Information Systems Security Readiness Assessment for Municipalities in Pennsylvania

Bottom line: In this survey of Pennsylvania municipalities' information systems security readiness, researchers found significant system vulnerabilities and a lack of IT and security knowledge, especially among rural respondents. Policy considerations to fix this information deficit include IT resource pooling among municipalities and awareness and security training. 

The survey examined Pennsylvania municipalities' information systems security elements: (1) infrastructure, (2) literacy, and (3) actual use. It found that:

• 84.3 percent of rural and 81.3 percent of urban respondents said their municipality had zero in-house IT personnel.
• 70.5 percent of urban respondents and 55.8 percent of rural respondents outsourced their computer hardware and software support.
• 80.8 percent or rural and 99.1 percent of urban respondents adopted usernames/passwords to control access to their computers.
• 58.8 percent of rural and 45.5 percent of urban respondents said they never change their passwords.
• About 11 percent of rural respondents were not using any access control at all.
• 54.3 percent or rural and 51.3 percent of urban respondents said their knowledge on information systems security was below average.
• About 72 percent of urban respondents and 39 percent of rural respondents backed up files daily.
• 99 percent of rural respondents and 75 percent of urban respondents said their municipalities spent less than $30,000 annually on information systems security software and hardware.
• 89.9 percent of rural and 92.5 percent of urban respondents had anti-virus software installed on their computers.
• 16.7 percent of urban municipalities and 2.3 percent of rural municipalities use smart cards with RFID (radio frequency identification) to access their building.
• 57.1 percent of urban municipalities and 74.3 percent of rural municipalities report using mechanical locks.
• 91.4 percent of rural and 89.3 percent of urban respondents have not adopted two-factor authentication.
• 87.3 percent of rural and 81.1 percent of urban respondents had not received any training on password usage policies, data access and authorization policies, computer security attack precautions, proper disposal of sensitive data, policies for proper internet usage, and transporting computers or data from authorized locations for the 12 months prior to the survey.
• 75.3 percent or rural respondents and 36.3 percent of urban respondents said they did not monitor the logs of network connection activities.

Policy recommendations based on these findings include:

• Resource pooling among different municipalities to share IT staff with security expertise.
• Periodic assessment of information systems security readiness among rural and urban municipalities to monitor progress or any potential deterioration.
• Awareness training and security education among municipal employees.
• A centralized incident management system that keeps track of security breaches and recognizes patterns that surface.
• Written policies for enforcing sound, daily information systems security practices.
• A website that promotes community-driven exchanges of ideas, and that features a multimedia knowledge base specializing in local government-specific information systems security recommendations.