Who is a member?
Our members are the local governments of Massachusetts and their elected and appointed leadership.
Mike Steben, Westfield’s network administrator, discusses municipal technology needs during the Massachusetts Municipal Cybersecurity Summit on Oct. 6.
Even as cyber threats multiply, communities can leverage an increasing number of resources to protect their systems, state officials said during the second annual Massachusetts Municipal Cybersecurity Summit on Oct. 6.
The summit, hosted online by the MassCyberCenter, provided municipal leaders and employees with information about available resources and strategies to help municipalities bolster their cybersecurity resilience.
“There is a lot out there for municipal cybersecurity, in terms of programs, and resources, and guidance,” said Meg Speranza, resiliency program manager for the MassCyberCenter.
Cybersecurity centers
The summit highlighted statewide efforts to create a larger pipeline for cybersecurity professionals while increasing research into cybersecurity threats and providing operational support for municipalities.
Over the next year, officials expect to work on creating Cybersecurity Centers of Excellence at colleges and universities across the state — centers that would include both cyber range facilities and security operations centers, or SOCs. The cyber ranges will function like academic labs, where professionals and students test out software and strategies and run cyberthreat simulations, while the SOCs will provide real-time security support to customers, including municipalities, nonprofits and small businesses. The ranges and SOCs will offer academic instruction and hands-on training for students. For example, Springfield Technical Community College is already involved in planning for a center at Springfield’s Union Station.
These facilities will operate under the aegis of CyberTrust Massachusetts, a new nonprofit established to “strengthen the cybersecurity of under-resourced local entities,” and to build a more broad and diverse cyber workforce. The nonprofit will also form a consortium of businesses and academic institutions to further these goals, according to Peter Sherlock, a consultant to the MassCyberCenter.
Summit panelist Mike Steben, the network administrator in Westfield, said he hopes the new centers benefit municipalities by addressing the difficulty of attracting and retaining cybersecurity-skilled employees, giving communities more insight into the tactics and methods of cybercriminals, and bolstering the cybersecurity of municipalities through security operations centers.
“I believe that a 24/7 threat-monitoring service would be extremely beneficial to communities,” Steben said. “Try as we might, we simply have no way to provide 24/7 IT coverage using our own resources. For me, to have the SOC backing up municipal IT operations is invaluable.”
State resources
Since its inception in 2017, the MassCyberCenter has worked to strengthen the cybersecurity resilience of Massachusetts organizations. It offers resources including a Municipal Cybersecurity Toolkit, designed to help local officials examine their security needs; the Minimum Baseline of Cybersecurity goals for municipalities; and Cyber Incident Response Planning materials.
The Municipal Cybersecurity Summit also highlighted other state technology and cybersecurity grant programs and resources: the Municipal Cybersecurity Awareness Grant Program; the Cybersecurity Health Check Program, which allows communities to access basic cybersecurity services for free; the Community Compact IT Grant Program; the IT Best Practice Program; the Efficiency and Regionalization Grant Program; and the Municipal Fiber Grant Program, which helps with communities with the construction and completion of fiber networks.
Danvers Information Technology Director Colby Cousens discussed how his town’s work with neighboring communities grew into a formalized IT collaborative, with shared services for the communities of Danvers, Essex, Hamilton, Manchester-by-the-Sea, Middleton, Topsfield and Wenham. Established in 2021, the collaborative offers joint technology services, infrastructure, and cybersecurity efforts, among other services.
Cousens said the collaborative has benefited significantly from state resources, including Community Compact funding, a $300,000 grant from the Municipal Fiber Grant Program to complete a fiber optic network through the collaborative’s seven communities, cybersecurity guidance from the MassCyberCenter’s Minimum Baseline of Cybersecurity, and security awareness training through the Office of Municipal and School Technology.
“I have found the resources available from the state to be very helpful and very accessible,” Cousens said. “I encourage anyone to go after those.”
Technology Services and Security Secretary Curt Wood urged all stakeholders to collaborate to improve technology defenses in Massachusetts.
“Cybersecurity is everybody’s responsibility,” Wood said. “If we’re going to be successful in defending against potential cyberattacks, awareness is key.”
Federal resources
State officials said they’re also preparing for the new State and Local Cybersecurity Grant Program, created by the federal Infrastructure and Investment Jobs Act. The new program will provide $1 billion over the next four years. States are expected to apply and distribute 80% of the funding they receive to local, tribal and territorial governments.
Daniel King, Region 1 cybersecurity chief for the federal Cybersecurity and Infrastructure Security Agency, said his agency offers a range of programs and resources to help municipalities, including cyber resilience reviews of a municipality’s operational resilience and cybersecurity practices, and “cyber hygiene” scans of websites.
• 2022 Massachusetts Municipal Cybersecurity Summit recordings and resources