As cyber threats grow more sophisticated and relentless, the Mississippi Office of Homeland Security, under the state's Department of Public Safety has a Cybersecurity Unit. Bob Freeman, the unit director, discusses what goes into ensuring the personal information of Mississippians, critical services, and the public trust remain secure from internet bad actors in an increasingly digital world with Morning Edition’s Desare Frazier.
Freeman We stood this unit up about four years ago, and the whole purpose of our unit is to provide cyber security support to local government and critical infrastructure, and then, of course, to our law enforcement partners.
Frazier Cybersecurity is so specialized and constantly evolving. How do you try and keep up with what's happening?
Freeman Well, we have a lot of good partners in the cyber security space, so we get a lot of information from the federal government, whether it's the FBI or CISA or organizations like that. We also have our own threat intelligence products that we use, and of course we try and focus on any threat actors that may be, you know, targeting Mississippi or our critical infrastructure or our school systems or anything like that, But it's really, it's a lot of legwork on our analysts to go out there and just keep track of what's going on as far as the open-source intelligence that's out there. And then it's just a constant learning process for education and just keeping up with tactics and techniques that the enemy is using.
Frazier How, is it possible to stay a step ahead because there have been some hacks, some organizations hacked in Mississippi, right?
Freeman Yes, there's been a handful of organizations in the news here in Mississippi unfortunately. It’s constant learning, an evolution in cyber security and just information technology, security in general. The cyber threat actors you know the bad guys, they only have to get it right once but as defenders we have to do it right all the time, because a simple mistake or a simple update that's overlooked or something like that could open up your entire network for the threat actors that are out there, for the bad guys.
Frazier Many Mississippians have information in some database in a state agency. How do you make sure that information isn't compromised?
Freeman At the end of the day, it's all a system of checks and balances. ITS with the state has a state enterprise security plan that all state agencies are required to meet the conditions of. ITS does a very good job of monitoring the state network. But then, you know, once you look outside the state network and you look at local government or K-12 school districts, you know they don't. They don't necessarily fall within that state umbrella. So that's where my team steps in to try and help support them because they might not have the resources to do some of this themselves and we're there to try to help bridge that gap.
Frazier How big is the staff that you have working on cyber security?
Freeman So right now, my team sits around five personnel. Of course, just like anything, we could always use more personnel. But that's always going to be the case with any of this sort of work. The threat is always evolving. And then, of course, we're competing for employees, just like the rest of the private sector is because right now there is a shortage overall across the country for cybersecurity professionals.
Frazier Is it really? So, if you want to go into cybersecurity, you're likely to be able to find employment now.
Freeman Yes, ma'am. Cyber security is an interesting field. It's not exactly an entry-level field, so it can be difficult for people who are just starting out to break into it. But anybody with a good IT background and a couple years of experience in the security side of IT can usually make that jump pretty easily.
Frazier We are a rural state with a large aging population. How can you help them with online issues, or can you?
Freeman Well, there's a handful of things that we can do. One of the things that my team does is we go out and we do outreach. We’ve went out to churches, different civic organizations to give internet safety briefings and then we'll take questions and try and help them through some of the problems that they're having.
We also go to schools. We've done some of these for parents. Then of course, the teachers as well, to make sure that they're up on the latest things that they need to be looking out for when it comes to cybersecurity.
Frazier In your work with schools, does knowing this help in terms of helping teachers and administrators understand what can happen?
Freeman When it comes to protecting your students online or protecting your children online it's no different than protecting them in real life. It's all about being an active parent and understanding what they're doing.
Frazier Do you have any role in detecting scams, or do they have to be reported by someone in order for you to move on it?
Freeman We take both an active and a passive approach. We can't know about every scam that's out there. We do rely on citizens to report that to us, just like the attorney general's office does with their cybercrime division. But if we hear from another neighboring state about a scam that is going on in their state, we'll publish something on social media, giving our constituents kind of a heads up that something might be headed towards Mississippi.
When it comes to these types of scams, they'll generally start in one part of the country and make their way across, because these threat actors are looking to collect information that they can sell or they're looking to con somebody out of their money. They're going to focus on one area and then go to the next one when that dries up.
Frazier Do you train parents?
Freeman We try to get in front of parents, grandparents, educators, anybody we can get in the front of to give them education when it comes to cyber awareness.
Frazier What is the biggest challenge in what you do?
Freeman Probably the biggest challenge is just the fact that it's an ever-changing landscape when it comes to cybersecurity and what threat actors are doing. Anytime we come up with a protection, the threat actors are working to figure out a way around it or they're figuring out a new vector to go after to make the money that they want to make.
Frazier How do you allay the fears of Mississippians who worry about their information getting out because they share it with state agencies or schools or what have you?
Freeman I think it comes down to just the outreach programs that we have and then also looking at some of the bills that have come through the legislature recently. Last session, the legislators passed Senate Bill 2654, which was to stand up a state-level security operations center, which would basically monitor all state agencies. We're looking at seeing how that can be potentially expanded to help everybody in the state, when it comes to local government or things like that. Right now, that bill only focuses on state agencies, but it's something we're always looking at to see how we can help protect more than just the state assets but also local assets.
Frazier Is there anything that I didn't ask you that's important to mention and people need to know?
Freeman With internet safety and cyber safety in general, it's active engagement. That's ultimately what people need to be aware of. The threat actors, the bad guys out there, they're going to try and make their schemes seem as real as possible. AI has made that a little bit easier for them, because now you have people who are not native English speakers who can craft perfectly worded English emails for their scams. It just goes back to being smart about how you respond to a scam when you see it.
There were the toll scams going on around last year.
Frazier What was that?
Freeman So, people were getting text messages stating that they had an unpaid toll. Well, Mississippi doesn't have any toll roads, so if you haven't traveled outside the state, you should automatically know that that's a scam. If you have traveled outside of the state, then you need to go back to the valid government website for that state's system that you were traveling through to verify that you have an unpaid toll.
Generally speaking, no government organization, no state organization is going to communicate through an unofficial channel. You know, you're going to get something in the mail, they're going tell you to go to an official website. They're not going to ask for payment through gift cards, cryptocurrency, or peer-to-peer payment apps like Zelle or Venmo.
Frazier I notice on emails, some of them, they use, it looks just like a business site. They copy it and it's very similar. How do people protect themselves from going on that site, thinking that it is the actual website for that particular company?
Freeman So one of the easiest ways to determine that is to look at the actual web address. If the web address doesn't match, like if you went out to Mississippi.gov, you know that you're on the Mississippi.gov website because the URL is going to be: http:// www.ms.gov. If it says something other than that, or if it says dot gov dash. Then that's not the valid Mississippi.gov website.
Also, threat actors will try and use what's called a shortened link where maybe it's just a button and you can't see the web address you're going to. It's best to hover over those, copy those links, paste them out in a text file or something else before you go to them so that you can confirm where they're actually taking you.
Frazier Do you do anything with texts on phones?
Freeman We will look into that, although that generally falls under the more traditional police work. But yes, ma'am, we can look into those types of attacks as well.
Frazier Okay. Well, do you feel like we've got a good picture of some tips that people can have and what you do in your role? Is there anything else?
Freeman I'm very thankful to the commissioner here and my boss at Homeland Security, the state legislature and governor for having the foresight to stand this unit up a few years ago when they did. I feel that through that and through things like the cybersecurity review board that the state has put in place, we're making good strides in cybersecurity to protect our citizens.