8 ways local governments can enhance security while working remotely

In the rush to mobilize home workers in the wake of the pandemic, local government agencies may have opened up security vulnerabilities that could lead to attacks. Many of the applications governments use were never intended for completely remote management; they lack two-factor authentication and other security controls.

As we move forward, however, agencies must consider secure remote work strategies a top priority. Hackers and criminals see crises like this pandemic as an opportunity to gain access to data they couldn’t have accessed previously.

Local governments do their constituents a disservice if they view the current crisis as a “wait it out” scenario. I have been working with city and state governments for 25 years and have found  that those that actively planned for long-term remote-ready operations have fared better in disasters and are better equipped to meet challenging circumstances, such as the ones we face today.

Both the public and private sectors will likely not go back to “business as usual” after the pandemic passes. For one, if the coronavirus resurges in fall and winter, employees may again shift to remote work. Second, many agencies have found that they can provide a more efficient, cost-effective experience to their constituents with digital services.  

Security is more difficult to achieve with remote operations, but it’s not impossible. As local governments transition from short-term to long-term remote operations, here are eight tips to enhance security:

1. Honestly evaluate security capabilities. Can the current system securely support remote work as it stands? What are the biggest risks? Are there any staffing gaps? Agencies may have to bring in an experienced partner to assess the current system. Knowing what is working and what is not is the first step in making a solid security plan for the future.

2. Write a remote work policy. Many organizations, in their rush to close physical offices, made the mistake of implementing remote work solutions first and then writing the policy to fit the solutions. This puts security at risk. Now that COVID-19 is stabilizing, local governments should be rewriting their remote work policies and guidelines. These policies should include use cases -- identifying different worker profiles and what each type of worker needs to be productive. Only then should they consider what architecture, technology and providers they need to enable those policies. This process will enhance the security of these technologies.

3. Assume ransomware attacks will happen. Don’t think, “it will never happen to us.” I have seen many municipalities with this mindset, and it has led to a lack of preparedness. In October, CNN reported that over 140 local governments, police stations and hospitals had been held hostage by ransomware attacks in the 10 months prior. Other studies have shown that ransomware attacks are increasing more than 300% year over year.

4. Everyone – not just the IT department – should know about security risks. Educating employees is one of the most important steps in securing systems. Providing regular employee security awareness training can teach employees to recognize signs of a phishing attack, examine links and attachments before opening and adopt a password management strategy.

5. Train for remote work. Share remote work guidelines, such as best security practices and what communication platforms will be used. Use one single source to communicate critical information to employees and let them know what that will be -- a secure website, an email from a known email address, a messaging platform or a videoconferencing platform. This will lessen the likelihood of an employee unknowingly clicking on a false email or link. Additionally, when employees are back in the office and new systems have been implemented, hold a “trial” remote workday so any kinks can be worked out.

6. Have a digital backup of all data. Creating digital copies of both physical records and backups of digital records is critical for ensuring continuity of service and will be essential in restoring systems in the event of a security breach. 

7. Know who’s on the team. IT managers must identify a chain of command and a list of people who will be engaged if a security breach occurs. This should include government managers, legal teams, service providers, compliance teams, insurance companies and relevant vendors.

8. Have the right digital tools. Scale the organization’s ability to provide services to constituents requesting services from home. This could include making payments through a website and having a phone payment system as a backup if the online system is down.

As delivery of government services shifts from physical to virtual, we must thoughtfully balance the practical realities of working from home with the security of systems and data. Remote work is the future -- in both the public and private sectors -- and local governments protecting valuable citizen data should prioritize remote-work security strategies. This will ease potentially crippling burdens on staff and enhance constituent trust.