New Hampshire welcomes Cybersecurity Advisor
Meet Rick Rossi, New Hampshire’s first Cybersecurity Advisor, a newly created position within the Integrated Operations Division, Cybersecurity & Infrastructure Security Agency of the Department of Homeland Security.
When and why was this position created?
This position was created by Congress in the fiscal year 2021 National Defense Authorization Act, so I’m a federal employee funded by the Department of Homeland Security. It was created to improve communication as well as awareness of resources and collaboration between the federal government, state and local governments and critical infrastructure owners and operators.
What is your background in this type of work?
I come into the role with prior experience with the Department of Homeland Security and the Intelligence Community. … I’ve been with the Department in some form or fashion for almost 16 years now. I’ve done a lot of work with critical infrastructure owners and operators in terms of hardening their defenses and mitigating threats from our foreign advanced adversaries and other significant criminal cyber actors.
What exactly does this position entail?
My role as the Cybersecurity Advisor for New Hampshire is to offer cybersecurity assistance to critical infrastructure owners and operators, as well as state, local, tribal and territorial governments. That assistance can take the form of many different things, including introducing organizations to the myriad cybersecurity services and products that are available to them at no cost, as well as other public and private resources. … Additionally, my role includes providing cyber preparedness assessments, protective resources, strategic messaging, working group support and leadership, partnership in public-private development, as well as incident coordination and support in times of cyberthreat disruption and attack.
What do you hope to accomplish?
One of the primary goals is to make contact with as many critical infrastructure owners and operators, municipalities and government entities as possible … and [develop] a robust partnership between the public and private sector in terms of information sharing, cooperation and thought exchange. It’s not ideal to be exchanging business cards in the middle of an incident; it’s very useful to develop those relationships in advance. The secondary [goal] is to make sure that entities are aware of the cybersecurity resources available to them. … Oftentimes, we find that municipalities and smaller organizations … are very reticent about cybersecurity in terms of the investment monetarily … and aren’t always aware of the breadth of resources that are available to them at no cost through … public and private means.
What is the biggest challenge?
[Cybercriminals] generally gravitate toward targets of opportunity. New Hampshire has a number of very small towns and small businesses, and oftentimes those smaller entities don’t have the budget to put together a robust cybersecurity program. Oftentimes, there’s a misconception … smaller entities [have]: ‘Why would anybody want to attack us?’ The truth of the matter is, to a cybercriminal who’s after monetary gain, the size of the organization doesn’t matter. If it’s an easy buck, they’ll take the easy buck. So one of the challenges I have is [increasing] the knowledge that … the size of an organization doesn’t always [factor] into [cybercriminals’] targeting decisions.
Has Covid contributed to cybersecurity threats?
Early on during the pandemic, we saw the cyberthreat environment really ramp up, the reason being that most organizations weren’t prepared for a near-100-percent remote work environment. You had a lot of smaller businesses and organizations that don’t traditionally have people working from home having to employ remote access solutions to their networks, and when you’re trying to do something in haste, oftentimes, unfortunately, security doesn’t always take a front seat. We saw a lot of [criminals] … looking to take advantage of that situation where we didn’t always have security at the forefront.
How can New Hampshire residents protect themselves and their families from cybersecurity threats?
They can create strong passwords for their home WiFi network … as well as email accounts and social media. … If you have a simple password, like a dictionary word or something that can be easily guessed, like your pet’s name … [cybercriminals] could enable a password cracker [that uses] algorithms to guess your password. … You want to use passwords that are more complex, that aren’t dictionary words, that can’t be easily guessed, and that involve uppercase and lowercase letters, numbers and special characters.
Featured photo: Rick Rossi. Courtesy photo.