State government is a house with many, many windows, and it relies on all its agencies to keep those windows shut tight. While one person in the basement may lower the storm windows, another person in the kitchen may crack a window for some air. Neither has any knowledge of the other's actions because of the historically siloed nature of government.
As the cybersecurity threat landscape grows ever more hostile and sophisticated, it makes sense to take advantage of economies of scale and centralize many security services. Without doubt, there will always be a need for security boots on the street in state agencies. But by centralizing many core utility services, Minnesota hopes to provide all of our state agencies with best-of-breed tools and security processes.
The first centralized security service that we rolled out was vulnerability and threat management. Designed with assistance from many security professionals across Minnesota agencies and housed in our main data center, the solution provides continuous vulnerability assessments of some 150,000 computers, including those at our state colleges and universities. Before this implementation, few state agencies had the technical or fiscal wherewithal to design and implement their own vulnerability management solution.
Now security professionals simply use a web browser to schedule and manage their vulnerability scans, harnessing the power of a single solution that is shared by all. IT workers also receive timely information about threats with actionable steps to mitigate them.
Beyond leveling the security playing field across all agencies, other benefits of centralized cybersecurity solutions include:
Our focus is to actively engage our customers to design security offerings with components that can be built once and shared by all. Collaborating and sharing: When it comes right down to it, it really is that simple.
Minnesota is working to expand its centralized security model to encompass technologies such as intrusion detection and prevention, security information and event management, and network traffic flow analysis. The state is also developing a shared identity management offering.