PRESQUE ISLE, Maine — With cybersecurity threats on the rise tribal governments around the country are now considering protections to further safeguard their data.
Mi’kmaq Tribal Council recently voted to pass a resolution to apply for a Tribal Cybersecurity Grant through the Federal Emergency Management Agency.
IT Director for Mi’kmaq Nation Fred Corey said the grant, if approved, would provide $94,000 over two years to the tribe. The money comes from $18.2 million of available funds for the 574 federally recognized tribes in the United States.
“A year ago FEMA rolled out some funding to the states, they block granted each of the states a million dollars and they gave them money on top of that,” to implement cybersecurity programs, Corey said.
Mi’kmaq Nation has different digital networks for wellness, housing, and domestic violence that are connected to its Tribal Administration Building. One proposal that Corey presented was to segment Mi’kmaq Nation facilities so traffic can’t jump between networks in the event of a cybersecurity breach.
Most of the ransomware actors and cybersecurity threats are coming from countries like Russia, China, North Korea, and Iran, Corey said.
The tribal cybersecurity grant could be received by Mi’kmaq Nation in February 2024.
The grant program sets up a tribal government structure called a cybersecurity planning commission within the Mi’kmaq Nation. The cybersecurity planning committee would report to the Mi’kmaq Nation tribal council and provide recommendations for a better cybersecurity plan.
Part of the program is to do table-top exercises with key tribal stakeholders in the event Mi’kmaq Nation is hit with a ransomware attack. A vulnerability and security assessment is one of the tools the cybersecurity grant program offers to see where there are weaknesses and develop ways to mitigate them.
“I know that in some facilities, or businesses, the IT sends out purpose emails to the staff to try to get them to open a link,” said Andrea Michaud, Mi’kmaq Tribal Council member.
Mi’kmaq Nation had a couple of close calls in the past when a computer virus infiltrated their system but turned out to be duds, Corey said. A dud is when a mistake was written in the code of a virus that renders it useless when executed on a computer network.
“Everybody in the [cybersecurity] industry says, ‘it’s not a matter of if you get hit, it’s a matter of when you get hit,’ we are all targets and it’s going to happen,” Corey said.
