EYALET VE YEREL DÜZEYDE SİBER GÜVENLİK YÖNETİMİ: MARYLAND ÖRNEĞİ

Öz

Siber güvenlik, en önemli politika ve yönetim konularından biridir. Amerika Birleşik Devletleri (ABD) federal hükûmeti siber güvenlik sorunlarına büyük ölçekli çözümler bulmaya odaklanırken eyalet ve yerel yönetimler tüm çözümlerin federal hükûmetten gelmesini beklememelidir. Bu nedenle eyaletler, siber saldırıları en aza indirmek ve güvenli bir siber alan yaratmak için önlemler almalıdır. Ancak eyalet yönetimleri; yeterli fon eksikliği, siber güvenlik uzmanlarının yetersizliği, belgelenmiş süreçlerin eksikliği ve tehditlerin giderek karmaşıklaşması gibi zorluklarla karşı karşıyadır. Bu çalışma, ABD eyalet ve yerel yönetimlerinde siber güvenlik sorunlarının ele alınmasının önündeki engelleri incelemekte ve bu yönetimlerin siber güvenliği en etkili şekilde artırmak için benimsemeleri gereken strateji türlerini tartışmaktadır. Maryland eyalet ve yerel yönetim yetkilileriyle yapılan ikinci el görüşme verilerini analiz eden çalışma, siber güvenlik sorunlarının ele alınmasında en önemli adımlar olarak (1) daha geniş güvenlik topluluğu ile ortaklıklar kurmak ve güvenlik ihtiyaçlarını dış kaynaklara yaptırmak, (2) bir siber güvenlik stratejik planı oluşturmak ve (3) daha fazla kanun uygulaması sağlamak olduğunu belirlemektedir. Önemli bir nokta olarak, nispeten iyi kaynaklara sahip bir eyalet olan Maryland bile bu engellerle mücadele etmektedir, bu da daha az kaynağa sahip eyaletlerin muhtemelen daha büyük güvenlik açıklarıyla karşı karşıya olduğu anlamına gelmektedir.

Anahtar Kelimeler

• Siber Güvenlik
• Eyalet ve Yerel Yönetimler
• Kamu Yönetimi
• Siber Güvenlik Kapasitesi
• Kamu Sektörü Yönetişimi
• Maryland

CYBERSECURITY GOVERNANCE AT THE STATE AND LOCAL LEVEL: THE CASE OF MARYLAND

Öz

Cybersecurity constitutes one of the most important policy and management concerns. While the United States (U.S.) federal government focuses on large-scale solutions to cybersecurity challenges, state and local governments should not expect the federal government to provide all responses. For this reason, states must take precautions to minimize cyberattacks and create a secure cyberspace. However, state governments face challenges such as a lack of sufficient funding, inadequate availability of cybersecurity professionals, a lack of documented processes, and the increasing sophistication of threats. This study examines barriers to addressing cybersecurity challenges in the U.S. state and local governments and discusses the types of strategies these governments should adopt to be most effective in enhancing cybersecurity. By analyzing second-hand interview data with Maryland state and local government officials, the study identifies (1) building partnerships with the larger security community and outsourcing security needs, (2) creating a cybersecurity strategic plan, and (3) enabling more law enforcement as the most crucial steps in addressing cybersecurity challenges. Critically, even Maryland, a relatively well-resourced state, struggles with these barriers, meaning that less-resourced states likely face even greater vulnerabilities.

Anahtar Kelimeler

• Maryland
• Public Administration
• Cybersecurity
• State and Local Governments
• Cybersecurity Capacity
• Public Sector Governance

Kaynakça

1. Abelson, R., & Goldstein, M. (2015). Millions of Anthem Customers Targeted in Cyberattack. The New York Times. https://www.nytimes.com/2015/02/05/business/hackers-breached-data-of-millions-insurer-says.html
2. Babcock, S. (2019). Gov. Hogan creates CISO position for State of Maryland. Technical.Ly. https://technical.ly/civic-news/gov-hogan-creates-chief-information-security-officer-john-evans-position-for-state-of-maryland/
3. Bailey, E. (2024, July 19). Dallas Ransomware Attack Exposed Info for 200,000 People. GovTech. https://www.govtech.com/security/dallas-ransomware-attack-exposed-info-for-200-000-people
4. Baker, A. (2018). An ‘Iceberg’ of Unseen Crimes: Many Cyber Offenses Go Unreported. The New York Times. https://www.nytimes.com/2018/02/05/nyregion/cyber-crimes-unreported.html
5. BBC News. (2023). European Commission bans TikTok on staff devices. BBC News. https://www.bbc.com/news/technology-64743991
6. Beaver, K. (2013). The 5 Common Network Security Vulnerabilities that Are Often Overlooked. https://www.acunetix.com/blog/articles/the-top-5-network-security-vulnerabilities/
7. Benedikt, M. (Ed.). (1994). Cyberspace: First steps (7th print). MIT Press.
8. Brasso, B. (2016). How State and Local Governments Can Solve Their Cyber Security Staffing Shortage. FireEye. https://www.fireeye.com/blog/executive-perspective/2016/02/how_state_and_local.html

9. Brown, R. (2012). More Details of South Carolina Hacking Episode. The New York Times. https://www.nytimes.com/2012/11/21/us/more-details-of-south-carolina-hacking-episode.html
10. Center for Digital Government. (2014). The Future of IT in State and Local Government [White Paper]. http://www.vion.com/documentlibrary/downloadDocument.aspx?id=70
11. Chun, S. A., Shulman, S., Sandoval, R., & Hovy, E. (2010). Government 2.0: Making Connections Between Citizens, Data and Government. Information Polity. 15(1,2), 1–9.
12. Deloitte. (2014). 2014 Deloitte-NASCIO Cybersecurity Study—State governments at risk: Time to move forward.
13. Deloitte. (2016). 2016 Deloitte-NASCIO Cybersecurity Study.
14. Deloitte. (2018). 2018 Deloitte-NASCIO Cybersecurity Study—States at risk: Bold plays for change.
15. Deloitte. (2020). 2020 Deloitte-NASCIO Cybersecurity Study—States at risk: The cybersecurity imperative in uncertain times.
16. Deloitte. (2022). 2022 Deloitte-NASCIO Cybersecurity Study—State cybersecurity in a heightened risk environment.
17. Deloitte. (2022). 2024 Deloitte-NASCIO Cybersecurity Study.
18. Englund, W., & Nakashima, E. (2021). Panic buying strikes southeastern United States as shuttered pipeline resumes operations. The Washington Post. https://www.washingtonpost.com/business/2021/05/12/gasshortage-colonial-pipeline-live-updates
19. Exec. Order No. 13,636, (2014). https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity
20. Exec. Order No. 14,028, (2021). https://www.govinfo.gov/content/pkg/DCPD-202100401/pdf/DCPD-202100401.pdf
21. Exec. Order No. 14,144, (2025). https://www.govinfo.gov/content/pkg/FR-2025-01-17/pdf/2025-01470.pdf Federal Bureau of Investigation. (2024). FBI Internet Crime Report 2024.
22. Federal Motor Carrier Safety Administration (FMCSA), 2021a. Regional emergency declaration no. 2021-002, May 9, 2021. https://www.fmcsa. dot.gov/emergency/esc-ssc-wsc-regional-emergency-declaration-2021-002- 05-09-2021.
23. Federal Motor Carrier Safety Administration (FMCSA), 2021b. Amended regional emergency declaration no. 2021-002, May 11, 2021. https: //www.fmcsa.dot.gov/emergency/amended-regional-emergency-declarationunder-49-cfr-ss-39023-no-2021-002.
24. Gandhi, R., Sharma, A., Mahoney, W., Sousan, W., Zhu, Q., & Laplante, P. (2011). Dimensions of Cyber-Attacks: Cultural, Social, Economic, and Political. IEEE Technology and Society Magazine, 30(1), 28–38. https://doi.org/10.1109/MTS.2011.940293
25. Garcia, D. (2016). 5 benefits for government agencies to use social media in 2016. LinkedIn Pulse. https://www.linkedin.com/pulse/5-benefits-government-agencies-use-social-media-2016-dan-garcia
26. Grinin, L., Grinin, A., & Korotayev, A. (2022). COVID-19 pandemic as a trigger for the acceleration of the cybernetic revolution, transition from e-government to e-state, and change in social relations. Technological Forecasting and Social Change, 175, 121348. https://doi.org/10.1016/j.techfore.2021.121348
27. Han, C., & Dongre, R. (2014). Q&A. What Motivates Cyber-Attackers? Technology Innovation Management Review, 4(10), 40–42.
28. Homeland Security. (2016). National Network of Fusion Centers Fact Sheet. http://www.dhs.gov/national-network-fusion-centers-fact-sheet
29. Karakoç, M. (2017). Understanding the Barriers to Addressing Cybersecurity Challenges in American State and Local Governments (Order No. 10604482). Available from ProQuest Dissertations & Theses Global. (2001286247). https://www.proquest.com/dissertations-theses/understanding-barriers-addressing-cybersecurity/docview/2001286247/se-2
30. Karakoç, M. (2022). An Analysis of U.S. State Level Cybersecurity Plans and Policies (Order No. 29324915). Available from ProQuest Dissertations & Theses Global. (2718968643). https://www.proquest.com/dissertations-theses/analysis-u-s-state-level-cybersecurity-plans/docview/2718968643/se-2
31. Kharpal, A. (2015). Hackers are selling your data on the ‘dark web’... For only $1. http://www.cnbc.com/2015/09/23/hackers-are-selling-your-data-on-the-dark-web-for-1.html
32. Levinson, M. (2012, January 26). Are You at Risk? What Cybercriminals Do With Your Personal Data. CIO. http://www.cio.com/article/2400064/security0/are-you-at-risk--what-cybercriminals-do-with-your-personal-data.html
33. Lipman, P. (2015). 4 Critical Challenges to State and Local Government Cybersecurity Efforts (Industry Perspective). http://www.govtech.com/opinion/4-Critical-Challenges-to-State-and-Local-Government-Cybersecurity-Efforts.html
34. Loewengart, V. (2012). An introduction to hacking and crimeware: A pocket guide. IT Governance Pub.
35. McCallum, J. C. (2023); U.S. Bureau of Labor Statistics (2025) – with minor processing by Our World in Data. “Disk” [dataset]. John C. McCallum, “Price and Performance Changes of Computer Technology with Time”; U.S. Bureau of Labor Statistics, “US consumer prices” [original data].
36. Montague, Z. (2023, June 15). Russian Ransomware Group Breached Federal Agencies in Cyberattack. The New York Times. https://www.nytimes.com/2023/06/15/us/politics/russian-ransomware-cyberattack-clop-moveit.html
37. National Governors Association. (2015). Enhancing The Role of Fusion Centers in Cybersecurity. https://www.nga.org/wp-content/uploads/2019/04/1507EnhancingTheRoleOfFusionCenters.pdf
38. National Institute of Standards and Technology. (2020). Evidence suggests that the U.S. Loses Hundreds of Billions to Cybercrime, Possibly as much as 1 % to 4 % of GDP Annually. https://www.nist.gov/news-events/news/2020/05/evidence-suggests-us-loses-hundreds-billions-cybercrime-possibly-much-1-4
39. Norris, D. F., Mateczun, L., Joshi, A., & Finin, T. (2015). Cybersecurity Challenges to American Local Governments. The 15th European Conference on eGovernmen, June 2015, Univ. of Portsmouth, UK, pp. 196-202.
40. Norris, D. F., Mateczun, L., Joshi, A., & Finin, T. (2018). Cybersecurity at the Grassroots: American Local Governments and the Challenges of Internet Security. Journal of Homeland Security and Emergency Management, 15(3). https://doi.org/10.1515/jhsem-2017-0048
41. Norris, D. F., Mateczun, L., Joshi, A., & Finin, T. (2019). Cyberattacks at the Grass Roots: American Local Governments and the Need for High Levels of Cybersecurity. Public Administration Review, 0(0). https://doi.org/10.1111/puar.13028
42. Obama, B. (2009). Transparency and Open Government. The White House. https://obamawhitehouse.archives.gov/realitycheck/node/2206
43. Obama, B. H. (2015). Remarks by the President at the Cybersecurity and Consumer Protection Summit. Whitehouse.Gov. https://obamawhitehouse.archives.gov/the-press-office/2015/02/13/remarks-president-cybersecurity-and-consumer-protection-summit
44. PBS News. (2023). Why TikTok is being banned for some federal employees. PBS News. https://www.pbs.org/newshour/politics/why-tiktok-is-being-banned-for-some-federal-employees
45. Ponemon Institute. (2015). State of Cybersecurity in Local, State & Federal Government. https://ssl.www8.hp.com/ww/en/secure/pdf/4aa6-2563enw.pdf
46. Preecha, J. (2025). Cybersecurity and Public Trust in Digital Governance: Focusing on Citizen Trust. Proceeding of International Conference on Social Science and Humanity, 2(2), 26–37. https://doi.org/10.61796/icossh.v2i2.27 ptsecurity.com. (2024). Analytics. Ptsecurity.Com. https://global.ptsecurity.com/en/research/analytics/cyberthreats-in-the-public-sector/
47. Refsdal, A., Solhaug, B., & Stølen, K. (2015). Cyber-risk management. Springer.
48. Rosenzweig, P., Bucci, S., & Inserra, D. (2013). A Congressional Guide: Seven Steps to U.S. Security, Prosperity, and Freedom in Cyberspace. The Heritage Foundation. http://www.heritage.org/defense/report/congressional-guide-seven-steps-us-security-prosperity-and-freedom-cyberspace
49. Shinder, D. L., & Cross, M. (2008). Scene of the Cybercrime. Syngress.
50. Sobers, R. (2025). Data Breach Statistics & Trends. https://www.varonis.com/blog/data-breach-statistics
51. Spidalieri, F. (2015). State ff The States on Cybersecurity. Pell Center for International Relations and Public Policy, 42.
52. Statista. (2026a). Cost of cybercrime in the U.S. 2030. Statista. https://www.statista.com/forecasts/1399040/us-cybercrime-cost-annual/
53. Statista. (2026b). Number of data records exposed in online breaches of U.S. government organizations from January 2023 to November 2023, by state. Statista. https://www.statista.com/statistics/1455775/us-gov-data-breaches-records-impacted-by-state/
54. Sutliff, U., & Richardson, T. (2016). Cybersecurity Guide for State and Local Law Enforcement. National Consortium for Advanced Policing. https://drulibrary.uoregon.edu/sites/default/files/rpds/entry/file_for_download/Cybersecurity_Guide_for_State_and_Local_Law_Enforcement.pdf
55. The City of Dallas. (2023). The City of Dallas Ransomware Incident: May 2023. https://dallascityhall.com/departments/ciservices/DCH Documents/dallas-after-action-review-slideshow-of-ransomware-attack.pdf
56. The Maryland Department of Commerce. (2016). Cybersecurity Maryland. https://open.commerce.maryland.gov/wp-content/uploads/2016/10/Cybersecurity-Maryland.pdf
57. The State of Michigan. (2015). Michigan Cyber Initiative 2015.
58. Tsvetanov, T., & Slaria, S. (2021). The effect of the Colonial Pipeline shutdown on gasoline prices. Economics Letters, 209, 110122. https://doi.org/10.1016/j.econlet.2021.110122
59. Webster, F. (2014). Theories of the information society.
60. Wilkie, C. (2021). Colonial Pipeline paid $5 million ransom one day after cyberattack, CEO tells Senate. CNBC. https://www.cnbc.com/2021/06/08/colonial-pipeline-ceo-testifies-on-first-hours-of-ransomware-attack.html
61. White House. (2013). Presidential Policy Directive—Critical Infrastructure Security and Resilience. Whitehouse.Gov. https://obamawhitehouse.archives.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil