Many cities are on the front line in a national and global battle against cybercrime and malicious cyber actors. By adopting a few critical cybersecurity behaviors, and encouraging these behaviors with their citizenry, cities can work to safeguard information, protect services, and help residents improve their cyber hygiene whether engaging with the city online or anywhere else on the internet.   

Why citywide security matters

Verizon’s 2023 Data Breach Investigation Report found that the public administration sector, which includes city governments, experienced over 3,200 cyber incidents that year and almost 600 attacks resulted in the loss of data. Threats to this sector come from both external and internal actors. While most (68%) of the 2023 attacks were financially motivated, the public sector also sees attacks motivated for espionage and ideological reasons. Strong cybersecurity is essential both for city governments and the people who live there for many reasons: 

• Cities services require the maintaining and storing the sensitive data of citizens, employees, and partners. 

• City IT systems require an investment of computing resources to maintain them and keep them up to date in a battle against known vulnerabilities. 

• Solid cybersecurity behaviors help protect the critical infrastructure of cities. 

• Cyberattacks on cities can result in costly, aggravating, and sometimes dangerous, service disruptions. 

4 behaviors of cybersecure cities 

Use strong, unique passwords 

Passwords are the first line of defense against bad actors. You want every password to be strong and unique. This means your password should be at least 15 characters long and a mix of letters, numbers, and symbols. The most secure passwords aren't recognizable words, but a seemingly random string of characters. And every account should be protected by its own special password. How are you supposed to manage all these passwords? Use a password manager – there are many safe options that will help you generate, store, and maintain your collection of excellent passwords.   

Enable multi-factor authentication 

Multi-factor authentication (MFA) adds a layer of security that goes even beyond a strong password! MFA requires an extra step of verification when someone is trying to log on, such as a facial scan, responding to a text message, or approving the login through an app. Turn on MFA for all accounts that allow it, and you are protected by more than a password. And if a website or vendor doesn't have MFA options, you should find a competitor that does.  

Avoid the phishing bait 

Most cyberattacks start as little messages that contain malicious attachments or links – phishing. Phishing can happen via email, text messages, or most other forms of online communication. You've probably encountered many suspicious emails during your internet adventures, but cybercriminals are getting more sophisticated with the widespread use of artificial intelligence and large language models like ChatGPT. Before clicking on links or downloading attachments, take a few seconds (even four seconds is good) to verify the message. Is the message trying to inspire panic or urgency, like alerting you that you've won money or that the police will come after you if you don’t respond? While deleting suspicious messages is the way to go, you should report the message to your email service beforehand. Not only does reporting help stop cybercriminals, but it also helps with detecting phishing messages before they hit your inbox.  

Keep your software and devices updated 

Your city deserves the latest and greatest security features! Device and software creators regularly update their software to safeguard against evolving cyberthreats and patch any flaws. Regularly check for updates – we recommend turning on automatic updates so you get the newest security protections delivered straight to your device. Don't click "Remind Me Later!” The peace of mind is worth the few minutes of disruption.   

Your city isn't alone 

It is always a great time to remind citizens, employees, local businesses, and supply chain partners that we all have a role to play in improving cybersecurity. Protecting your digital realm can seem intimidating at first. Fortunately, there are resources available, like the Multi-State Information Sharing and Analysis Center and the CISA regional offices, where information sharing and resources like cybersecurity performance goals can all be tools in understanding and improving a city’s cybersecurity. Adopt these behaviors into daily city operations to secure your digital cityscape.