🔒House takes initial steps to mitigate CT’s cybersecurity risks

Here is a look back at the five business, nonprofit and higher education leaders we watched in 2017.

Hackers have booked some major successes this year, and no one expects the trend to subside anytime soon.

In March, WikiLeaks released a trove of cyber-tools used by the CIA to spy on cell phones and other devices, raising concerns that foreign actors could use the tools against the United States.

“That is truly frightening,” said Arthur “Art” House, the state's first cybersecurity risk officer, during a recent interview recapping his first full year on the job.

The scary headlines didn't end there. A hack of credit-scoring monitor Equifax, revealed in September, jeopardized sensitive personal information of 143 million people.

There is also the ongoing inquiry into alleged U.S. election hacking by Russian actors, which have been accused of targeting online voter registration systems in multiple states, including Connecticut.

And there was Symantec's announcement that hackers gained access to the computer networks of dozens of energy companies in the U.S. and Europe, which, in some cases, could have allowed the cyber thieves to cut off power to consumers and businesses.

“The extent and the severity of cybersecurity threats have both grown very significantly,” said House, who most recently spent four years as the Public Utilities Regulatory Authority commissioner. “At the same time, Connecticut has made significant progress in cybersecurity defense.”

That progress includes the state completing its first annual review of utility companies' cybersecurity defenses. Four utilities — Eversource, Avangrid, Connecticut Water and Aquarion — participated in the voluntary and confidential review, which concluded in October that the companies' defenses were “adequate.” The second review is slated to take place in 2018, and House is urging wireless and telecom providers to participate. Thus far, they have refused, as some fear it may lead to new mandatory state oversight.

In July, the state also issued a 35-page House-led strategy that outlined cybersecurity approaches and challenges for five key sectors — state government, municipalities, businesses, universities and public-safety agencies.

House, who said Connecticut is becoming a leading state on cybersecurity matters, called the strategy document “an initial step on a road we must travel.”

He presented the plan to officials in Estonia — one of four Black Sea nations House and officials from several other states are working with on cybersecurity — and got a good review.

That was meaningful because Estonia has beefed up its defenses over the past decade after suffering a series of cyberattacks.

“The Estonians thought [our plan] was like theirs,” House said. “I was very pleased. Very encouraged.”

The strategy, which is to be followed up by a more specific action plan, predicts that hackers might attack the power grid to amplify the effects of a hurricane or extreme weather event, and that such an attack could be accompanied by a disinformation campaign on social media and elsewhere. It also notes that governments and companies alike face a persistent shortage of cybersecurity talent.

“I think we did the things we promised to do [this year],” House said. “We still have so much more to do.”

Read all Five We Watched profiles.