Increasingly sophisticated malicious actors can use a growing number of vectors to attack a government’s network infrastructure, and because governments, like organizations of all kinds, are more reliant on the network than ever, the prospect of a disruptive, and even dangerous, cyber attack is a very real threat.
To defend against cyberattacks, and the real possibility of a “cyber 9-11,” the State of New Jersey formed the first-in-the-nation, state-level information sharing and analysis organization, the New Jersey Cybersecurity and Communications Integration Cell.
Michael Geraghty, New Jersey’s Chief Information Security Officer and Director of the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC), leads this innovative cybersecurity effort.
By bringing together personnel from across New Jersey state government and co-locating his team alongside representatives from federal agencies like the FBI and DHS and other state organizations like the New Jersey Office of Emergency Management and state police, Mr. Geraghty and the NJCCIC give New Jersey the ability to bring the entirety of a state’s resources to bear against a cyberthreat.
Or, in Mr. Geraghty’s words, “anything and everything that is necessary.”
To talk more deeply about his efforts at NJCCIC and to recap his recent remarks at Fal.Con for Public Sector, we recently sat down with Mr. Geraghty.
Here is what he had to say:
GovCyberHub (GCH): Can you tell our readers a little bit about yourself and your responsibilities as New Jersey’s Chief Information Security Officer?
Michael Geraghty: The mission of the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) is to lead and coordinate New Jersey’s cybersecurity efforts while building resiliency to cyber threats throughout the State. As the State’s CISO and Director for the NJCCIC, my role is to lead those efforts, not just within the Executive Branch of NJ State Government but throughout the rest of the state.
GCH: As a state CISO, what cybersecurity threat vectors most concern you, both now and in the future? Are there reasons why these threats are particularly dangerous at the state level?
Michael Geraghty: Currently, one of my major concerns is the exposure of endpoints connected to untrusted networks as a result of the requirements to work from home in response to the COVID-19 pandemic. In an instant, we’ve gone from protecting endpoints on secure, organizationally managed networks with a myriad of defense in depth controls and safeguards to now expecting those endpoints and their individual users to fend for themselves against every cyber threat imaginable. That’s a concern today, as most organizations were not prepared for such changes. It’s also a concern going forward. For the past several years we’ve seen the slow dissolution of network perimeters as we’ve moved to cloud and edge services. This is our new normal, even though we probably didn’t expect to get there for years.
Looking forward, one of my major concerns is the accelerating connectiveness of physical devices. Autonomous vehicles, smart buildings and cities, and everything else being connected will undoubtedly result in amazing societal benefits. At the same time, they are also introducing an entirely new dimension to cybersecurity.
GCH: Why was it necessary for New Jersey to form its Cybersecurity and Communications Integration Cell? What capabilities does it bring to the fight?
Michael Geraghty: Anything and everything that is necessary. The NJCCIC is a component organization within New Jersey’s Office of Homeland Security and Preparedness (OHSP) and we’re comprised of OHSP personnel, New Jersey State Police (NJSP) detectives, and NJ Office of Information Technology security engineers. We’re co-located at the Regional Operations and Intelligence Center (ROIC) along with the NJSP, FBI, US DHS, the NJ Office of Emergency Management and others. And so the resources that we bring to this cybersecurity fight include not only those of the NJCCIC proper, but also the collective resources of our partners in both the public and private sectors.
The formation of the NJCCIC is an outgrowth of the fusion center’s role with respect to counter-terrorism and crime suppression. Fusion centers were rare prior to 9-11, but as we realized after we were successfully attacked on our homeland, we needed to be better at sharing information and intelligence to prevent another tragedy. As a result, fusion centers began to spring up around the country. Today there are over 70 fusion centers. One of our mission objectives in the NJCCIC is to share cyber threat intelligence in near real-time throughout the public and private sectors in NJ, to help ensure we don’t experience a cyber 9-11.
GCH: In discussing the NJCCIC team’s “fusion center concept.” Why is sharing information across state organizations an important part of New Jersey’s cyberdefense?
Michael Geraghty: Cybersecurity isn’t just a state government issue. It’s an issue shared across all organizations throughout the public and private sectors. A cyberattack on a critical infrastructure sector such as energy, water, or healthcare is going to have widespread impacts across NJ and beyond. The impacts are not just technical disruptions – they can adversely affect public health and safety. In that regard, it’s essential that cyber is part of the State’s fusion center, and it’s essential that we effectively share information about cyber threats, along with best practices for combatting them. We know we cannot stop all attacks. Our goal is to make NJ more resilient to them. The only way that is possible is to work collaboratively and cooperatively across all sectors.
GCH: What did you discuss during your session at the upcoming Fal.Con for Public Sector virtual event? What did attendees take away?
Michael Geraghty: For this event, we focused on ransomware – how to mitigate the risks and how to respond in the event your systems become infected.
GCH: Who do you think benefited from attending Fal.Con for Public Sector this year? Why is now an important time to hold this event and why is it important to bring this community together – even virtually?
Michael Geraghty: Just looking at the lineup of topics that were covered and the expertise of the speakers, this event provided everyone an opportunity to learn and improve their cyber posture. It’s a great opportunity to hear from subject matter experts throughout the industry and to apply those lessons they impart in your own organization. Cybersecurity and the threat landscape are continuously evolving. This event was extremely timely, as organizations have undergone tremendous changes over the last few months in response to the pandemic. We’re in unchartered waters, and the information from this event will help us better navigate them.
To watch Mr. Geraghty’s remarks at Fal.Con for Public Sector, click HERE.
Featured image courtesy of New Jersey Cybersecurity and Communications Integration Cell
