Navigating Your ARPA Tech Project Before the 12/31/24 Deadline

The American Rescue Plan Act (ARPA) provided $350 billion in funding for state and local governments to aid in their recovery from the COVID-19 pandemic. This includes funds allocated for rebuilding public sector capacity, which encompasses technology infrastructure.

Here’s what you need to know:

  • Deadline: Governments must obligate the funds by December 31, 2024 and spend them by December 31, 2026. Don’t miss out!
  • Eligible Uses: You can use ARPA funds to purchase technology to address negative economic impacts, including:
    • Rebuilding public sector capacity by rehiring staff or investing in data analysis and technology infrastructure.
    • Implementing economic relief programs through tools that manage applications and reports.
  • Multi-year contracts: ARPA funds allow for multi-year contracts, giving you peace of mind for your project’s future.

HCH Enterprises can help:

  • Navigate ARPA guidelines: We can help you understand the rules and ensure your technology project aligns with eligible uses.
  • Develop a strategic plan: We work with you to craft a plan that demonstrates how technology addresses your specific challenges.
  • Implement the solution: We offer expertise and resources to ensure successful implementation and continued support.

Additional Resources:

How other cities are using their ARPA spend on technology

The National League of Cities, National Association of Counties, and Brookings Institution’s Brookings Metro program have teamed up to create an interactive dashboard that tracks how 152 municipalities are using this relief money. The dashboard allows you to see how cities are investing in a variety of areas, including funding for improving broadband internet access, cybersecurity measures, and tools to help government employees work remotely.

Don’t let this valuable opportunity pass by! Contact HCH today to discuss how we can help your organization leverage ARPA funds for technology solutions.

Protecting your staff from getting “Hooked”

Small businesses face an ever-present threat: phishing attacks. These deceptive cyber schemes can wreak havoc, leading to data breaches, financial losses, and severe reputation damage. To safeguard your small business and ensure your team stays clear of phishing traps, it’s essential to implement robust security strategies and educate your staff about the dangers of these scams.

Unveiling the Phishing Menace

Phishing attacks involve cybercriminals sending convincing emails or messages that appear to be from trusted sources, often mimicking renowned companies, government entities, or colleagues. The sinister objective? To manipulate recipients into disclosing sensitive information, such as login credentials, credit card details, or personal data, or to dupe them into downloading malicious software.

Safeguarding Your Small Business

Employee Training: Your workforce is the first line of defense against phishing threats. Empower them with the knowledge to spot common phishing indicators, like unexpected emails requesting confidential data, misspelled website URLs, or generic greetings. Encourage a cautious approach and emphasize the importance of verifying unusual requests.

Implement Top-notch Security Software: Get strong antivirus and anti-malware software to protect your computers. Keep this software up to date to make sure it works properly.

Harness Email Filtering: Set up email filters to catch phishing emails before they reach your team. Filters can find and flag suspicious messages, making it harder for phishing attacks to succeed.

Activate Two-Factor Authentication (2FA): Activate Two-Factor Authentication (2FA) for important accounts. This means you’ll need to confirm your identity using a second method, like a text message or an authentication app. It adds a layer of protection.

Regular Updates: Make sure all your software, operating systems, and apps are always up-to-date. Cybercriminals often use weaknesses in outdated software to attack.

Create an Incident Response Plan: Create a plan for what to do if you suspect a phishing attack. The plan should include steps to stop the attack, tell the right people, and investigate what happened.

Embrace Encryption: Use encryption to keep your important information safe. Encrypting emails and files makes it very hard for cybercriminals to steal your data.

Check Your Vendors: If you rely on other companies for services or software, make sure they have strong security measures. A breach at one of your vendors could hurt your business too.

Stay Informed: Stay updated on the latest phishing tricks and trends. Cyber threats change, so it’s important to keep learning to stay safe.

Regular Testing: Regularly test your team with fake phishing emails to see if they can spot them. It helps find areas where more training is needed.

Conclusion

By prioritizing employee education, implementing robust security measures, and staying vigilant, your small business can protect its valuable data and reputation from cybercriminals aiming to get your staff “hooked” in their phishing schemes. Contact HCH Sales to access our support and expertise.

SecurityBeat: Software Security Needs Validating

By Donald Borsay, Director of Security Solutions, HCH Enterprises

Software Security: A Critical Concern for Businesses in 2024

In March, HCH strongly recommended that clients prioritize addressing the Top 8 Cybersecurity Challenges of 2024. Among these, Software Security emerged as a critical concern, particularly for businesses undergoing Digital Transformation.

The complexity of Software Security is intensified when dealing with Outdated Security Technologies and inadequate responses to Zero Day Events. A valuable approach to bolster Software Security confidence is through Web Application Penetration Testing (WAPT).

Our trusted partner, Cobalt, a ‘platform-as-a-service’ WAPT provider, has recently unveiled The State of Pentesting 2024. In response, HCH is issuing this advisory to provide actionable insights into Software Security, leveraging the insights from this newly released report.

Resource Allocation is a Key Concern

A significant overarching concern is resource allocation. Clients with established Software Security processes are striving to achieve more with limited resources. This often involves outsourcing, deferring remediation efforts, and compromising validation processes. Conversely, clients without existing Software Security measures face challenges in securing adequate resources for software development, let alone validation.

HCH acknowledges this dilemma and has chosen to collaborate with Cobalt due to their innovative delivery model, which optimizes Return on Investment (ROI) and cost savings for clients.

Instill a Software Security Mindset

Instilling a Software Security mindset within your organization can be transformational. Unlike functional requirements, Security is largely non-functional. While system design, infrastructure configuration, and software coding address functional needs, they might not inherently ensure security. At the very least, development teams should familiarize themselves with the OWASP Top Ten vulnerabilities. Cobalt’s assessments have revealed critical vulnerabilities like SQL Injection, Remote Code Execution, and the use of Default Credentials. To effectively address these threats, HCH suggests implementing a comprehensive checklist within your software release process.

Get the Most Out of Your Penetration Testing

To derive maximum value from your investment in penetration testing, it’s essential to empower your penetration tester. Collaborate with HCH to enhance your preparedness, or alternatively, utilize the Pentest Preparation Checklist outlined in the Cobalt report. Avoid potential hindrances during testing, such as:

  • Testers lacking necessary credentials or access prior to the test initiation.
  • Misalignment of the testing scope.
  • Insufficient ongoing collaboration throughout the testing process.
  • Inadequate brief or asset information.

Remediate and Retest Critical Findings

While Cobalt offers free retesting for resolved findings, less than 25% of identified issues undergo retesting. Although this might be reasonable for lower-severity findings, it’s concerning that 61% of critical vulnerabilities remain untested again, likely due to unresolved issues or a decision to forgo validating crucial fixes. HCH firmly advocates for the remediation and retesting of critical findings. Moderate findings should not be accepted without formal documentation of compensatory controls.

Conclusion

Trust in your Software Security demands verification. Make security a cornerstone of your software release strategy. Prioritize thorough testing of your software application and adequately prepare for the testing process to maximize its value. Lastly, prioritize the rectification and retesting of significant findings. HCH is dedicated to assisting you throughout this journey. Contact HCH Sales to access our support and expertise.

Building Inclusive Government Policies: A Roadmap to Equity

Leaders in Government and Critical Infrastructure

Today, we would like to explore how government leaders can champion diversity, equity, and inclusion (DEI) as foundational principles in their decision-making processes. By prioritizing these principles, leaders can create policies that better reflect the needs of all people and build trust among their constituents.

Diversity

Inclusion and representation from various backgrounds, including race, ethnicity, gender, age, abilities, etc.

Equity

Fairness, ensuring that everyone has equal access to opportunities and resources, regardless of their background.

Inclusion

Creating an environment where everyone feels valued, respected, and has a voice in decision-making processes.

Employee Resource Groups (ERGs)

ERGs stand as valuable assets in cultivating inclusive and equitable work environments and communities. They provide a platform for underrepresented employees to connect, gain insights, and advocate for their needs.

ERGs play a pivotal role in DEI initiatives:

Fostering Inclusion: ERGs promote belonging and authenticity among employees, increasing visibility for underrepresented groups and fostering acceptance.

Improving Diversity: ERGs actively participate in talent attraction, showcasing organizations as welcoming communities and communicating the needs of underrepresented groups to leadership.

Promoting External Impact: ERGs assist in recruiting diverse talent pools, diversifying the workforce, and participating in government-led talent attraction events.

Training

Training acts as a catalyst for creating inclusive and equitable environments, addressing individual and institutional aspects.

Key aspects of training in government:

Mitigating Implicit Biases: Training empowers employees to recognize and mitigate unconscious biases in decision-making.

Ongoing Education and Awareness: Training programs keep employees updated on DEI best practices and emerging issues, fostering a culture of continuous improvement.

Interpersonal Relationship Building: Training addresses attitudes, stereotypes, and microaggressions, promoting a respectful workplace.

Institutional Transformation: Training empowers core groups to champion equity initiatives and addresses institutional and structural racism.

Community Engagement

Building connections with diverse community organizations and stakeholders provides invaluable insights into the unique needs and concerns of various populations.

Community engagement is essential for:

Building Relationships and Understanding: Engaging with diverse stakeholders informs policies that truly serve and represent communities.

Enhancing Trust and Transparency: Active listening and collaboration foster trust between government and constituents.

Inclusive Decision-Making: Involving stakeholders in discussions ensures fair and equitable policies.

Effective Service Delivery: Understanding community needs allows for more efficient and equitable service allocation.

Conflict Resolution and Prevention: Open communication helps address issues proactively.

Promoting Civic Participation: Engaging the public encourages active participation in local governance.

State Government Examples

Rhode Island (RI) is known for its community-focused racial justice initiatives, including DEI task forces, diversity celebrations, outreach strategies, criminal justice reform, and leadership pipelines.

Community-focused racial justice initiatives include: 

Transparency

Transparency and Accountability

Transparency and accountability are vital in DEI efforts, driving trust, progress measurement, and positive examples.

Public Trust: Openly sharing DEI goals and progress builds trust with the public.

Stakeholder Engagement: Involving the public and organizations invites collaboration and feedback.

Positive Example: Prioritizing transparency sets an example for other organizations.

The journey towards inclusive government policies involves breaking down barriers, embracing diversity, and promoting fairness at all levels. By implementing ERGs, training, community engagement, and transparency, leaders in government and critical infrastructure can forge a more equitable future for all.

Contributors:

Kathryn Peterson, Technical Writer

Chelsea Levesque, Director, Marketing

References:

Gain a comprehensive grasp of effective grant writing and management, along with a deep appreciation for the pivotal role of broadband connectivity, through our enlightening webinar. Designed for professionals in both public and private sectors, this engaging session aims to enhance your knowledge and confidence in navigating the intricacies of grants while fostering the well-being of all communities.

Our interactive webinar delves into the fundamental elements of excelling in grant applications, navigating grant administration, and harnessing the transformative potential of broadband access for community advancement. Whether you’re a dedicated government official, a passionate nonprofit leader, or a knowledgeable private sector consultant, this informative webinar equips you with the essential insights to drive tangible impact within your community and professional sphere.

Webinar Highlights:
– Unveiling the Importance of Grants in Fostering Community Growth
– Exploring the multifaceted benefits of grant funding for nurturing vibrant community development projects
– Real-world case studies illuminating successful, grant-supported projects
– Crafting an Effective Grant Proposal: The Basics
– Navigating Optimal Grant Management Strategies
– Showcasing Achievements of Grant-Supported Broadband Initiatives
– Engaging Q&A Session to Address Your Inquiries

Don’t miss this invaluable opportunity to enhance your grant writing skills, gain insightful perspectives on streamlined grant management tactics, and recognize the life-changing potential of broadband connectivity for diverse communities. Secure your spot today and actively contribute to our mission of empowering communities and fostering sustainable progress.

Register now to embark on a journey towards understanding community empowerment and facilitating enduring growth!


Register Here

Spending ARPA funds. Does your city have a plan?

It’s been nearly two years since the passage of the American Rescue Plan Act (ARPA) — a $1.9 trillion economic stimulus bill including an allocation of $350 billion to help state, local, and tribal governments to address economic and health impacts of the COVID-19 pandemic. While ARPA’s State and Local Fiscal Recovery Fund (SLFRF) dollars offer flexibility, it is important for all municipalities to have a plan in place, and the time to act is now — as cities and towns must obligate their funding by December 31, 2024.

How can municipalities spend SLFRF funds?

Cities and towns have many options for using their ARPA dollars. According to the U.S. Department of the Treasury, there are four separate eligible use categories. Local governments may use SLFRF funds to:

  • Replace lost public sector revenue, using this funding to provide government services up to the amount of revenue lost due to the pandemic.
  • Respond to the far-reaching public health and negative economic impacts of the pandemic, by supporting the health of communities, and helping households, small businesses, impacted industries, nonprofits, and the public sector recover from economic impacts.
  • Provide premium pay for essential workers, offering additional support to those who have and will bear the greatest health risks because of their service in critical sectors.
  • Invest in water, sewer, and broadband infrastructure, making necessary investments to improve access to clean drinking water, to support vital wastewater and stormwater infrastructure, and to expand affordable access to broadband internet.

More on SLFRF Rules and Regulations

As a municipality, it’s important to understand how you can use ARPA funding — but that’s only part of the equation. The more challenging element is determining how you should apply these dollars. 

The goal for any municipality should be to capitalize on this tremendous opportunity for recovery in ways that meet the most prevalent needs of the community. The challenges many cities and towns face is — identifying those needs, and assessing the most effective pathways to meet those needs. Many communities are developing recovery and growth plans that involve:

  • Constituent Communications — engaging with the people in their communities to assess needs and priorities.
  • Data Analysis —  Collecting, organizing, and analyzing data points to gain insights to accelerate community recovery and equity.
  • Peer Evaluation — Reviewing what other similar communities have done and are doing with their ARPA funds, learning from their successes and challenges.
  • Compliance and Reporting — Ensuring projects meet the Treasury’s requirements for suitability and that quarterly reporting requirements are met and timely filed.
  • Project Management — Defining a plan and developing the roadmap to deliver the intended outcomes.

How are cities and towns using their ARPA money?

As it’s been nearly two years since ARPA’s passing, there is more and more data on how these funds — specifically those of the State and Local Fiscal Recovery Fund — are being allocated. The Council of State Governments published a database of all state-level allocations of SLFRF funding. Additionally, there is a Local Government ARPA Investment Tracker project developed through a partnership between the National League of Cities, Brookings Metro, and the National Association of Counties pulling in data from ARPA projects from cities and counties with populations of at least 250,000. 

According to data from the Local Government ARPA Investment Tracker, as of August 31, 2021, 150 local governments submitted 2,577 projects involving $18.5 billion in SLFRF funds. Specifically, these projects involve a number of spending categories:

  • Government Operations (37.6%)
  • Infrastructure (12.5%)
  • Housing (12.5%)
  • Community Aid (12.3%)
  • Public Health (12.2%)
  • Economic and Workforce Development (11.1%)
  • Public Safety (2.3%)

While information on how state governments and large cities are deploying their recovery funds is easily accessible, there is very little reporting on how small towns and medium-sized cities are making use of ARPA dollars. That’s why it may be beneficial for small-to-medium cities and towns to work with consultants and project managers to help ensure they are using these SLFRF funds in the most meaningful and efficient ways.

SecurityBeat: China 10x U.S. in Cyber Command Staffing

DOJ Prosecutes Individuals Scamming Federal Funding

Ten people have been charged by the U.S. Department of Justice (DOJ) for their alleged roles in business email compromise (BEC) scams. These scams were aimed at a wide range of victims, including federal funding programs like Medicare and Medicaid.

More than $11.1 million was lost as a result of these attacks, with the money stolen by fooling victims into diverting bank transfers to the scammers’ accounts.

Daixin Team Behind Ransomware Attack on AirAsia

A cybercrime group known as Daixin Team has leaked sample data belonging to AirAsia, a Malaysian low-cost airline, on its data leak portal.  The threat actors claim that they have access to the personal information of all of the company’s employees and five million passengers. The samples uploaded to the leak site include employee personal information, passenger information, and booking IDs.

The U.S. cybersecurity and intelligence agencies recently issued an advisory about Daixin Team, warning of attacks primarily targeted at the healthcare industry.

Increasing Cyber Risk in the Transportation Industry

Ransomware activity continues to increase globally despite efforts by businesses to boost their cybersecurity. While some industries have doubled or tripled their protection, others are still vulnerable and are finding themselves being targeted by cybercriminals.

According to The Threat Report: Fall 2022 from Trellix, the third quarter of 2022 saw ransomware activity double in the transportation and shipping industry. The report includes evidence of malicious activity linked to ransomware and nation-state-backed advanced persistent threat (APT) actors. It examines malicious cyber activity including threats to email.

China 10x U.S. in Cyber Command Staffing

China’s focus on enhancing its cyber capabilities over the past decade “poses a formidable threat to the United States in cyberspace today,” according to a report released by a congressional advisory commission.  The U.S.-China Economic and Security Review Commission’s 2022 Annual Report to Congress assessed a range of threats to the U.S. economy and national security, including Beijing’s cyber warfare and espionage capabilities.

Rackspace’s Hosted Exchange Environment Held Ransom

Four days passed from the time Rackspace disclosed that its customers were experiencing difficulties with the company’s hosted exchange environments until advising that the incident was in fact a ransomware attack. The impairment was promoted to a security incident on day 2 with in-place recovery being so difficult that the company reluctantly notified customers that their email services were migrating to Microsoft 365 on day 4.

Who is Monitoring Your DNS Communications?

For nearly forty years, we stopped manually sharing host information and began relying on the Domain Name Service (DNS) to get the address of the system we need to communicate with.  DNS is one of the few protocols we allow to communicate freely without restriction. Why would we need to protect our systems query of the network’s address book?

In a recent report published by Pentera, we find that attackers can use DNS tunneling to communicate with air-gapped networks. Organizations often use air-gapped networks to isolate their sensitive assets.

The takeaway is twofold.

  • First, completely air-gap your sensitive assets by disabling DNS and using hostname tables.
  • Second, consider using special monitoring solutions to inspect and prevent suspicious DNS traffic from traversing your network.