State Governments Struggle to Secure Networks Amid Expanding Cyber Threats: Deloitte Survey
State chief information and security officers (CISOs) across the United States are grappling with increasingly sophisticated and numerous cyber threats, with many citing insufficient budgets, resources, staff, and expertise as significant hurdles. This is according to a recent survey conducted by Deloitte & Touche LLP, which gathered insights from officials in all 50 states and the District of Columbia.
The survey underscores the escalating challenges faced by state governments as they become more reliant on digital infrastructures. “The attack surface is expanding as state leaders’ reliance on information becomes increasingly central to the operation of government itself,” explained Srini Subramanian, principal of Deloitte & Touche LLP and global government and public services consulting leader. Subramanian highlighted the increasing difficulty faced by CISOs in ensuring the resilience of their technology infrastructures against growing cyber threats.
Key Findings and Emerging Threats
Released today, the biennial cybersecurity report pinpoints emerging threats and vulnerabilities that state technology teams are encountering. A key concern is the growing dependence on servers and the Internet of Things (IoT) for storing and transmitting information. Additionally, critical infrastructure systems, including transit and power, which are heavily reliant on technology, are now more exposed to potential cyber-attacks. The emergence of artificial intelligence (AI) has also introduced new avenues for cybercriminals, particularly through enhanced phishing scams and deep fake technologies.
Despite the introduction of statutes and legislation in some states to enhance the authority of CISOs, the survey revealed that many officers still feel underprepared. Approximately 40% of respondents indicated a lack of sufficient funding for compliance projects, and nearly half are unsure of the exact portion of their state's IT budget allocated to cybersecurity.
Talent Shortages and Turnover
The survey also highlighted a significant talent gap within cybersecurity teams. Nearly half of the CISOs surveyed reported inadequate staffing, and 31% mentioned a shortage of available professionals to fulfil cybersecurity roles. While CISOs noted improvements in staff competencies between 2020 and 2024, staffing issues persist. An area of particular concern is the high turnover of CISOs themselves, with almost half of all states experiencing turnover since the last survey in 2022. The average tenure of a state CISO has dropped to 23 months from 30 months in the previous survey.
Generative AI: Asset and Threat
Generative AI emerged as a double-edged sword in the survey findings. While 71% of respondents consider AI to be a significant threat, due to its potential to facilitate sophisticated cyber-attacks, many states are also actively adopting AI to enhance their security measures. Currently, 21 states are already employing some form of AI in their cybersecurity operations, with 22 more expected to follow within the next year.
CISOs expressed varied approaches towards AI, with some in the discovery phase exploring the impact of generative AI on state security through executive orders, and others forming committees to review use cases, policies, and best practices.
Recommendations for State Tech Departments
In response to these pervasive challenges, the report proposes several strategies for state technology departments to consider. These include leveraging partnerships with other governmental entities, adopting creative budgeting solutions, diversifying their talent pipelines, advancing AI policy discussions, and promoting the role of CISOs in the digital transformation of government operations.
This comprehensive survey sheds light on the herculean task faced by CISOs nationwide as they strive to fortify state networks against an evolving landscape of cyber threats, all while grappling with limited resources and the need for specialised talent.
Source: Noah Wire Services