Cybersecurity Podcast Transcript Layla: Public entities face unique cybersecurity challenges, from protecting complex systems to safeguarding confidential information. Today, let's discuss practical cybersecurity strategies and how public entities may use Statewide Contracts to strengthen their defenses against evolving threats. You are listening to WOSD News: Procurement Insights. I'm your host, Layla Palmer. Today, I'm delighted to be joined by MassCyberCenter's John Petrozzelli, who will share expert cybersecurity insights and practical tips to help public entities stay secure. John: My name is John Petrozzelli. I'm the Director of the MassCyberCenter. The mission of the MassCyberCenter, which was set up by the Baker administration and supported by the Healey administration, is bipartisan in nature, and it's basically there to support municipalities, nonprofits and small businesses that are limited in what they have for resources available to them. And so what we do as MassCyberCenter is try to provide them with updated threat information, resources they could use that are free or relatively inexpensive. And we try to give them guidance that they can use to strengthen their cyber security resiliency and, um, try to protect them against these most current threats. Layla: Well, speaking of those threats, what are the cybersecurity or technology trends that the public sector should really be paying close attention to right now? John: The nature of the threat remains the same. These are people who are maybe financially motivated. These are people who are working on behalf of a state sponsor of cyber attacks like Russia or China, or it's like I said, financially motivated groups that might be an offshoot of some of those governments or groups that may have formerly worked for those governments. So what we're seeing is these threats that continue to be the same types of groups have evolved with the technology. So now you've got malicious tools, malware, ransomware, information stealers, all on the dark web that are now crowdsourced. So people can hire a bad actor to do work for them to target an organization. If someone is disgruntled with their company or their entity, they could go on the dark web and hire someone to attack that company or entity. So with the propagation of a lot of these tools, we start to see a wider attack base. And so a lot of places that have the attitude "we're too small to be targeted" are now being targeted because with the propagation of those tools layered in with artificial intelligence related or assisted attacks, it gives threat actors the ability to target more with less resources. And so when they're always on the offensive makes it really hard for the defenders with limited resources to be able to block everything that comes in. And the threat actor needs to be good once, they need to break in once. The defenders need to be accurate one hundred percent of the time. And so it's a really complicated defensive environment, and that's where we try to help with some of our different initiatives. Layla: What types of things should agencies really be paying attention to and preparing for? John: So the majority of the big attacks that we're seeing are still involving ransomware. Ransomware may be part of a multi-stage attack against an environment taking advantage of zero day vulnerabilities, which are unknown vulnerabilities in software for programs that are internet facing like firewalls, servers, cloud resources, browsers, operating systems. You know, those are basically some of the common vulnerabilities that bad actors can use to steal information or encrypt a computer. Then you layer in the AI related attacks. And those could be AI assisted attacks where a hacker doesn't know how to necessarily get into an environment, so it uses the AI to help probe it. So we're seeing these AI type of assisted attacks that really speed up the process from initial entry to exploitation. The more prevalent one that we've seen a lot is these cloud based business email compromise type attacks where someone captures somebody's credentials, they could be an admin or they could be a employee. What these threat actors do is basically blast out these emails, expect a certain amount of people to click on those emails, compromise those accounts, and then flip those emails again and blast now another blast through people who were just compromised. A lot of that is scripted, meaning that it's not necessarily AI driven, but it could be. So what we're seeing is once someone got into an Office 365 account, it used to be days or weeks before that attack took place. I've seen it as quick as twenty minutes from when a bad actor got into someone's email account to when that email got deployed. And it's really just a matter of how sophisticated the threat actor is who compromised the account. Layla: Wow. Cyber risks. They're evolving so quickly and it's really hard to keep up. So what are some of the biggest operational pressures that agencies may start to feel when it comes to these cyber attacks? John: For agencies as a whole that identity piece is so critical. So when a hacker gets access to that identity, then they can get into an environment. And depending on who has certain privileges in the environment, they can go far. So if I'm an IT person and my account allows me to get into anything, then if my account gets stolen, the hacker can use my identity to get into everything. And so that, I would say, is one of the biggest threats we're facing right now is the identity side of attacks and organizations in general need to be able to lock down their identities of their employees. Who has access to what? And is it possible that they could limit that access to the responsibilities that that person has? That would be the biggest takeaway I would have. Number two would be all the rest of your employees making sure that their computers and their devices, their identities are locked down and that they're observant to suspicious activity. Number three would be those internet facing vulnerabilities. One of those such vulnerabilities is identity, like we talked about. But for people who have an on-premise environment, like they have a workplace that they go to and there's servers, there's data there that bad actors would want, such as a municipality. Internet facing vulnerabilities are the critical cog to a lot of this, because what we're making available on the internet is also available to these groups to try to target. So limiting what is out and available on the internet is really critical. And then having an ability to know and to be able to log what's in your environment is also really crucial because if you know what's in your environment - you're using good tools like endpoint detection and response and logging tools, zero trust tools - the more tools you have in place, the harder it will be for them to get to that compromised server or use those credentials. So it's really important to stack and create layered cybersecurity so that you can stop those threat actors as well. And then having a backup plan, having an incident response plan is really crucial. The sixth thing I would mention is none of this matters if you don't have leadership buy in. You can have all the first five, but if you don't have a leadership that's willing to support their IT team...Like I had seen it, I used to work for a services provider. We had the owner of the company who would refuse to put in multifactor authentication. So he would he would say, no, I'm just using my password. And then his username, he would not put multifactor authentication in there. That was an example of a horrible leader when it came to cybersecurity. Layla: Multifactor authentication is like second nature these days, you don't go without it. John: Right. Like locking your door. Multifactor authentication is like the simplest way to protect that identity. Layla: Now that we understand the importance of layering cybersecurity defenses, Senior Category Manager Josh Flanagan-Lanier will share how public entities may leverage Statewide Contracts to put those practices into action. For public entities who are using Statewide Contracts, what cybersecurity solutions and services can they access? Josh: We have a pretty wide range of offerings. I think if you were to Google it or if you look on mass.gov or the OSD website, ITS78 will pop up. This is the only Statewide Contract we have with cybersecurity in the name, and there are a number of different services available there. However, almost any IT Statewide Contract will have a cybersecurity angle to it. For instance, ITS86 Software and Services doesn't say Cybersecurity. Cybersecurity SaaS offerings, Software as a Service, are widely available under that contract. But we do have ITS78, and that's probably a key area to focus. That contract has four categories. They range in services offered. Some of the primary solutions on ITS78 are cybersecurity audits. That's maybe the most commonly procured item there. Other services that are commonly procured include penetration testing, validation of compliance with various standards, regulatory, legal policy. Also included is category for incident response. I was going to get into that a little bit later, but that's a that's a more active kind of event response as opposed to proactive getting ahead of it. Layla: You mentioned auditing, and it sounds like that may be for agencies who are kind of at the beginning of their cybersecurity journey, they need a little bit of a launch pad or a path in terms of where to go. So just get a little bit more into detail about what buyers can find through those. Josh: Yeah. So Category One is probably if you're early on trying to understand what your current cybersecurity profile is. If maybe those records or those notes hadn't been kept about how we got to where we are. Often an IT environment will be a hodgepodge of many different systems that were procured at different times. Some are very old, some may not even be supported anymore at a cybersecurity level in terms of if the publisher or whatever the original vendor was no longer supports it. And so those audits under Category One can help you understand and document where your gaps are, where your strengths are, and where you can focus on improving your readiness. Category Two is somewhat similar, but it's really oriented towards third party risk assessment. So if you think about your environment, you may have IT solutions that are your own, maybe an in-house development, or maybe it was originally developed by a third party but became yours, the keys were handed over to you. But basically Category Two is for those third party services. So your software solutions that you have a license for, those vendors on Category Two can help assess those third party solutions for gaps or risks that may exist there. Very often your weak point is not really yours. It's a vendor you've hired to deliver some sort of service to you, or product that has a back door into your network, or whatever it is you're trying to protect. Category Three is for testing and readiness. This category is for trying out real world scenarios on your infrastructure, on your people. That's kind of an under thought about element of this. You know, how do people react to an incident? You can test that out. You can do tabletop exercises. I know that's something that EOTSS does pretty regularly to make sure that their people and the other people they work with are ready for response should something happen. Layla: Always getting those phishing tests as well. Just did one of those the other day. Josh: Yeah, I'm sure that's definitely part of their plan. But it goes it goes beyond that too. It goes into penetration testing. So that's hiring a vendor to try to break your system. That can help sort of identify what a true bad actor might be able to find, but also include identity and access management assessments. So the multifactor authentication, how well is that working, assuming you're using it. Various entry points into your systems, how secure are they? And generally the category is about determining what your real world readiness is. What I would note about this category, especially for Commonwealth state agencies, is EOTSS really wants to make sure that you contact them before you procure really a lot of things off this contract, because obviously they're the keeper of the keys, so to speak, of cybersecurity for the state agency group as a whole. And so although this contract is open, like any OSD Statewide Contract to a wide group of buyers, if you're a state agency, a lot of these times you want to make sure you're working closely with EOTSS on a lot of these projects because they obviously have a very important role to play. Category four is really the one category I hope nobody ever uses because this is our incident response category. So there is no need to use this unless you have a suspected incident. So a real world suspected breach or something else happening. So this is kind of an emergency response category where vendors are more or less on call to help respond to an incident. And once again, if you're on the Commonwealth network, please talk to EOTSS should you suspect a breach. 00:13:02 Layla: What would you recommend as their first step for exploring ITS78 and just figuring out which category really fits their need? 00:13:10 Josh: As always, we point people to the Contract User Guide. It gives you a pretty good rundown of the different categories. But the big picture on this I always want to remind buyers of is vendors only have what you give them to work on. And so if you want an effective response to an RFQ or an RFI that you're putting out, or just in a general communication to them, the more information you can share- and obviously with cybersecurity you don't necessarily want to share everything in an RFI, let's say - But the more you can share that can help them craft an effective response, the better, higher quality responses you'll get, the more accurate quote you'll get, the more the vendors will understand what it is they're taking on, potentially by working with you. Layla: Let's head back to John Petrozzelli to learn how state agencies and municipalities exchange cybersecurity insights and strengthen collaboration across the Commonwealth. John: Our Cyber Resilient Massachusetts Working Group is volunteers, it's not a paid function. It's people who work for municipal IT or school systems. It's state employees. It's people who are part of the Massachusetts cybersecurity ecosystem, and partners sometimes outside of the Massachusetts ecosystem. GovTech is an example, they sponsor a bunch of these different public sector cybersecurity summits. So they're invited into our working group. But primarily every other Monday, we have about a half hour call. We talk about the latest attacks and attack methods. We have a briefing from the Commonwealth Fusion Center. And so the Fusion Center provides threat updates to us on what they're seeing. And then we have a roundtable, and the attendees talk about things that are germane to what we're seeing in the cybersecurity space in their world, and that has really fostered really good interaction between different people on that call. Because sometimes you'd have a town administrator say, "Hey, we just got this thing. We stopped it. But like, we want to spread this to everybody else so that they have this awareness." And so at the end of the call, typically we'll send out an email essentially with the episode notes, if it was a podcast. All of the articles that we highlighted, we send out all the patches, and then we send out information that the Fusion Center has authorized to push out as well. So any public sector employees, you're welcome to join that. Nick Butts is our outreach program manager. butts@masstech.org. We'll invite you to the call every other week. But that's really been a really good way of us to be able to share threat information in a as near real time way as we can do it for the government. Layla: This concludes today's episode on the cybersecurity tips helping agencies stay secure. Thank you to MassCyberCenter Director John Petrozzelli for joining us today. For more resources, head to masscycbercenter.org. And thank you to Josh Flanagan-Lanier for joining us. Visit statewidecontractuserguide.mass.gov to explore the data and cybersecurity services available to public buyers. Visit the OSD YouTube channel for more informative content, including training videos, webinars and podcasts, with new episodes released each month. Be sure to subscribe and check back for future episodes highlighting the people, programs, and policies shaping public procurement in Massachusetts. This podcast was produced, engineered, and edited by me, Layla Palmer. Thank you for joining us.
transcript