Hear from Reclamere’s president & founder, Joe Harford, on the current state of cybersecurity & risks to be aware of.
Written Testimony of Joseph P. Harford, Ph.D., CSDS Founder and President, Reclamere, Inc. Pennsylvania House Majority Policy Committee
Chairman Causer and members of the House Majority Policy Committee. Thank you so much for the opportunity to provide written testimony about cybersecurity and the threats posed by predatory attackers in Pennsylvania. Your work on enacting policies and legislation to protect your constituents is critical to Pennsylvanians and has a direct impact upon the people I interact with each day.
My name is Joe Harford. I have the privilege and honor to serve as the Founder and President of Reclamere. Along with my business partner and CEO, Angie Singer Keating we operate a twenty-one-year-old information technology asset management company in Blair County that specializes in supporting the cyber security resiliency of our clients. We support clients in healthcare, financial services, education, and government. Reclamere is proud of the work that we conduct both here in Pennsylvania, across the United States, and internationally. In addition to my responsibilities as a business owner, I am an adjunct faculty member at Juniata College, teaching entrepreneurship in the business program. I also serve as a Walker Township Supervisor in Huntingdon County, and I volunteer as a member of the Pennsylvania NFIB Leadership Council. I share this with you so that you can have a better understanding of my background and my perspective on cybersecurity.
It should come as no surprise that data breaches and the damage caused by them are on the rise. However, what may be of interest is that this is not the way that it must be in our state government, businesses, or schools. Nor do we have to believe that a strong information security posture must be burdensome or expensive.
I want to commend you for investing your time to examine this important area of cyber resiliency and protection. As more of Pennsylvania’s students go online in schools leveraging the power of the internet to learn and create knowledge, your efforts to develop effective policies will be paramount to protecting them. As the amount of information that is created, stored, transacted, and managed continues to grow exponentially, your work on future legislation will be critical to protecting our citizenry. As the global “Internet of Things,” IoT services market grows from an expected $163.70 billion in 2021 to $188.80 billion in 2022 at a compound annual growth rate (CAGR) of 15.3%., your work on this legislation will be a critical catalyst to empower connected innovation and wealth generation. As remote work, increased automation, and artificial intelligence fundamentally change how we manage employees, manufacture goods, and protect our supply chain, your work on this legislation will be vital to supporting next-generation innovation and our leadership in the world.
This is a necessary and extremely relevant topic in our hyper-connected world. The Privacy Rights Clearinghouse reports that there have been more than 900,000,000 records compromised in over 4,000 U.S. breaches since April 2005. Numerous high-profile data breaches have appeared in the news in the last year. FBI data shows that Pennsylvania led all other states in ransomware losses in 2020 — more than $5 million — spread among 116 victims. Does this mean that Pennsylvanians do not care about the safety of their data, not at all? It means that both the private sector and state government need to identify ways to collaborate more effectively to minimize the damage. The truth of the matter is that no organization will ever be entirely “secure,” but with a robust security risk assessment, a comprehensive risk action plan, and a thorough remediation strategy we can start to win back some ground.
As long as there is a black market for the sale of personal and financial data, and data breaches are attainable, cyber-attacks will continue. At the same time, we live in a society that demands mobility and connectivity. More Pennsylvania children are getting online at a younger age, and more and more of our household devices are connected to the internet. This ever-present connectivity makes sound information security principles a requirement. We, as citizens, businesses, and the state government, must continue to focus on the protection of our consumers and national security.
In a recent statement, the President insisted that the private sector needs to take immediate action to improve its defenses against likely cyberthreats. This is the most recent and urgent caution we have seen yet, following a string of regular notices to implement robust cybersecurity procedures since the fall of 2021. As a practitioner in the field of cyber security, I believe that the President’s statement is a warning that the US government may have specific intelligence requiring our complete attention and focus on reducing the threat of cyber intrusion.
Reclamere partners with several industry leaders to support our client’s information security needs. One of the leading international service providers recently shared that their 24/7 threat operations center “has seen no noticeable increase or sophistication in the volume of attacks while monitoring our customer base, we strongly recommend all our partners to treat this latest statement as a call to action to harden your infrastructure and verify that cyber hygiene best practices are being followed. As a start, review the controls and benchmarks provided by the Center for Internet Security (CIS).”
Recommendations to Improve Cybersecurity Resiliency
Whether an organization is a state government, healthcare, insurance, financial services provider, or an educational institution we strongly recommend the following actions be taken before the end of 2022.
- Identify a cybersecurity resource that has the demonstrated experience to develop, conduct, and report the findings of an enterprise-wide information security risk assessment. This will allow the organization to see a snapshot in time of the current risk profile and the areas for immediate, short-term, and long-term improvement.
- The risk assessment must deliver a risk action plan that will help the organization to risk rank and prioritize the steps necessary to improve the cyber resiliency of the organization. The plan needs to be practical, meaningful, and actionable.
- Develop a remediation strategy as a follow-on activity to the risk action plan. Decide on what resources will be necessary to achieve the strategy, whether those are internal or with a trusted third-party partner.
- Meet with your current or potential cyber insurance carrier to determine how best they can assist the organization with risk management.