Local Government Cybersecurity: How Michigan Counties Cope with Cyber Threats

Abstract

In the age of global interconnectedness, we can all be equally affected by cyberattacks. Given the evolving nature of threat landscapes, comprehensive and preemptive practices are needed now more than ever to keep local government and citizen data secure. According to Recorded Future, in 2019, local U.S. government infrastructure was targeted by ransomware attacks 100 times. Cyber threats to local government systems have been increasing exponentially over the last several years, and the frequency of attacks will only continue to grow. Although cyberattacks on local government entities are rising every year, the challenges county IT departments face in combating the thousands of yearly attacks remains largely unexamined. This research study aims to understand how Michigan counties are currently protecting their IT systems, define the challenges they face in improving their cybersecurity posture, and address the potential improvements regarding current cybersecurity practices. This thesis addresses these goals through semi-structured interviews and a post-interview questionnaire with local government IT leaders across the State of Michigan. The results of this research study found challenges local Michigan governments face in enhancing their county's culture of cybersecurity, operating with limited funding and support, and inability to properly utilize state resources due to limited staffing needed to operationalize. A surprising finding was learning how essential communication and relationship building are to cybersecurity and how these relationships impact the culture of cybersecurity in an organization. By identifying these challenges, policymakers can introduce evidence-based policies that will address the essential needs of local Michigan counties and provide actionable and implementable solutions. Additionally, it will enable researchers and cybersecurity professionals to develop recommendations and mitigating solutions to improve local Michigan government cybersecurity.