19473_Authority_Oct-opt

6 dŚĞ ƵƚŚŽƌŝƚLJ │ October c ybersecurity b eyond the F ireWall : s ecuring gis, d ata , and c onnected s ystems By Simply Spatial, a Carroll Engineering Corporation Partner M unicipal authorities depend on digital systems to deliver essential services. Water and wastewater operations, financial systems, customer service platforms, asset management software, SCADA environments, cloud applications, and geographic information systems (GIS) all support daily operations. As these systems become more connected, cybersecurity is no longer only an IT responsibility. A disruption involving a mapping platform, shared database, work-order system, or vendor connection can affect staff productivity, emergency response, regulatory reporting, and service continuity. Meaningful improvements often begin with practical questions: What systems do we have? Where is critical information stored? Who can access it? How is it shared? What happens if a key system becomes unavailable? GIS: An Overlooked Security Risk GIS is often viewed primarily as a mapping tool. In practice, it may contain or connect to information about water mains, sewer lines, pump stations, treatment facilities, service connections, inspections, work orders, easements, and capital projects. A modern GIS environment may include internal and public-facing applications, mobile field tools, databases, dashboards, cloud services, and integrations with other systems. Employees, consultants, contractors, partner agencies, and vendors may all have different levels of access. GIS can therefore fall between traditional areas of responsibility. IT teams may secure servers and networks without fully understanding how spatial data, applications, and user roles interact, while GIS staff may focus on data quality and performance without overseeing broader cybersecurity policies. The result can be an operationally critical system that is not consistently included in access reviews, backup planning, or continuity exercises. Lessons From the Field Cybersecurity risks often arise in routine system management and information collection, access, and sharing. Three case studies from Simply Spatial, a spatial intelligence and technology consulting firm partnered with Carroll Engineering Corporation, show how practical improvements reduce vulnerabilities and strengthen resilience. 1. Strengthening Governance for a Water Authority A strategic technology planning engagement with a local water authority identified opportunities to strengthen technology governance and cybersecurity. Recommendations included IT assessments, improved patch and certificate management, role-based access controls and audit trails, system architecture reviews, and clearer governance for maintaining and sharing information. These measures address a common challenge: weaknesses often develop not through malicious activity, but when system ownership, access permissions, maintenance responsibilities, and data- management practices remain unclear. Strong governance reduces these risks while supporting reliable, efficient operations. 2. Assessing a Critical GIS Platform A large municipality relied on ArcGIS Enterprise for critical operations but needed a clearer view of the platform’s reliability and security. A Technology Assessment and Health Check examined architecture, infrastructure, network considerations, backups, recovery procedures, monitoring, and technology dependencies.