The IT security team and the Office of Emergency Management (OEM) in Arapahoe County, Colo., are working together to improve cybersecurity incident response.

Traditionally, issues such as active shooters and critical infrastructure haven been considered separate from IT, but they intersect, Amber Winthers, an IT cybersecurity analyst for the county, said during a May 13 Route Fifty event.

For instance, in both situations, “you don’t necessarily know where an attack is or what it is, but you know that you have to start somewhere,” Winthers said. “You have to activate your incident command structure, you have to put resources in place, you have to have a process for these things,” she said. “We started breaking down those barriers — making the language the same, making the process the same.”

Because the main threat the IT security team deals with is phishing, they’re working to change their approach to training county employees on cyber hygiene. Rather than drilling staff to recognize red flags in emails, Winthers is training them on security best practices in general.

“That means I tell people it’s OK to click links and plug in USBs and whatever, and all of these things we’ve told you not to do for years,” she said. That is, it’s OK if users first ask themselves three questions: Was I expecting this? Can I get to this another way, such as through a trusted source? If I can’t get to it another way and wasn’t expecting it, can I verify with the sender that the item is legitimate?

That will prevent many of the smaller-scale threats that take IT’s attention away from protecting against larger ones, Winthers added.

“If you take those three things, those three questions, those three best practices and you instill them in your mind and you become so fluent that that’s how you handle things, then the things that are going to get through are more than likely going to be those bigger attacks that we need to focus on,” she said.

The IT team is also taking a page from OEM by adopting complexity analyses to help determine how severe an incident is and how much response is required.

In general, cybersecurity is getting a boost from artificial intelligence, said Andrew Lohn, senior fellow at Georgetown University’s Center for Security and Emerging Technology. For instance, it can bolster vulnerability scanners by helping users figure out what they found.

But AI also opens vulnerabilities. For one, it can be used to spread disinformation.

“A couple years ago, AI was all about image recognition, and over the last couple years, it’s become all about text generation…. It can be pretty convincing,” Lohn said. “That’s the sort of thing that an advanced, like nation-state, actor could use to make a bunch of really convincing phishing emails.”

AI used for facial and person recognition is also a high risk because the data used to train algorithms can be sabotaged, poisoned or pulled out for malicious use.

“We have to figure out system-level defenses to deal with vulnerable components,” Lohn said.

The experts also addressed the recent ransomware attack by extortionists on Colonial Pipeline. Although it’s a private company, the results – the shutdown fuel supplies — affected governments at all levels. Coupled with a hack on a Florida water treatment plant in February, these incidents highlight the connection that Winthers made between IT and emergency management. For her, the best response always comes back to educating workers.

For hackers, “getting past technology is the hard thing. Getting past people is the easy thing,” she said. “We just need to change our approach. We have the basics. We just need to work on really inputting them.”