Index
- automation technologies 216–217
- artificial intelligence see artificial intelligence (AI)
- machine learning see machine learning (ML)
- bitcoin, as ransom currency 8, 9, 29, 203
- Black Frog 61–62
- Boston, MA 80
- Breithaupt, Jim 87
- bring-your-own-device (BYOD) 209–210
- Census Bureau estimates 2, 232n1
- Census of Governments (2017) 2
- Center for Digital Government, Digital Counties Survey 202
- change (configuration) management policies (CMPs) 123–124, 160
- Chicago, IL 80
- chief information officers (CIOs) 4, 38, 58, 79
- Coalition of City CISOs 79–80, 195
- Collier County, FL 145
- Colonial Pipeline, cyberattack on 30, 203, 214
- Colorado Privacy Act (CPA) 178–180, 215
- Colorado state security legislation 178–180
- Commission on Information Technology (COIT), San Francisco 126, 129, 131, 132
- Commonwealth of Massachusetts 116
- cybersecurity policy 132–139
- computing, management of 86–87
- Computing Technology Industry Association 57–58
- Conference of Mayors 29
- Coveware 207
- COVID-19 pandemic 6, 18, 31
- cryptocurrencies, as ransom currencies 8, 9, 29, 203, 207
- Cuckoo’s Egg, The (1989) 19
- cyberattackers, types of 31–32, 59, 70–71
- cyberattacks 1–3
- attribution 197
- case studies 7–10
- costs of 5, 8, 57, 61–62
- definitions 68
- detection 22–23, 161, 193–194
- effects of 7–8, 9
- and elections 5, 146
- forensic services 94
- frequency 1, 27–28, 68–70
- and home working 204
- and human error see human error, in cybersecurity incidents
- increase 69–70
- kits 203, 207
- motives for 32, 70, 71, 144
- by national governments 5, 32
- and negligence 8, 32
- organizational ignorance 27–28, 68–70
- perpetrators see cybercriminals
- targets 67
- types see cybersecurity attacks, types of
- Cyber Incident Notification Act 181
- cyber insurance see cybersecurity insurance
- cyber negotiation frameworks 12, 48, 53–54
- cybersecurity, organizational 18–19, 37–38
- auditing 19, 94, 131, 192
- authentication see authentication
- and business environment 157
- CIA triad 20
- confidentiality 18, 19, 135
- culture 42–43, 76, 125, 231–232
- definitions 17–19
- dimensions 20
- economic modelling 54–55
- and governance 157
- and hardware see computer hardware
- and insider attacks 32
- IT departments see IT departments
- principles 18–20, 20
- responsibility for 38, 88–89, 232
- safeguards 20, 22
- and size of organization 50
- systems see cybersecurity systems
- Zero Trust approach 212–213
- see also chief information security officers (CISO), role of; cybersecurity administration
- cybersecurity advocates 147
- cybersecurity attacks see cyberattacks
- cybersecurity attacks, types of 5–6, 28–31
- cybersecurity cube 20–21, 20
- Cybersecurity Enhancement Act (2014) 152
- Cybersecurity Infrastructure and Security Agency (CISA) 17–18, 90, 206, 217
- cybersecurity law 167–182, 213, 228
- European Union see European Union General Data Protection Regulation (GDPR)
- federal 168–172
- Presidential Executive Orders see Presidential Executive Orders
- proposed (117th Congress) 181–182
- state 174–180
- cybersecurity leadership 101–103
- cybersecurity malpractice 8, 69, 96, 203, 230
- cybersecurity partnerships 194, 195–196
- cybersecurity policies, 95, 96–99, 113–139, 194
- acceptable use see acceptable use policies (AUPs)
- best practice 116, 205, 230–231
- bring-your-own-device 36, 122
- business continuity 121, 135
- centralized 113
- change management 123–124
- compliance 115, 117, 129, 131, 133, 136
- continuous improvement 125, 139, 192
- design and development 113–115
- disaster recovery 121–122, 130–131, 135
- email use 122–123
- essential 116–117
- examples 115–116, 126–139
- exceptions 58, 134–135
- implementation 115
- importance of 96
- incident handling 98, 120–121, 136
- information security see information security policies
- internet use 35, 36–37
- legal review of 115
- media and communications 123, 162
- remote access 122–123, 210
- reporting violations 134, 147
- and size of organization 114–115
- stakeholders 113–114
- templates 116
- vulnerability and patch management 124–125
- see also privacy policies, local government
- cybersecurity research 7
- academic see cybersecurity literature
- methodology 48, 49, 50, 67, 68, 76–81
- see also cybersecurity surveys
- cybersecurity staff 147, 205–206
- burnout 206
- gender imbalance 206
- numbers of 73–74, 190
- role 6, 188
- status 229
- vacancies 205–206
- see also chief information security officers (CISOs); IT departments
- cybersecurity systems 1–2, 42–43, 115
- artificial intelligence 146, 206, 214–215
- attacks on see cybersecurity attacks
- automation 216–217
- back-up 40, 121, 124
- barriers to effectiveness 73–75
- complexity 5, 6
- confidence in 72–73
- costs 8, 73
- and critical infrastructure 22, 152, 215–216
- and culture 42–43
- defense in depth model see defense in depth model of cybersecurity
- designing 113–114
- and email 34, 122–123
- federal guidelines for 75
- see also NIST Cybersecurity Framework
- firewalls see firewalls
- formal/informal 68, 69
- funding 74–75, 76, 190–191, 229
- hardware see computer hardware
- and human error see human error, in cybersecurity incidents
- incident logging 68–69, 136
- insurance 8, 9
- inventories of 188
- investment in 10, 104–105, 230
- leadership buy-in see cybersecurity leadership
- literature review 47–63
- maintenance 156, 158, 160
- management see cybersecurity administration
- negligence 8
- see also cybersecurity malpractice
- NIST see NIST Cybersecurity Framework
- obsolescence 218
- officials see cybersecurity staff
- outsourcing 88–89, 90, 106, 182, 218
- see also cybersecurity partnerships
- preparedness 70–72
- priorities 57–58, 74
- research on see cybersecurity research
- responsibility for 88–89, 103
- staffing see cybersecurity staff
- third-party vendors 114, 158
- tools 91, 92, 107–108
- vulnerability see cybersecurity vulnerabilities
- Cybersecurity Ventures 5
- cybersecurity vulnerabilities 3, 7–8, 9, 32–38
- artificial intelligence 145
- categories 33
- definitions 33
- human see human error, in cybersecurity incidents
- machine learning 145–146, 216
- management see vulnerability management
- operating systems 10, 33, 205, 209, 216, 218
- personal devices 36–37
- see also bring-your-own-device (BYOD) policies
- social engineering see social engineering
- software supply chain 218
- teleworking 35–36, 210–211
- third party 59–60, 136, 158
- Zero Day 22, 23, 30, 31
- d
- Dallas, TX 80
- data, electronic 18–19
- authentication see authentication
- availability 18, 19–20
- back-up see back-ups
- corruption 19
- definition of 18
- encryption see data encryption
- integrity 18, 19, 146, 159
- PII see personally identifiable information (PII)
- privacy see data privacy
- security see data security
- states 18, 24
- storage 19, 51, 119, 168, 215
- see also cloud, the
- data protection legislation 179–180
- data security 156–157, 159
- encryption see data encryption
- state legislation 178, 214
- departmental information security officers (DISOs) 126, 129
- Department of Health and Human Services (HSS) 31
- Department of Homeland Security 206
- Detroit, MI 80
- disaster recovery/business continuity (DRBC) policies 121–122, 130–131
- disinformation campaigns 5, 31, 146
- Distributed Denial of Services (DDS) attacks 6, 31
- Durham, NC, cyberattack 5
- e
- education, K-12 level 117, 206
- educational institutions 171, 206
- e-government 24, 87, 215
- research on 74, 86, 87
- see also smart cities
- emergency (911) systems 9, 114, 214
- Emisoft 61
- Endless Frontier Act 181–182
- Equifax 34
- Ernst and Young Global Ltd (EY) 59
- European Union
- f
- facial recognition software 19, 145, 214, 215, 220
- Fairfax County, VA 80
- Falco, Gregory 53
- Family Educational Rights and Privacy Act (FERPA, 1974) 170–171
- FBI
- federal cybersecurity policies 75, 114, 168–172
- Federal Information Security Modernization Act (FISMA, 2006) 170
- firewalls 107, 120, 194, 211
- h
- Healthcare Information Technology for Economic and Clinic Health (HITECH, 2009) 168
- Health Insurance Portability and Accountability Act (HIPAA, 1996) 168, 178
- home schooling 18
- home working, during COVID-19 pandemic 6, 18, 35–36, 122, 204
- and cyberattacks 204
- see also teleworking
- Ibrahim, Ahmed 54
- ICMA survey results
- adequateness of technology 191
- barriers to cybersecurity 37, 73
- cybersecurity awareness 101, 102, 103
- cybersecurity effectiveness 96, 98, 99–100
- cybersecurity insurance 90, 91
- cybersecurity investment 38, 104–105
- cybersecurity management 69
- cybersecurity policies 95, 96, 97–98
- cybersecurity staffing 190
- cybersecurity testing 92
- cybersecurity tools 92
- cybersecurity training 93, 94–95
- frequency of breaches 28
- frequency of cyberattacks 1, 68, 69, 70
- leadership support 102, 103–104
- local government preparedness 72, 100–101
- location of responsibility for cybersecurity 38, 88, 90, 104
- logging of attacks 68
- respondent rating 100, 101, 102
- types of cyberattackers 32, 71
- use of forensic services 94
- identity and access management (IAM) policies 119, 120, 123, 159
- Illinois 59
- incident handling processes
- information security policies 117–120
- information sharing 194–196, 214
- see also cybersecurity partnerships
- as critical infrastructure 2, 22
- data see data, electronic
- and the internet see Internet of Things (IoT)
- reliance on 2
- security see cybersecurity systems
- see also computing management; operating systems
- Internal Revenue Service (IRS) 170
- see also tax information
- International Association of Privacy Professionals (IAPP) 178
- International City/County Management Association (ICMA) 67–68, 76
- survey methodology 76–81
- 2016 survey see ICMA survey (2016)
- 2020 survey see ICMA survey (2020)
- IT data see data, electronic
- IT departments (ITDs) 33, 87–88
- cybersecurity budgets 191
- DISOs 126, 129
- local government 88, 123, 191
- responsibility for cybersecurity 88
- see also chief information officers (CIOs); cybersecurity staff
- k
- Kansas 59
- Kaseya cyberattack 28, 30, 217
- Kentucky 59
- Kesan, Jay P. 54
- King, John Leslie 86–87
- Kraemer, Kenneth 86–87
- K-12 education 117, 206
- l
- legacy technology 216, 218–219
- Li, Zhen 54–55
- Liao, Qi 54–55
- Lin, Herb 9
- local government cybersecurity
- best practice 116, 191, 196, 197, 205, 230
- funding 74–75, 76, 190–191
- future predictions 201–220
- information sharing 194–196, 214
- IT departments see IT departments
- policies see cybersecurity policies
- research on see cybersecurity research
- responsibility for 189
- systems see cybersecurity systems
- vulnerability see cybersecurity vulnerabilities
- local governments 2–4, 6
- budgets 4, 37, 38, 54, 105, 190–191
- cities see city administrations
- compared with private sector 3–4
- and educational institutions 171
- elected/appointed officials see local government officials
- email systems 34, 122–123
- federation 39
- leadership 42, 87
- media relations 123
- number of 2
- online see e-government
- physical security 52–53, 136, 211
- policies 119–120, 123
- political decision-making 4, 8
- professionally managed 87
- as public entities 3–4
- representative organizations 116
- services 2, 3–4
- structure 4
- m
- machine learning (ML) 219–220
- McAfee 62–63
- McCumber, John 20–21
- media and communications policies 123, 162, 164
- Memphis, TN 80
- MeriTalk survey (2021) 202, 203
- Merko, Mark 87
- Michigan 59
- Microsoft 365, 203
- Mirai Botnet 6
- Mondelez International 196–197
- Montgomery, Mark 104
- Moschovitis, Chris 32, 33
- Multi-State Information Sharing and Analysis Center (MS-ISAC) 195, 214
- municipal demography 2, 232n1
- Municipal Research and Services Center 210
- n
- Naples, FL 145
- Nashville, TN 80
- National Conference of State Legislature (NCSL) 174
- National Cybersecurity and Communications Integration Center (CCIA) 195
- National Security Agency (NSA) 211
- National Survey of Local Government Cybersecurity Programs (2020) 58
- negotiation theory 53
- NERC Critical Information Protection Standards 173–174, 175–176
- networks 18, 114
- network segmentation 218
- New Orleans, cyberattack on 5
- New York State Department of Financial Services (NYDFS) 197
- next generation firewalls (NGFW) 91, 92, 107
- NIST Cybersecurity Framework 21–23, 127, 152–156
- applications 153–154
- as assessment tool 21, 54, 153
- as best practice 191, 196, 205
- critical infrastructure sectors 22, 152, 215
- five functions see NIST framework functions
- history of 151
- and PRISM 61
- recommendations 35, 127–128
- risk management see NIST Risk Management Framework
- structure 152–153
- threat spectrum 33
- 2018 version 151–164
- vulnerabilities definition 33
- NIST framework functions 21–23
- categories 159–161
- NIST Risk Management Framework 22, 116, 128, 188
- Norris, Donald F. 49, 60
- North American Electrical Reliability Corporation (NERC) 173
- North Dakota 59
- Norton Security 41, 208
- NotPetya cyberattack 197
- Payment Card Industry Data Security Standard 168–169
- personally identifiable information (PII) 3, 50, 170–171, 178–179
- President’s Commission on Critical Infrastructure 32
- PRISM model of local government 60–61, 64n1
- and NIST Cybersecurity Framework 61
- privacy see data privacy
- privacy policies, local government 24, 119
- public policy papers 27
- Public Technology Institute (PTI) 57–58
- Ryuk malware 5
- Seattle, WA 80
- security breach notification laws 176–177, 214
- security information and event management (SIEM) 217
- security orchestration, automation, and response (SOAR) 217
- Security Scorecard 59
- Shelby County, TN 144
- 60 Minutes documentary (CBS) 31, 208
- smart cities 5–6, 48, 50–52
- SolarWinds data breach 28, 40, 203, 217
- Sophos 212
- spam 145
- spear phishing 29, 31, 145, 188
- state governments 59
- State and Local Government Workforce Survey (2020) 210
- Statistica 5–6, 207
- Stoll, Cliff 19
- surveys see cybersecurity surveys
- survey methodology 76–81
- sampling 77–78
- t
- tabletop exercises 198
- tax collection 188
- tax information 188
- federal 170
- IRS see Inland Revenue Service (IRS)
- local 118, 119
- security 179
- Tax Information Security Guidelines 170
- teleworking 35–36, 210–211
- agreements 211
- cybersecurity risks 36, 210
- see also home working
- threat actors see cyberattackers
- Threats-Vulnerability-Assets Worksheets 34
- traffic light protocols (TLPs) 118–119, 118
- v
- Verizon Data Breach Investigations Reports (DBIRs) 59, 68
- Virginia state security legislation 178
- virtual private networks (VPNs) 91, 92, 107, 135
- encryption 107
- Vitunskaite, Morta 52
- vulnerabilities management 33–35, 91–93, 137
- actions 92–93, 95
- anomalies 158, 161
- back-up and restore 40
- BYOD policies 36, 122
- continuous monitoring 22, 61, 158, 161
- cyber-hygiene see cyber-hygiene
- decommissioning 144, 148n1
- exercises 94, 198
- internet usage policies 35, 36–37
- inventory of information assets 34
- passwords see password security
- risk assessment 93
- social media policies 35
- software patches 34, 99, 121, 124–125, 156, 205
- and teleworking 36
- threat identification 34
- see also cybersecurity administration; cybersecurity policies; risk management
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.