Cybersecurity in municipal administrations

Internationally known Prof. Dr. Dennis-Kenji Kipker, co-founder of the cyberintelligence.institute and sought-after consultant, analyzes why cybersecurity for Germany is so complicated, and sheds light on the cybersecurity challenges in municipal authorities. The podcast was recorded a few weeks before the final transition of the NIS2 directive into German law.

Duration:

24 min

Guest in this episode:

Prof. Dr. Dennis-Kenji Kipker

co-founder cyberintelligence.institute

FAQ

Facts on the topic

What were the specific findings of the German Federal Court of Auditors' report on cybersecurity?

The internal report identified a "massively inadequate" level of security in municipal facilities and federal data centers. Most alarming: fewer than 10% of the federal data centers audited met the minimum standards for geographic redundancy and Uninterruptible Power Supply (UPS). Furthermore, the 2021 cybersecurity strategy was criticized as ineffective due to a lack of measurable criteria and inconsistent implementation.

Why does the NIS2 implementation include exemptions for government agencies?

In current NIS2 implementation discussions, there is significant debate regarding special exemptions for federal entities. Experts criticize this "diffusion of responsibility." While the private sector faces strict regulations and heavy fines for non-compliance, the government often exempts itself from the same requirements. This is particularly problematic as government agencies are responsible for essential public services (e.g., social security benefits) that are at high risk during a cyberattack.

What is meant by the "hidden object map of responsibility diffusion" in German cybersecurity?

This term describes the highly complex national cybersecurity architecture, which involves over 77 different stakeholders (equivalent to agencies like the FBI, CISA, or FEMA in the US). The result is a fragmentation of duties and information flow. Experts are calling for a reduction in complexity and a strengthening of central authorities to increase efficiency, rather than constantly creating new bureaucratic layers.

How can municipalities increase resilience despite staffing shortages?

Since local governments often lack both the budget and the specialized workforce for IT security, inter-municipal cooperation is key. Shared service centers and regional IT providers can pool expertise. However, it is vital that these providers offer true Cybersecurity Management rather than just basic system administration to prevent catastrophic failures like the Südwestfalen IT case.

Which "low-hanging fruits" can improve security immediately?

According to Prof. Kipke, 90% of standardized cyberattacks can be prevented through simple baseline measures. These include:

Multi-Factor Authentication (MFA): An absolute requirement for every system.
Backup & Power Supply: Securing physical availability and data recovery.
Staff Training: Utilizing built-in system tools and open-source resources by training existing personnel.
Pragmatism: Starting with small steps (the Pareto Principle: 80% protection with 20% effort) instead of waiting for lengthy committee decisions.