Building Resilience in Public Sector Cybersecurity

Michael Dent, Chief Information Security Officer, Fairfax County Government

Michael Dent, Chief Information Security Officer, Fairfax County Government

Michael T. Dent, Chief Information Security Officer for Fairfax County Government, is a cybersecurity leader with over 30 years of IT and security expertise. He directs comprehensive security programs, safeguarding data for 1.3 million residents while advancing secure adoption of emerging technologies and fostering national and regional cybersecurity collaboration.

As a former Army Telecommunications Supervisor, Mike handled classified communications, operated in tactical environments, and served as a presidential escort and Honor Guard member. His leadership, precision, and risk management skills guide Fairfax County’s cybersecurity operations. Drawing on military experience, he ensures secure communications, conveys security concepts effectively, and applies strategic risk methodologies. Committed to continuous education, he strengthens cybersecurity resilience with military-honed adaptability. Transitioning to civilian roles, Michael joined the state of Virginia’s Department of Corrections as Chief Security Officer before taking on his current role in 2002.

“Building a defense-in-depth strategy and prevention-focused measures are essential. Smaller jurisdictions often lack the resources to implement these strategies. Federal agencies like CISA, MS-ISAC, and the National Guard can play a crucial role in bridging this gap by providing support and resources.”

Michael has chaired the National Capital Region Emergency Support Function committee for over 15 years, bringing together 21 jurisdictions’ CISOs to discuss issues, share insights, and enhance a public-private safety network connected through private fiber. Beyond this secondary role, Mike actively contributes to various committees and advisory boards. He serves as Co-Chair of the Commonwealth of Virginia Cyber Planning Committee and the state's ELECT Cyber Security Policy Committee. As a long-standing member of the National Association of Counties (NACo), he participates in the CIO Committee, Cyber Technology Advisory Committee, and the Standing IT Committee. Additionally, he advises the Northern Virginia Fusion Center, contributes to the Northern Virginia Regional Commission as a local government cyber expert, and serves on the Government Business Executive Forum’s Executive Committee, where he chairs state and local initiatives. His focus lies in advancing cybersecurity policies, optimizing resources, and bolstering public safety networks.

Current Challenges in the Government Sector

In Fairfax County, we are fortunate to have leadership and elected officials who understand the importance of cybersecurity and adequately fund our programs. However, challenges persist, particularly with the increasing threats in the cybersecurity space. The misuse of AI, whether for good or malicious purposes, is a growing concern. We’ve implemented internal AI capabilities and educated employees about these risks, but maintaining basic cyber hygiene remains a critical issue.

Nationally, there’s a significant lack of leadership accountability for cybersecurity. Many leaders exempt themselves or favored employees from essential training, resulting in vulnerabilities. Basic patch management and cyber hygiene are often neglected due to operational constraints or fear of public backlash from system downtime. Legacy systems are another significant challenge, as they’re costly to replace but leave organizations vulnerable to breaches. It’s frustrating to see breaches occur due to these avoidable issues, followed by costly recovery efforts rather than proactive prevention.

To address this, I’ve been a strong advocate for official risk notification programs. Leadership must acknowledge and own the risks they accept. This shifts accountability and encourages informed decision-making about resource allocation. Without such programs, leaders often evade responsibility, perpetuating the cycle of vulnerabilities.

Trends and Technologies to Address Challenges

In my role, I’m focused on supporting smaller jurisdictions that lack the resources or voice to address their cybersecurity needs effectively. These entities often struggle to implement basic cybersecurity measures due to limited budgets and organizational hierarchies that stifle their efforts. I’ve made it a priority to call out vulnerabilities and advocate for these jurisdictions.

Fairfax County continues to collaborate with third-party vendors, ensuring they adhere to our cybersecurity standards. We expect our partners to provide risk assessments, incident response capabilities, and attestations of their risk management programs. Emerging technologies, such as AI and machine learning, are being used to streamline tasks like policy writing and strategy creation. We also share insights and best practices with other large counties and cities through our committee, fostering a culture of collaboration and mutual support.

Staffing remains a challenge, as government salaries often cannot compete with the private sector. Despite this, many dedicated individuals choose public service out of a sense of civic duty. Their commitment is what drives progress, even under challenging circumstances.

Envisioning the Future of Cybersecurity

Recent revelations, such as those from the FBI director about foreign adversaries infiltrating critical infrastructure, highlight the urgent need for proactive defense. Governments at all levels must scrutinize their networks, identify anomalies, and address vulnerabilities before they’re exploited. Unfortunately, many local governments adopt a reactive approach, waiting for breaches to occur before responding. This mindset must change.

Building a defense-in-depth strategy and prevention-focused measures are essential. However, smaller jurisdictions often lack the resources to implement these strategies. Federal agencies like CISA, MS-ISAC, and the National Guard can play a crucial role in bridging this gap by providing support and resources. Funding remains a significant barrier, as cybersecurity budgets often fail to account for the costs of securing online services. While federal funds have been allocated, they’re insufficient to meet the needs of state and local governments.

Cybersecurity is consistently ranked as the top priority among local, state, and federal leaders in every major poll, yet tangible support for local government cybersecurity efforts remains insufficient. It is imperative that the federal government moves beyond rhetoric and takes decisive action to strengthen local defenses. Citizens depend on local governments for critical services, making their cybersecurity a national concern. Greater collaboration, sustained funding, and proactive strategies are essential to closing the gap between stated priorities and real-world protections.

Advice for Aspiring CISOs and Colleagues

For current and aspiring CISOs, it’s crucial to focus on employee education and awareness. Implementing an official risk notification process can hold leadership accountable and ensure informed decision-making. Effective communication with executives is key—prioritize risks and present clear strategies when requesting funding.

Basic cyber hygiene, including security awareness training and phishing simulations, is fundamental. Documenting risks and mitigation efforts not only protects cybersecurity teams but also places responsibility on leadership. By building a culture of accountability and proactive planning, organizations can better navigate the evolving cybersecurity space.

Cybersecurity in government requires dedicated individuals, proactive leadership, and robust collaboration. While challenges persist, a commitment to education, accountability, and continuous improvement will pave the way for a more secure future. I’m always open to sharing insights and supporting others in their journey to strengthen cybersecurity efforts.