Members of Florida state and local agencies joined industry execs to discuss the state of digital transformation and cloud architecture.
Florida, already the third largest U.S. state by population, is experiencing rapid growth and increased pressure to keep up with more and more citizen needs. The state’s population grew by 14.5% from 2010 to 2020, meaning more citizens need additional internet-based, user-friendly government services.
At the Vision 2024 in-person event in Tallahassee, thought leaders from state, local and federal government agencies joined members from the tech industry on a series of FedInsider panels to discuss how digital transformation can improve customer experiences and strengthen cybersecurity.
Featured Experts:
The Difference Digital Services Can Make
Florida Digital Service (FLDS) has made substantial, impactful strides over the past couple of years. Recently, it was awarded a $30 million cybersecurity grant to benefit cities and counties across the state. Leon County was awarded $720,000 worth of licenses for two cybersecurity solutions, according to Michelle Taylor, chief information officer for the Leon County Government. “There was a next-generation AI base antivirus solution,” Taylor said. “We had that installed, and we are taking advantage of that now. That was huge for us, especially with 2024 being an election year.”
Dr. Craig Knight, solutions engineer at Okta, referred to the FLDS as a sort of consultation group for the state’s local and county governments — advising on proper cybersecurity hygiene and solutions, and ensuring that citizen data remains secure.
“The ability to serve that consultant role and recommend what product to use and how to configure it is critical. Also FLDS can explain what a product will protect against and what it’s not going to protect you against. That is the part of the consultation arrangement where I see [the most benefit],” Knight said. In this way, the FLDS also helps fill the available resources gap found in many city, county and local governments.
Florida, much like the rest of the country, also experienced an influx of remote workers. Providing widespread connectivity in the state is key, but doing so without sacrificing security was critical, and became the basis for every decision regarding remote access.
When COVID-19 hit and required all county workers to work from home, Taylor and her team administered laptops where they could and created a virtual workstation that allowed employees to securely connect to county resources from their home computers. The county’s VPN vendor also expanded licenses so that employees could remain securely connected from home.
Along with security, Knight said states must think of everything they do in terms of the citizen. That’s the concept behind the SunPass phone application, Florida’s prepaid toll program that uses facial recognition technology for security and allows citizens to replenish funds, order new transponders and more from their mobile devices. “Your citizens want to access your services in that way,” Knight said.
Adopting a Cloud-Ready Architecture for Emerging Tech
As agencies explore bringing integrated capabilities to the edge, implementing portable cloud network solutions at the edge of a network also brings key benefits to organizations, like portability. “With portability, you get agility, performance and an environment that is inclusive, both on-premise and in the cloud,” said Jairobe McPherson, cloud AI/ ML engineer for Google Cloud Public Sector. “It allows you to essentially provide your services in a way so that they are closer to the citizens.”
These tools also give agencies the ability to provide services quicker and more efficiently during disaster events. By extending the environment into the cloud, organizations have better management of their on-premise environment.
Plus, “in order to enable the portability, it is really all about how you build and deploy your services in the first place,” McPherson said, like when using containerization. “Using containers allows you to move them to different areas based on the situation that you are encountering.”
There are cost benefits, too. Suppose an environment is set up in a way that both the service and the workload is portable. In that case, organizations can easily move workloads to the most cost-effective place in the environment. That flexibility exists, can be extremely useful during a disaster situation, and allows agencies to leverage and extend cloud environments so they can make use of services, and thus pay for them, only when needed.
It’s important to note that the foundation of cloud adoption is a proper environment for data. Agencies must understand the data they have in their shared ecosystem, how it is used and by whom, where that data originated from and so on. This way, new tools in those cloud environments can leverage that data to be effective. This is when cloud computing can come in handy.
“You have a lot of agencies who are looking at the technical data saying, ‘What can I do about this?’ and looking at the tools that are already out there that a lot of the providers already have,” said Andrew Brown, deputy CIO for the Florida State Lottery.
Cloud environments allow agencies to leverage the tools and capabilities of providers like Microsoft Azure, so they can benefit from secure services that help to manage that data and provide back-end updates. This is especially useful in state and local organizations where resources, staff and money are limited. “It allows us to do a lot more with what we have,” Brown said.
Cybersecurity in the Age of Cloud
The Office of the Chief Inspector General is tasked with conducting governmentwide cyber audits to ensure federal, state and local agencies are measuring cyber hygiene and performance. Steven Henry, director of auditing for the Office of the Chief Inspector General, said tracking the following metrics as proposed by FLDS are promising when it comes to network health: average number of hours to recover, the number of tabletop exercises conducted annually, the length of incidents, the average number of days to fully contain an incident, and the percentage of employees who report phishing emails within five hours.
There are several ways state and local agencies can also bolster cybersecurity. One of which is ensuring that state governments have a relationship with the local FBI office, and including federal agencies in incidence response plans.
“Having a partnership with the FBI can give you access to information, expert groups, training and also peace of mind,” said Matthew Bulavko, supervisory special agent for the FBI. “If you see something on the network, even if it is not a major hack or your firewall caught it, you should still reach out to your point of contact at the FBI as we have access to data, records and information that you may not have.”
Bulavko also noted the most common attack mechanisms, like email compromises, ransomware and insider threats. He also said that nation-state adversaries were increasingly targeting state and local governments and critical infrastructure. All of those kinds of attacks are worth reporting to the FBI so they can continue to monitor the situation and help organizations properly respond.
For IT organizations, Esteban Soto, advisory solutions consultant at SailPoint, said it is important they meet users where they are regardless of the device, application, resources or network that they are accessing.
“When you look at organizations like Google Cloud, AWS or Azure, identity is the first line of defense in protecting their environments and data centers in the cloud,” Soto said. “If you have one of your users who is in the wrong group and has the wrong role in your data center or the cloud, they may have access to the wrong resources to be able to turn off your entire cloud or do other damage.” How agencies protect identities is thus critically important for their security posture, Soto added. Be sure to inventory all digital identities within the organization, and close inactive ones as quickly as possible.
States like Florida may be growing by leaps and bounds, as is their need for better, more internet-friendly digital government services. But as the panelists at the Tallahassee event pointed out, with the right technology, expertise, federal partnerships and cybersecurity best practices, states can confidently keep up with those demands while keeping their networks and constituents safe from an increasingly dangerous threat landscape.
