Massachusetts CIO Jason Snyder is seeing a new trend in cyber attacks.
He said this week at the National Association of State Chief Information Officers (NASCIO) Annual Conference that AI has allowed bad actors to find more vulnerable targets, and that means that attacks on smaller local governments are increasing.
It also means that a whole-of-state approach is more important than ever, particularly with changing federal support for cybersecurity, Snyder said.
“It really puts a lot of pressure on the states to bring up their cyber,” he said. “The attackers have not gone down. So we’re actively working to ensure whatever we can do to keep our cyber maturity where it is and that we can help all the municipalities who are under attack on a regular basis.”
As he put it, the bad actors are going to use the same level of attack whether they’re hacking an organization as large as a state or as small as a town. “In many ways, it’s an economies-of-scale question,” Snyder added.
Expanding that definition of what whole-of-state security means was a common refrain for state IT leaders in San Diego. Nebraska CISO Bryce Bailey pointed to his time in the federal government and said he brings “that same mindset that our nation has with our partners” to his state work: “An attack on one is an attack on all.”
Video Transcript:
So one of the things we’ve done in cyber is we’ve brought our public safety and IT together, and we meet on a regular basis, and we’ve been doing that for years. And that, that partnership is the foundation for everything we do for the commonwealth across the state. What we’re seeing that’s different now is I think with AI, we’re seeing cyber attacks affecting less state government and more municipal government.
And so just last week or two weeks ago, we had three different municipalities that were under attack at the same time in Massachusetts, and I think this is the beginning of a trend.
In many ways it’s an economies of scale question. If you think about the attackers, their level of attack, they’re here, and it’s not gonna change whether they’re attacking me or they’re attacking you or, you know, a small municipality.
But the defenders, their ability to scale is, is very different. And so we have, say, this level of defenses, whereas the municipalities have this. And the attackers can use AI to scan quickly across the state and identify the municipalities that aren’t well-defended, and we’re seeing them attacked. So I think we can do more for the municipalities, you know, the whole-of-state approach for Massachusetts.
And I think strategically we need to think about how do we defend that? ‘Cause quite frankly, if a city is out because of a cyber attack, that affects the whole-of-state as well.
