Iowa State University opens cyber resiliency initiative to Iowa towns, counties, schools

“By having Iowa State sort of run all of this, we have kind of an economy of scale and be able to serve a lot more political subdivisions than if we were to just have each subdivision go out and contract to do this type of work on their own,” Jacobson said.

SUBSCRIBE: GET THE MORNING HEADLINES DELIVERED TO YOUR INBOX.

Part of the initiative is learning the status of cybersecurity and contingency plans for schools, cities and counties in case of a cyberattack or other event that knocks out their services, Jacobson said, as well as what assets they have, such as water treatment and power plants. The center also develops Cybersecurity Incident Management Exercises for political subdivisions to facilitate discussion and connect those who would be essential in keeping operations going during an outage.

Unlike other “tabletop exercises,” which Jacobson said focus on training information technology officials and leaders how to get services back online after an outage, the ISU exercises focus on ensuring functions continue through an outage, rather than having to stop everything for it.

“We’ve seen many cases in the news where organizations have been forced to basically shut down for a week, maybe,” Jacobson said, “and so this really focuses on giving them a process for them to work through, and how does the rest of the organization identify what’s critical, and how do we start to develop some plans to keep those critical functions running?”

Of the around 1,200 political subdivisions spread across Iowa, Jacobson said around 75% outsource information technology services — something he said isn’t necessarily any less secure than keeping everything in-house, but requires a good understanding of what they have to work with and how to keep operations running if certain services go down.

It’s also becoming increasingly common, with Jacobson pointing to the state’s move to contract with private companies for management of state government websites, servers and data.

The ISU team worked with 30 political subdivisions through pilot programs, though Jacobson said some of those processes are still ongoing. He said he’s been pleased with the level of preparedness he’s seen from the groups he’s worked with, but said the exercise reveals additional lines of thinking that people can take away to strengthen their operational continuity plans.

Panora was one of these municipalities, according to a news release from ISU, and Panora City Administrator Lisa Grossman said in the release she found the program left her with “actionable steps to improve her community’s cyber readiness.”

“The content was practical, clearly presented and directly applicable to the challenges cities face in strengthening cybersecurity and preparing for emerging threats. The hands-on guidance and real-world scenario made it easy to understand where our vulnerabilities may be and how to address them,” Grossman said in the release. “It was time well spent and a great resource for Iowa communities.”

Jacobson said the center is reaching out to communities and publicizing its offerings so those interested can sign up, no matter their size. A focus on ensuring participation of rural areas was included with the federal funding and is a part of the center’s work, he said.

It’s not that Iowa’s smallest communities need more help than their larger neighbors, he said, but smaller staffs often means that employees are doing everything and not just focusing on one part of a job, and it’s more likely that those depending on the municipality’s or organization’s services won’t have anywhere else to turn if their information services get shut down.

“Working with some of these communities with a staff of one or two has been quite rewarding because there’s lots of simple things they can do,” Jacobson said. “They’re just as just as vulnerable as everybody else and anything that happens would hurt them just as much as the largest city in Iowa.”

SUPPORT: YOU MAKE OUR WORK POSSIBLE