All this is more than the agency can handle on its own. “I was fortunate to be able to create a new position a year ago — a cybersecurity coordinator — but he is also my continuity of operations officer. He’s responsible for business continuity and for disaster recovery planning,” said MEMA Director Bruce Fitzgerald. “There is absolutely no way he can do it all.”
The agency has found a way to lighten the load in recent months by teaming up with students from Thomas College. The Waterville, Maine, school has offered a degree in cyber since 2012 and was looking for a place where students could hone their skills in a practical environment.
About 20 students have been working with MEMA largely to help towns and cities around the state bring their municipal cyberpractices up to snuff. For the emergency management agency, municipal cyber-readiness could help to ease some of the pressure that has been building as the pace of cyberattacks nationwide continues to rise.
Force multiplier
Government clearly is in the crosshairs for cyberattackers. In a survey of 24 federal agencies released mid-2016, the General Accounting Office found that between 2006 and 2015 the number of cyberattacks on government climbed 1,300 percent — from 5,500 to over 77,000 a year.
Bring this down to the municipal level, where resources are even more scarce, and the peril only becomes more pronounced.
“We have very small local government here in Maine. It may be a part-time clerk or an office that is only open a few days a week,” Fitzgerald said. “They don’t have the resources to address the emerging cybersecurity threat.”
After a rash of ransomware attacks locked multiple Maine police and sheriff's departments out of their records management systems, calls started coming into MEMA from towns seeking guidance. Fitzgerald needed a force multiplier to meet the demand and he turned to the college for help.
“It’s good for our students,” said professor of information technology management
Frank Appunn. “They get hands-on experience dealing with smaller and larger municipalities. They get to use their skills in the real world.”
New tools
The student team has delivered resources to help MEMA in its efforts to bring municipalities up to speed.
They have developed a brochure outlining basic cyberpractices and distributed it to some 700 municipalities. “It addresses backup, which is so important when towns are struggling with ransomware threats,” Appunn said. “We also looked at how to do wireless, because there are just so many things that can go wrong. And we talked about the user’s role, about having an acceptable use policy so that town workers and officials don’t do things that inadvertently open the door to the bad people.”
Last fall the students hosted a training session in person and online. The effort attracted about 60 officials from municipalities, utilities and others in the public realm. It offered a high-level overview of cyber best practices.
Now MEMA has its eye on a weekly help desk event, wherein students would work directly with municipalities to address pressing issues. “As we envision it, towns or police departments could either email in a question or call to get help. It’s a way to provide them with more of a technical resource than we could otherwise provide,” Fitzgerald said. “And they would be under the supervision of faculty, so it’s not like we are just turning college kids loose.”
In addition to the Thomas College effort, MEMA also collaborates with the Maine Cyber Security Cluster (MCSC), an academic and research center located on the Portland campus of the University of Southern Maine. Given the complex nature of a cyberthreat, Fitzgerald said he is eager to keep open as many lines of communication as possible.
“There is a wealth of information from the [Department of Homeland Security] and other sources, and we don’t want to duplicate something that is already available,” he said. “We want to make sure we aren’t setting up the colleges to be working in identical directions. We want them to complement each other and not step on each others’ toes.”
In addition to coordinating cyberefforts in the near term, MEMA’s ties to academia could help secure the state’s long-term digital security posture. “We hope these kids will come out of school and that they will want to stay in Maine. There is a huge need, and we just hope they won’t get whisked off to Boston or other places,” Fitzgerald said. He suggested that undergraduate encounters with FEMA and municipal leaders could encourage students to keep their talents close to home.
Diving deeper
Looking ahead, Appunn said students will be helping local leaders take their basic understanding of cyber to a deeper level.
“Now we are rolling out a couple of items a month where we dive deeper into a particular aspect of cyber,” he said. Students are producing white papers addressing detailed cyberimplementations and will be doing one-on-one outreach to municipal leaders.
“They will be going out to the towns to talk about what, specifically, the towns are seeing and what they can do about it. We want to talk about how they can protect their networks and protect their citizens,” he said.
This could enable MEMA to make best use of its limited cyberassets. “It provides feedback to us about what the common questions are, what the common issues are that people are reporting,” Fitzgerald said. “That in turn helps us target our resources.”
