Cybersecurity Threats in Local Government: A Sociotechnical Perspective

Abstract

The use of information and communication technologies (ICTs) by local governments is widespread and meant to improve managerial effectiveness and public engagement. ICTs are commonly used by governments to collaborate and communicate with stakeholders. Yet, the use of ICTs increases local governments exposure to cyberthreats. Cyberthreats are increasing and local governments are often under-resourced and underprepared for them. While many organizations combat cyberthreats with technological solutions, it is well known that social aspects—including manager vigilance and buy-in—are critical in reducing cyber incidents. Thus, governments require both social and technical solutions to cyberthreats. This research takes a sociotechnical perspective to examine the relationships between social (e.g., values and perceptions) and technical factors (e.g., design and capacity) and cyber incidents in local government. We use data from a 2018 national survey of public managers in 500 U.S. cities, data from city government websites, and the U.S. Census. The results indicate that manager buy-in and perceptions interact with technical aspects to explain reported cyber incidents in government. The findings expand our understanding of how social and technical factors are associated with cyberthreats in government, particularly manager.

Local Government Cybersecurity Landscape: A Systematic Review and Conceptual Framework

“…MacManus et al [53] also published a portion of the same survey. Among the remaining articles published in the USA context, Wolff and Lehr [9] discussed mitigating the economic impacts of cyber-attacks; Norris, Mateczun, Joshi, and Finin [11] presented findings from a focus-group discussion on cybersecurity issues in Maryland; Norris, Mateczun, Joshi, and Finin [7] and Norris, Mateczun, Joshi, and Finin [15] featured a survey from the first-ever national survey on cybersecurity issues of local governments in the US; Hatcher, Meares, and Heslen [10] featured a comprehensive survey on cybersecurity in local governments; Norris and Mateczun [8] presented the findings of a key informant survey on cybersecurity issues, followed by a comparative analysis between those results and the first-ever nationwide survey in the US; Preis and Susskind [54] discussed the importance of cybersecurity; and Frandell and Feeney [18] discussed managerial perceptions and cyber incidents.…”

“…MacManus, Caruson, and McPhee [53] identified regulatory oversight and a lack of enforcement as crucial challenges for local governments. A lack of visibility and influence can lead to a disconnect between policy formulation and implementation, resulting in insufficient resource allocation and attention to cybersecurity matters [11,18]. The lack of political and bureaucratic support also hinders the development and enforcement of effective cybersecurity measures [86].…”

“…Norris et al [15] conducted a nationwide survey in the USA, revealing that 28% of local governments experienced cyber-attacks hourly or more frequently, with 19% reporting at least one attack per day. The failure to address the cybersecurity concerns of local governments may result in significant consequences, such as the unauthorized disclosure of sensitive information and documents [16], damaging the government's reputation [17], causing high costs for fixing security breaches [12], and hindering the ability to effectively address routine and emergency service needs [18].…”

Understanding Local Government Cybersecurity Policy: A Concept Map and Framework

“…The smart city movement, which significantly enhances urban digital capabilities, also increases our cities' vulnerability to cybersecurity threats [1][2][3][4][5]. In the age of smart cities and digital transformation, local governments (LGs) face increasing cybersecurity threats due to storing and managing a vast amount of sensitive information, including residents' data and critical infrastructure details [6][7][8]. The frequency and severity of cyber-attacks on…”

“…Cybersecurity policies offer a set of guidelines for employees and contractors and enhance the effectiveness of technical measures [18,19]. However, many LGs across the world do not have cybersecurity policies, which is a significant concern due to the increasing rate and ever-evolving nature of cyber-attacks [8,19,20].…”