, your networks, right? That's the kind of stuff that makes it so that there's these, you know, not necessarily an easy button, but an easier button on getting yourself into a secure place. And so, you know, when I talk to CIOs, you know, one of the recommendations that I tend to make is to say, look for some of those really high-value workloads, right, that you know are going to be targets, but also you You can't afford to have locked out, right? Those are gonna be good instances to, you know, whether you're looking to use the federal funding instead of the IJA bills, the ARPA funds, you can start to use these things and migrate those things, use best-in-cloud cloud security to lock those down, and then use that as a template for things that may be a little bit further downstream that don't need to necessarily get migrated right away.

So let's talk a little bit about best practices because, you know, many agencies kind of get polarized in so many different ways to approach cybersecurity. in this constantly evolving threat landscape. So what should security-conscious agencies be doing right now today to prepare for the inevitable evolution of this threat landscape?

Yeah, it's a good question. And I think it's a hard question because of the fact that you're dealing in an environment that is implicitly super challenging, right? And so, 'cause one of the things that Google is obsessed with huge proponent of is zero trust, which is awesome, but there is no product that just gives you a zero trust architecture, right? And so it's like, oh, best practices to be zero trust, but what does that even mean? Like, how can I accomplish that? That's a hard problem to go and get solved. And so in terms of what that might look like, right, like I would say you're gonna go on kind of a multiple-step journey, right? Step 1, you have to worry about identity. Because phishing is going to be your number one concern. And so setting up multifactor authentication, and not just multifactor, but in categories where people are dealing with the really sensitive workloads and sensitive data, you're going to want to have multifactor with hardware authentication, right? At Google, every single employee has to have one of these to be able to plug into their laptop anytime they're going to access a system that has access to any information. Right? Those are the types of decisions that you need to start to make as a best practice starting off. Rip the Band-Aid off. A lot of times users don't love having to carry something around, but it is important to really start to secure that very first level. After that, then you start to really think about, from a best practice perspective, are we doing a good job of the logging of the security information that's coming to us, right? Do we have a good cyber data warehouse? And that's really, you know, something that, you know, being on cloud can be helpful for, but you also can start to work on that on a multi-cloud and a hybrid environment. So pulling all these data streams together from a whole bunch of different places, because your threats are going to be hitting you on your SaaS programs, they're gonna be hitting you on your on-prem infrastructure. And so really starting to aggregate that and look at it at scale is gonna be one of the most important things that you can start to do Because that's where you're gonna get better perception as to where the attacks are coming and what do you need to take action on right away. So those would be the, you know, phase 1 and phase 2. I'd say your kind of final best practice is kind of what I said earlier, which is you need to start to modernize environments. You know, we have to start to say, you know, we've been attempting to take mainframes out of the equation for 20+ years. It might be time, right? Like, we need to start to look at some of these older technologies And acknowledge that it's not enough that it's going to be hard. We have to rip those Band-Aids off and start to make them a little bit better.

Yeah, I think that's right on. And so, you know, at the beginning we started talking about privacy and compliance and, you know, all of these new dynamics that are starting to work into the security conversation. You also have, you know, in addition to those 2, end-user trust. And so when you think about that, you know, when most people think of security, it's not just an appliance anymore, but now there's all these other nuances that are a part of this conversation. So I'd love to get your, your take on where all these things intersect with the security side.

Yeah, that's a great question. You know, when I think about compliance, I think about it in terms of who watches the watchers, right? You need to have some level of trust that, you know, when somebody like Chris Hein jumps on a call and tells you that Google Cloud is secure, that's awesome, right? He seems like a nice guy. I'd believe him. But that doesn't really tell you all that much about the underpinnings of the servers and of what's going on in that environment. And so I think compliance, when done right, is a really good way to start to say, what are the levels that we can have audited to make sure that we can trust what's happening right now? What I'll say that I've seen as a watch point for folks is compliance does not dictate your responsibility. Right, as an IT professional, right? There's a lot of times where you'll see these, hey, good news, it's a FedRAMP High environment. I don't have to worry about anything anymore. I can walk away from doing anything more on this. And that's not true, right? You still have a level of responsibility, right? We're taking care of that bottom half of the stack, but man, if you're not handling the identity, if you're not handling and making sure that you're logging the different events that are coming through it, if you're not patching at the right levels, you're still going to end up in these kind of tricky situations. The other thing that I would say is that, you know, compliance can be a bit of a blocker when it comes to, you know, overuse. And so as an example to that, you'll often get these agencies that will end up with, you know, whether it's a CJIS workload or a Pub 1075 workload, And that requires a really high level of compliance for good reason, right? That's sensitive levels of information. But then sometimes you get a downstream effect of that that says now everything has to be held at the CJIS level or at the IRS 1075 level. And what that does is that drives the cost of the entire installation up dramatically, right? Which can be a hindrance to actually getting the security that you might want. Right? So like, as I was saying earlier, just shifting to cloud will uplevel most installations' security profile. But if you have to uplift into clouds that, you know, like are just there, you know, like on our competitors, they'll do a GovCloud, and that's a much higher price point. And so I think that you do have to be careful when you look at things like compliance to make sure you're doing it smartly for the right datasets at the right time, but then also looking to see what the history is of the vendor that you're working with. make sure that they have done the right things to keep folks out of the bad places as best they can. So I think of that when I think about the security/compliance landscape.

Yeah, I think that's great. So now, you know, digital experience is everything, and agencies are leaning into finding ways to leverage new technology to serve people differently. So how are you helping agencies realize the potential of this seamless digital experience while maintaining security in the process? So in other words, where should security and experience meet?

That's a great question. And that ends up being one of the blockers, right? Because you end up with these, like, problem sets where folks will, you know, sacrifice one or the other, right? And I would, you know, hope that we can get to a place where we can do a yes and. kind of scenario when we think about digital user experience and the security on the backend. So what we've been doing, right, what we really focus on is taking some of those technologies that Google has built ourselves to run our, you know, applications that everyone uses, right? Whether it's Google Search, whether it's Gmail, YouTube, Google Photos, right? We've really invested over the long, you know, 20-year history of our company in really trying to say, how can we make those experiences as frictionless as possible to the person coming at it, right? We're always going to work with these 3 core tenets of simplicity, security, and speed, right? So I would argue that governments can do those same 3 things. Make it simple for someone to interact with your service, make it fast, really emphasize the fact that it's going to turn around quickly and give user feedback as quickly as it possibly can. But you can keep that security as an underlying principle. So the way that you can do that is by looking at and making sure that as you're building it out, building out an architecture, you really want to look at how can I get information from the user in a way that they're going to trust, right? They're going to get the implicit systems of trust. How can I make sure that I'm giving the end user feedback on where they are in the process? And then how do I, as a government employee, make sure that I'm securing that data through the transit, at rest, and all of those kinds of things, right? Again, cloud can be a huge enabler for this because of the fact that it is, you know, at Google we're encrypted in transit and at rest at all times. But then you can also look to see what are the types of scenarios where, you know, You're going to need to bring your own encryption keys. What are the times where it needs to stay on US data centers only? And making sure that you make the right trade-offs on the underlying infrastructure. But really look at, you know, I would challenge, you know, a lot of the CIOs and the agency directors that I talk to at, are you using best-in-breed technologies for what the constituent is used to interacting with, right? I was actually— speaking with somebody this week that was mentioning that one of their primary challenges is workforce inside the governmental agencies. They're having to do way more work with way less people because just like everybody else, they're in this kind of post-pandemic, you know, folks shifting from, from career to career, and it's hard to get people in and get them trained on these, these older ways of doing things. And so one of the things that I would recommend is how can we make sure that we're building processes that allows the government agency employees to do more work with less people, right? And that requires things like AI and machine learning and being able to use some of those cool digital transformation technologies that are out in the market today.

So you just hit on a bunch of the force multipliers I think that government is absolutely gonna be in need of. So what's the vision in terms of Google Cloud's vision for the future of security operations?

Yeah, I think there's a great article that's out there, and maybe we'll put it in the show notes or something about— and we'll see if I can say it correctly— Autonomic Security Operations, right? And so the idea between Autonomic Security Operations, or ASO, so I don't have to say that anymore, is that what you're trying to do is you're trying to make security invisible, right? You're trying to say we are never going to solve the challenge of being able to staff to the threat level that is out there, because that's an arms race that we won't win because of just the level of the challenges that comes at us. And so what we believe is that you need to start to invest really, really strongly in building up a security practice that takes and can work through all the threats that it's seeing and only bring attention to the ones that are real threats that a human needs to take a look at, right? So there's good automated systems that can really start to parse that for you so that you don't have to, you know, start to say like, oh, well, sorry, we missed it. It's a needle in the haystack, right? Make it so that you're looking through a pile of needles instead of a pile of hay with a needle in it. So, you know, that's perhaps where we think that this is all going. Now, part of that and part of a recommendation for governments on that is that you need to make sure that you're building a big enough community so that you're doing the threat sharing so that you know what the needles are inside that haystack. Because right now there's oftentimes way too much of a wall between even just from agency to agency, right? Trying to get access to the security logging information from one to the other can still be a huge challenge. And so we need to start to break down some of those. And I actually saw there was another federal bill that's just coming out now to try to promote that more of saying better sharing, both from the localities to the states to the feds. We need to really be encouraging that more. And from a technology side, we need to be doing a better job of making that possible, right? Making it a little bit easier for us to port from one system to the next system. Being in these hybrid and multi-cloud environments, we absolutely need to make that possible because right now it's a significant challenge and it's something that we need to work on together and really use, you know, there's a lot of federal funding right now. It's the time to invest. It's the time to make that possible.

That's great. We'll make sure to add that to the show notes. Along those same lines, where can our audience go to learn more about Google Cloud's approach to security and risk mitigation?

Yeah, so good timing because we just finished up our Google Cloud Security Summit that happened this week. And so there's the link on that one. So you can go back and rewatch all the information that was published there. There's a ton of good stuff from folks who know a heck of a lot more about this than I do. And so there's gonna be some really great content that you can get through. It's all on demand, so you can watch it at 2x speed and still try to absorb as much as you possibly can as you go through it.

Well, that's great, Chris. Thanks so much for, for joining us. That's all the time that we have for today. I want to thank you all for tuning in and watching this episode. Make sure to tune in every Friday at 12 o'clock Pacific on LinkedIn, YouTube, and Twitter for more In Case You Missed It. Have a wonderful weekend.