For the second consecutive year, the Arizona Department of Homeland Security (DOHS) is making a total of $10 million available for entities to obtain anti-phishing and security awareness training, cybersecurity tools and licenses for end-user devices, threat-sharing systems and incident response services from the National Guard, according to John McFarland, cybersecurity program coordinator for the Arizona Department of Public Safety.
McFarland told Government Technology on Thursday that the Arizona DOHS began cybersecurity outreach services in 2018, but since then the effort has obtained more funding and become more organized, with greater collaboration from various state agencies and participating entities. The grants are considered noncompetitive, so applicants can get what they need with minimal administrative effort.
The program is not limited to rural entities, as Phoenix and Tucson have also benefited from grants and services, but the outreach efforts have been concentrated on small communities where leaders would otherwise think cybersecurity measures are financially out of reach, McFarland explained.
“This is especially important for our K-12 [school] partners,” he said. “They are the fastest-growing group, and they have very small budgets.”
Jennifer Pittman-Leeper, a former Arizona state employee and now a senior cyber strategist with Tanium, the state-selected vendor that is supporting the Cyber Readiness Program, said schools have been asking for help.
“There’s a lack of experience and a lack of resources," she said. "If they have to decide between hiring staff or [purchasing] cybersecurity software, who is going to lose this battle?”
The outreach component of the program is called Arizona LEGIT (Local Education and Government Information Technology). McFarland said forums have taken place in every region of the state since the program started conducting them last year, and in the past several weeks he made return visits to help entities continue their cybersecurity efforts. He said entities who feel they still have not been reached can request more local meetups with program representatives.
“We’ve established relationships and obtained feedback,” he said. “This [making return trips] gives us an excuse to bring them together. You are so much better when you’re sharing information. Once this was kick-started, several of them [participating schools and local governments] have been meeting with each other monthly.”
McFarland said under the threat-sharing component of this program, entities use the same platform to report possible phishing emails and other concerns. The incident response component, he added, provides “boots-on-the-ground assistance” in the form of cybersecurity specialists from the National Guard traveling to sites after reported attacks. Schools and local governments can also proactively request National Guard personnel to conduct vulnerability assessments at their sites.
Pittman-Leeper corroborated the idea that collaboration between all local governments and schools is the key strength of this initiative.
“It’s a coalition of the willing,” she said, noting that participation has been excellent so far, and there’s plenty of interest across the state of Arizona to keep the program going for years to come.
“If you see creepy crawlies in eastern Arizona, you can warn the rest of the state,” she said. “These are run and owned by the locals. Our program is unique because it’s not a case of the big bad state coming in and telling everyone what to do.”
Pittman-Leeper said in the months to come, she expects to see more collaboration and resource sharing between small governments and community colleges. She added that Arizona is considered a front-runner in public cybersecurity and an example that neighboring states will follow.
Jennifer Duenas, an IT technician in the rural Show Low Unified School District about three hours northeast of Phoenix, said small districts like hers have been on edge ever since a cyber attack hit the nearby Snowflake school district last year. Both districts are participating in the Cyber Readiness Program.
“That made everyone really nervous,” Duenas said in an interview with Government Technology on Thursday. “Now, we feel less vulnerable. We are sharing a common voice.”
