Lawmakers urged to move to a centralized cybersecurity system in Mississippi to protect from attacks – Magnolia Tribune

(Photo from Shutterstock)
With cyberthreats increasing and attacks taking place in the state of Mississippi, the state Senate Select Committee on Cybersecurity heard from a panel of security experts Tuesday to prepare for the introduction of potential legislation in the upcoming session. 
Some of the ways the committee was advised to proceed include moving the state’s cyber infrastructure into a more consolidated system that uses the same vendors, hardware and software to prevent attacks. There were also talk of state agencies offering access to those same services to cities, counties, the education sector, and utilities such as water and sewer. 
Cyberattacks on state agencies and local governments have already occurred this year, including at the Institutions of Higher Learning, the University of Mississippi Medical Center, and dozens of others.
“You’re coming off 36 hours of 70 entities in the state of Mississippi that were hit on one third party vendor,” Senator Tyler McCaughn (R), the committee’s co-chair, described to the panel. “You’re coming off of UMMC. You’re coming off of IHL. You’re coming off Vicksburg and Madison County. You’re coming off of everything that we could see go wrong, that you told us was going to happen, is now here.”
The committee was created by Lt. Governor Delbert Hosemann (R) this year to address the ever-increasing threats that the internet, artificial intelligence and other aspects of a connected life create. 
“Cyber threats are evolving, and Mississippi has to be prepared,” Lt. Governor Hosemann said Tuesday. “With multiple recent cyber breaches and millions of dollars being stolen through Mississippians financial information being hacked, the time is now to sound the alarm and act.”
Greg Mallette with the Cybersecurity and Infrastructure Security Agency told the committee that last year there were about 1 million complaints received by the Internet Crime Complaint Center (IC3) website. Those complaints equated to more than $20 billion in total losses, which is a 26% increase from 2024.  
Typically, individuals 60 or older are more likely to fall victim to cybersecurity breaches or fraud. That age group was about 200,000 of the 1 million complaints, totaling $7.7 billion of the $20 billion in losses.
The threats to a network come in various forms, such as insider attacks, acts of terrorism, cyberattack, extreme weather events, and accidental technical failures. The biggest threats to a state’s data are extortion groups that utilize ransomware to convince an agency to pay money to retrieve what was stolen.
To best prepare for those instances, several of the panelists suggested the state work toward centralizing a large part of its network into one office, if possible. It would not only lead to a universal use of one vendor, and uniformity amongst the state’s various agencies, but a potential for cost savings as well.
Mississippi has some ground to cover to ensure cybersecurity due to the use of legacy computer systems, outdated security protocols, and the lack of trained security personnel to meet the growing demand.
Mallette noted the use of unmonitored remote support software, which creates weak points in the system hackers can exploit. He suggested the immediate use of two factor authentication and creation and maintenance of isolated backups. Two factor authentication would prevent up to 80% of all automated credential shuffling attempts, while a recent backup stored off the internet will prevent the need to pay ransomware attacks. 
“Building cybersecurity across Mississippi is not a one-time project. It’s an ongoing commitment to hygiene, communication and readiness,” Mallette described.
Funding will play a part in how the state updates its level of protection. Bobby Freeman, Director of the Mississippi Cyber Unit, said federal funding has ended, and what has been procured already will need to be spent by 2029. He, too, asked lawmakers to consider setting a centralized system for investigating incidents and creating mandates for local agencies and governments to report attacks within a limited timeframe, such as within 48 hours.
“We lack, currently, a single, codified, whole-of-state cyber authority to command statewide incidents across all jurisdictions,” Freeman explained.
Coordination between his office and other agencies is critical when considering response times, since a faster response time increases the ability to identify the perpetrator. Currently, local agencies and governments are not required to report attacks to the state. That can negatively impact the subsequent investigation and possible prosecution since the attacker can cover their tracks or the IT professional on staff may accidentally delete crucial information in their attempts to restore service.
“So, the sooner we get law enforcement involved, the sooner we can get forensics involved, the more likely that we can trace it to an initial intrusion vector and figure out where the attack came from and how it happened, not just that it happened,” Freeman added.
Another aspect of cybersecurity involves protection from, and the use of, artificial intelligence. Doug Robinson, executive director of the National Association of State Chief Information Officers, told the Senate committee that AI is increasing the number and severity of cybersecurity threats. 
In addition, Robinson said Mississippi needs to focus on recruiting more people trained in disciplines that can secure the state’s data, by both using AI and establishing protections against AI. This workforce need is a priority because the ever-increasing advancements in the technology are outpacing protections. 
“The nation states and criminals and bad actors are always a step ahead in their investments,” Robinson said. “And this is particularly the case in business e-mail compromises and very, very sophisticated phishing attacks which mimic a state’s e-mail domain. And they look just like an e-mail that may have come from state government agencies directing an employee to do something.” 
His suggestion for a centralized system included the state’s higher education institutions, K-12 schools, and water and sewer systems. 
“We’ve seen that within the incidents, just in the last 6 months, directed at water and wastewater systems of municipalities,” Freeman added. “They are at risk.”
By joining our newsletter, you are confirming that you agree with the Privacy Policy

source
This is a newsfeed from leading technology publications. No additional editorial review has been performed before posting.