This podcast is brought to you by govinfosecurity.com, the leading online publication for risk management and security professionals within federal, state, and local government agencies. Minnesota's Democratic Governor and the Republican majority and the legislature have been able to agree on a budget. And without a budget, much of Minnesota government functions cease just as midnight on Friday, July 1st. And for nearly a month, Minnesota State Chief Information Security Officer, Chris Boussey, has been tweeting about the pending shutdown of Minnesota government.
And the story he relates to on Twitter is a frustrating one. Hello, I'm Eric Trapper of govinfosecurity.com. Please bring back Chris Boussey. Welcome, Chris.
Just the threat of the shutdown seems to be having an adverse effect on state IT security. Nearly three weeks ago, you tweeted with my light off notice in hand, bitterly wondering how I'm going to keep a stellar security team together. So we could go, you wrote a top security pro is leading state government out of frustration with a looming shutdown. I wondered if policymakers even care.
And yesterday you tweeted, even if a deal unfolds, our security program has already suffered a reputable harm and has lost a valuable time. Sound dire. Yeah, actually it is very dire at this point. And, you know, since we started this security program, you know, roughly five years ago, we've been working so hard to build a team to put together, you know, a strategic and tactical plan to really drive this thing with the reader that it needed to go from, you know, a state that had individual agency security operations to an enterprise wide plan with tools and processes.
The thing that's been frustrating for me is I feel like the month of June has been the really the first time in the five years that I've been here where I felt like our program really didn't make the progress that it needed to make. We have a tactical plan where we report out every month with metrics of progress that we've been making against our objectives. And we don't have a good report now for June. But really most of the activities have been centered around the shutdown planning.
What are we going to do at this point to be provisioned security clearances for thousands and thousands of employees and what kind of work needs to be done so that the real work of driving the strategy and security tactics has been replaced with more of a tactical reality of trying to figure out what we do about access control and cognitive operations planning and some of these things that pertain to the shutdown. That's all about what would happen. First of all, how many people working on security in Minnesota government? Actually, I don't have a precise number for you.
We have a core that's in our enterprise security group. And there's also people scattered throughout all the different government agencies that perform security duties. The thing that would worry me in this particular case is that right now when you look at the problem that government security professionals face, I think you may have reported in one of your tweets and stories that there's virtually a 0% unemployment rate for security professionals. When you look at us in government that are trying to compete with salaries of the private sector which are often higher than government, things like a looming shutdown where people have to question whether or not they're going to have a job, how long they'll be out without a paycheck.
Those are the kind of things that are a strike against us. In my case, I've already had one really talented guy that basically said I have a family in a mortgage payment and I just can't afford this uncertainty when I don't have to. So even though they may love our program, what we're doing and really love us as an employer, a lot of people may not be willing to hang on and ride this thing out because it's just not, they just don't have the financial wherewithal to do so. We had an interview about two years ago where you discussed that despite some of the pay disadvantages, there was a lot of good things that attracted people to state government, ID security.
Yeah, that's correct. I think there's really, it's a feel-good organization where we're trying to do something, put in place a program that I think is going to buy in large, help society. It's going to help protect people's vital data to make sure that critical government processes are there in times of crisis. So it's very much a feel-good kind of job.
Back to the matter is we're going to be telling people that they may have an extended period of time and they're simply not going to get paychecks. I think a lot of the feel-good side of our story that we're trying to sell may go out the window because people have the reality that they have mortgage payments and bills to pay and savings that they need to have for their kids to go to college someday, and those are the things that worry about the shutdown. If the shutdown occurs, will the IT security staff still be expected to work and just hope to get paid one day? No, right now the legislature obviously funds programs and state government.
Now the paradigm is shifted to where the decision of what our critical services and what our critical services is actually moved over to the judicial branch, and attorneys are trying to figure out and judges on what our critical services and trying to figure out what laws govern how states are funded when the legislature and governor can't come together to actually make those decisions on their own. What services will be available right now is being decided by judges that court hearings are going on right now, and they'll ultimately decide whether cyber security are services that are valuable and need to be kept going during a crisis. We don't know whether or not security services will keep going during a shutdown or not. That's going to be something that will be in the hands of judges.
That's one of the things that's a little bit frustrating for us is knowing that these kind of decisions that are really important are now outside of our control. You know, in this case, it's a Ramsey County District Judge in Minnesota. There are those who say one of the weaknesses in our government is the lack of judicial understanding of the importance of IT security that often you hear in terms of the law does not keep pace with the changes in technology. Is that a fear that you have?
Everybody who's running government service right now has that same fear. I think it's not just IT security. There's a lot of folks wondering how is this judge going to really understand what we do and the significance that it's not done. So it's just when do I just want to make this decision?
Right now, yes, that's the way it's set up. So there's lots of different petitions before the court now with different groups that are actually trying to petition the court to see what services remain operational and which don't. We don't have a parent. Our executive team and our agency has done our best to try and figure out, well, if the court does rule that cyber security is something that's necessary, what would be the minimum skeletal staff that we would put in place and what are those services that we would keep operational in a time of crisis?
Our assumption is that, you know, the planning and leadership services that we do to kind of drive the long-term agenda of our program, that those wouldn't be deemed like safety type of critical activities, but maybe the operational aspects that we do such as continuous monitoring, all the really management, those things that critical services rely on would be necessary, but we really don't know how the judge will rule, and whether they'll agree with their assumption of how things should play out if the shutdown does affect, in fact, occur. We're waiting to see what happens in the meantime. We're planning as if the minimal skeletal proof of the core operational systems will be needed and we're trying to figure out the staffing model and how things will happen starting this Friday. IT, IT, security is so complex, well, I'm listening to what I'm thinking about, things such as, well, there's probably a lot of state-issued mobile devices out there.
What becomes of that? How do you manage that? Well, there's state-issued devices. There's mobile devices.
One of the elements in our plan right now is how are we going to control access to those environments? How do we deprovision devices and users that won't be deemed critical, but yet keep on those devices and users that will be deemed critical, and then looking at our different messaging environments, our Blackberry environment, our Exchange environment, and trying to figure out technical plans to make this all happen. The tough part about it is we don't know yet who's critical and who's not critical, so we're going to find this out probably at the very last minute and have to figure out how our provisioning will happen. So it's hard for you to plan for this?
Well, we're trying to figure out general plans as to what we're going to do for each of these environments, but the problem is we don't know who the specific people are that will be here and will not be here. That's actually yet to be determined by the district judge. I wish you best of luck. It's an interesting scenario.
I think as a chief security officer, if you can navigate through these waters, I feel like you should be able to navigate through just about anything. It's a situation that I hope none of my peers have to face. Well, thanks, Chris. Thank you very much, Eric.
I was speaking with Chris Bussey, Minnesota State Chief Information Security Officer for govinfosecurity.com. I'm Eric Stravro. Thanks for listening. This podcast has been brought to you by govinfosecurity.com.
For more interviews, breaking news, research and educational webinars, please visit www.govinfosecurity.com.