Governor Kathy Hochul's unveiling of the New York State Cybersecurity Grant Plan, geared to strengthen the state's cyber defenses, has stirred hope and skepticism. With nearly $6 million allocated through the federal State and Local Cybersecurity Grant Program, the plan aims to fortify local governments against escalating cyber threats. However, as cyber-attacks on critical infrastructure surge, questions about the plan's adequacy and overall effectiveness are emerging.
Governor Hochul, stressing the critical need for robust cybersecurity, stated, "A cyberattack can halt an entire community, and it's essential that local governments have the resources and information needed to protect themselves and quickly respond to a cyber threat." Despite these intentions, uncertainties linger about whether the allocated funds can genuinely combat the evolving nature of cyber threats.
As part of the federal Infrastructure Investment and Jobs Act of 2021, the Cybersecurity Grant Plan designates $5,810,605 for New York through the State and Local Cybersecurity Grant Program. While 80 percent of this funding targets goods and services for local government entities, emphasizing rural areas, concerns arise that the plan may need to address local governments' diverse and complex cybersecurity needs comprehensively.
Recent data reveals a concerning trend – the number of attacks targeting critical infrastructure in New York nearly doubled, reaching 83 in the first half of 2023 compared to 48 for the entirety of the previous year. A report from State Comptroller Thomas P. DiNapoli underscores the severity of the growing threat, raising significant questions about the Cybersecurity Grant Plan's efficacy in the face of such a dynamic landscape.
To maximize the impact of limited funds, New York intends to procure software, hardware, and services for eligible entities directly. The first year of the program emphasizes shared services initiatives, including Multi-Factor Authentication (MFA), Cybersecurity Certification Scholarships, and Cybersecurity Awareness Training. While these initiatives are commendable, questions arise about whether a more comprehensive approach may be necessary, given the multifaceted and evolving cyber threat landscape.
The revelation of estimated losses in New York from cyber attacks in 2022, surpassing $775 million, and nationwide losses soaring to $10.3 billion in the same year, a figure seven times greater than in 2016, adds weight to concerns about the plan's overall impact.
While Governor Hochul has initiated programs such as the Shared Services Program and expanded law enforcement cyber capabilities, some experts and observers question whether these measures alone safeguard New York's critical infrastructure. The surge in cyber attacks and the substantial financial losses underscore the urgency of a robust and anticipatory cybersecurity strategy.
As the Cybersecurity Grant Plan begins its implementation, the debate over its effectiveness intensifies. Some question whether it genuinely positions New York at the forefront of cybersecurity policy or needs to address the state's evolving cyber threats adequately. The coming months will likely provide crucial insights into the plan's actual impact and ability to weather the state's increasing cyber threats.