Don’t Make It Easy for Them to Target Public Infrastructure
Safety National
Don’t Make It Easy for Them to Target Public Infrastructure
For public entities, cybersecurity threats can affect the systems that keep communities running. Water treatment, traffic controls, power distribution, and building automation are increasingly connected to digital networks, expanding the potential consequences of an attack.
Many of these operational technologies were developed without cybersecurity in mind. As older systems become connected for remote monitoring, vulnerabilities can create opportunities for attackers. Public entities must manage those exposures while navigating limited budgets and competing demands.
“Start with the essential services the community relies on, define why each connected system is needed and how it supports those services, and then evaluate the consequences if it is disrupted,” said Ariel Jenkins, Assistant Vice President, Risk Control at Safety National. “That need-and-purpose analysis should be incorporated into an enterprise risk management (ERM) approach. Examples of ERM models include the Committee of Sponsoring Organizations (COSO) ERM, International Organization for Standardization (ISO) 31000, or the PRIMA ERM standard. These are typically used alongside the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Federal and state agencies may pair the CSF with NIST Special Publication 800-53, while local municipalities and public utilities may find the Center for Internet Security (CIS) Critical Security Controls more practical for translating priorities into safeguards.”
Recognize Where Resources and Risk Intersect
Some municipalities and schools may have fewer cybersecurity resources than larger private organizations, leaving them more dependent on legacy systems and outdated security tools. These conditions can increase vulnerability to ransomware and unauthorized disclosure of information. Understanding those limitations is an important part of evaluating public sector cyber exposure.
Prioritize Practical Protections
Public entities can strengthen their defenses through cybersecurity assessments of operational technology, updates to aging infrastructure, network segmentation, multifactor authentication, and strong access controls. Even incremental improvements can help reduce exposure.
These measures also connect prevention with insurance considerations. Insufficient preventive safeguards may affect a public entity’s ability to obtain cyber coverage or the terms on which coverage is available.
“A public entity’s cyber exposure is closely connected to the services it delivers,” said Spencer Timmel, Head of Cyber Insurance at Safety National. “Bringing those operational details into the insurance discussion helps make the conversation more specific and useful.”
Prepare for Disruption
Where internal resources are limited, external cybersecurity expertise can support incident response and business continuity planning. These plans complement preventive controls by helping public entities prepare for the operational consequences of an attack.
Protecting connected infrastructure requires attention to both aging technology and the responsibilities it supports. “Don’t Make It Easy for Them” begins with recognizing vulnerabilities and taking practical steps to reduce them.
