Securing the State

Early tech adoption set Tennessee up for digital success, and modernization is moving them forward

The largest company in the Volunteer State employs 45,000 persons, operates 1,900 brick-and mortar sites, a host of remote workers, and the state’s biggest telephone company. And when it comes to technological progress, they stand head and shoulders over a host of similar organizations. They are the State of Tennessee.

Curtis Clan

In our digital age, keeping 7.1 million citizens connected to government services requires unparalleled dedication to vigilance, resilience, and forward thinking. As the state’s Chief Information Security Officer, Curtis Clan and his 31-person teams are at the tip of the technological spear. The CISO’s office is part of Strategic Technology Solutions (STS), the central IT organization for the state. Clan is the single point of contact for the state on the local and federal level.

STS covers a number of program areas, including privacy, disaster recovery, compliance, incident response, and vulnerability management. An audit and policy team assists with policy and contract negotiations, endorsements, and related issues. “The ultimate goal is to provide a great experience for citizens,” Clan said. For several years, the MyTN app has made the lives of Tennesseans more convenient, with online access to permit renewals and other digitally enabled services. “I think it’s important to mobile-enable all of our systems.”

Chaired by the Commissioner of the Tennessee Department of Finance & Administration, the ISC is charged with overseeing information technology for the entire State of Tennessee and for developing policies for managing the state’s information technology overall. The ISC meets at least quarterly to review policies, provide input on the state’s IT direction, and review major IT project statuses.

“The council includes legislators and others that have the oversight to make sure that the agencies are being diligent with not just the money, but also with timelines and things of that nature,” he said.

The CIO office is staff to the Information Systems Council. STS requires all agencies to submit a three-year Information System Plan (ISP). That plan is reviewed and approved/denied by a governing body called the Solutions Review Board (SRB). Those plans are the road maps for modernization efforts and other future IT initiatives. STS’s project management and program management teams make sure that the plans are followed

The team is currently involved in a major push to help local government entities obtain grant money for cybersecurity. To be eligible for cybersecurity grants from FEMA, state offices must complete the Nationwide Cybersecurity Review (NCSR) self-assessment survey, which gauges their security maturity model.

“Some of entities might not have a savvy staff from an IT perspective, so we took the survey offline and went word for word, line for line through that and baselined what each question meant. We’ve reached out to about 1,300 local entities already,” he said, emphasizing that the department assists smaller offices to complete the surveys. In addition to applying for local funds, NCSRs also enable participants to apply for federal grant monies. The big assist is paying off. In 2023, Clan’s team received 22 completed NCSRs. So far in 2024 they’ve received 361, a 1,540% increase in responses.

Annual cybersecurity awareness training is mandatory for all employees of the government’s 54 agencies, commissions, and boards. The CISO’s office builds those networks and relationships with the business and agency commissioners. “The commissioners work directly for the governor and actually provide all the services to the citizens, but they rely on us for their IT support and on my team for cybersecurity,” he said. “We frequently work with them, partner with the Comptroller’s Office on audits and things of that nature to make sure that we’re not just assessing ourselves, but we’re having third-party assessments that include state audit and other third-party security consulting firms.”

At present, the government is implementing Crowdstrike’s Falcon Complete managed endpoint detection and response tool. “We actually piloted it and felt it was superior to what we had previously,” Clan noted. “We’ve been working with them for quite some time now and we deployed over 30,000 clients to help protect those endpoints.” As the state’s remote workforce continues to expand, covering its growing attack surface is essential. “We must have the ability to protect devices while they’re on or off the state network, and Crowdstrike gives us that visibility.”

The state is charged with keep a tremendous amount of sensitive data secure, such as personally identifiable information, personally  health information, a plethora of federal information running the gamut from social security numbers, driver’s licenses, and much more.

“We need to protect those servers and endpoints to ensure that there are no compromises there and if there’s any type of anomaly, it’s detected and we immediately kick in our incident response team and mitigate any risks,” he said. “Crowdstrike will take action for us and then reach out to us so that we’re not the only ones seeking a solution. We have a partner that’s looking at it with us.”
While many organizations were forced to pivot and rethink remote work during the pandemic, Tennessee was ready, as they already had successful hybrid and remote work opportunities in place.

“When Covid hit and everybody had to be working remotely, we did have to increase in our capacity such as VPNs,” Clan said. “Overall, it was not a big problem. We were very fortunate that we had already gone down that path of allowing remote work.”

Leveraging technology through consolidation

The state’s consolidation efforts to secure the state government as a whole have been extremely successful. Multiple networks require multiple security platforms, which adds complexity and heightens the risk of vulnerabilities ripe for exploitation. Over the decades, Clan’s team has shifted their networks, moving to a private network, consolidating workstation support, and consolidating server support. “Then we just took over the IT for the majority of the executive branch agencies and developed the applications to support them after the fact,” he explained. “It was a huge effort that’s really allowed us to be a more efficient government and stewards of citizens’ monies because we’re not investing in 12 different flavors of something. We’re investing in the best of breed of technology such as Crowdstrike.”

To eliminate a siloed data environment, IT created management structures that have domain directors in agencies with similar business needs, such as children’s services and human services, law, and corrections. Those domains differ from one another but report back up to one person within the division, which ensures that all requirements are met and data-sharing agreements are in place. “There’s really not any of that, ‘Hey, you can’t touch my stuff’ mentality and it’s a better process because people are willing to work with you because you’re there with them every day helping them perform their duties,” Clan confirmed.

Clan offered some sage advice for other CISOs who may be modernizing their agencies. “Stay resilient. Always have your eyes open and always be looking for the ‘gotcha.’ There are way too many of those.” In such a rapidly evolving security environment, tunnel vision is enemy No. 1. “Look around you and make sure that you’re considering anything that might be changing, such as AI, for example.

“AI is going to change the way folks work, and we need to make sure that we’re handling that in a secure manner and not breaking any privacy laws or anything of that nature. Do your due diligence and keep your eyes open for changes in technologies,” he concluded. “At the state, we’re not always bleeding edge, but we are definitely quick followers, and we learn lessons from the private sector quite frequently. When we see the mistakes they make, we make sure we don’t make them ourselves.”