GoKawiilStates, cities, and localities are struggling to stay ahead of devastating cyberattacks — and some under-resourced organizations are buckling under pressure. Recent cuts to federal initiatives and policy changes mean they can't expect help from that quarter, paving the way for independent organizations and initiatives to fill the ever-widening void.
The Cybersecurity Infrastructure and Security Agency (CISA) has seen its budget slashed and its workforce dramatically downsized over the past two years. The U.S. government has also pulled back help for the Multi-State Information Sharing and Analysis Center, a public-private information-sharing initiative for people, businesses, and governments at the state, local, and tribal levels. And the White House's Cyber Strategy for America encourages organizations to adopt a more offensive approach as part of their defense strategy, something that may be difficult, if not out of reach, for smaller-scale organizations lacking dedicated IT and cybersecurity teams.
Related:Electricity Is a Growing Area of Cyber-Risk
The University of California Berkeley's Center for Long-Term Cybersecurity (CLTC)fills this growing gap by providing tools and services for low-resource organizations like nonprofits, municipalities, and schools. "The feds have pulled back so hard on funding and support," Sarah Powazek, CLTC program director of public interest cybersecurity, tells Dark Reading. "It's sort of everyone for themselves at the local level."
'Out of Reach For Smaller Organizations'
CLTC sees the problems and provides several initiatives to help resourced-strapped entities solve them. More importantly, the research and collaboration hub understands these groups have limitations. They need services – human to human hands-on help – before they need toolkits, checklists, and software.
"[We're] in a state where there are a lot of tools for free, but very few people have free services," she says.
On the research side, CLTC has Cybersecurity for Cities and Nonprofits (CyberCAN)where they partner with cities, counties, and state governments to do surveying research for nonprofits in their regions and subsequently share that information. For example, research could highlight the number of attacks or the security health of nonprofits.
Coalition building, which includes cybersecurity clinics, is more hands-on. The clinics operate as a dual workforce training/cybersecurity defense program. Students, including undergraduates, learn to do basic vulnerability or risk assessments for local organizations, while nonprofits, schools, cities, and small businesses receive similar help that they'd get from a professional service. One important distinction: It's free.
Related:Lies, Damned Lies, and Cybersecurity Metrics
... continue reading