State begins $30 million shared-services program for local-government cybersecurity

ALBANY, N.Y. — The cities of Syracuse, Rochester, Albany, Buffalo, and Yonkers are among those that will benefit from a new shared-services program to help municipalities with cybersecurity for government systems.

New York State has started the $30 million program that includes tools to protect against ransomware attacks, the office of Gov. Kathy Hochul announced.

The announcement complements the work of the state’s recently announced Joint Security Operations Center (JSOC) in Brooklyn, which Hochul’s office describes as the “nation’s first-of-its-kind,” cyber-command center that houses cybersecurity assets from multiple levels of government partners under one roof.  

As part of the shared-services program, New York’s counties and the state’s initial JSOC partners — the cities of Syracuse, Albany, Buffalo, Rochester, and Yonkers — will be offered CrowdStrike endpoint detection and response (EDR) services at no cost to them.

EDR is a technology used to protect endpoints — often computers or servers — by monitoring and reacting to cyber threats in real-time. These services can protect entire networks by detecting and isolating a compromised endpoint and will enable New York State cybersecurity teams to “effectively track sophisticated attacks and promptly uncover incidents, as well as triage, validate and prioritize them, leading to faster and more precise remediation,” per Hochul’s office.

The JSOC is taking a centralized approach to managing cyber-security risk, as the interconnected nature of the state’s networks and information-technology programs can lead to an attack spreading quickly across the state.

By opting-in for these services, counties will contribute to enhancing security of government assets throughout New York state. These services will be provided to counties, and the cities mentioned above, at no cost to them, via the state’s consolidated licensing and economies of scale.

Many local governments currently do not have resources necessary to protect their systems from cyberattacks and ransomware, including systems which provide critical services such as health care, emergency management, utility services, as well as law enforcement, Hochul’s office said.