Louisiana CISO takes on new role overseeing cyber incident response

As the number of cyberattacks affecting government organizations across Louisiana rose over the years, it was increasingly difficult for Dustin Glover, the state’s longtime chief information security officer, to lead the response to those incidents while also fulfilling his mainline duties in the Office of Technology Services.

Since July 2019, when a group of K-12 districts were taken down by ransomware just days before the start of a new school year, Glover has helped parishes, cities and school systems respond to cyber incidents 107 times, he said in an interview. Those responses often featured not just Glover’s colleagues from OTS, but also personnel from the Governor’s Office of Homeland Security and Emergency Preparedness, the Louisiana State Police and the National Guard, as the state’s made steady use of a cyberattack response protocol known as Emergency Support Function 17, or ESF-17.

Earlier this month, Glover was rewarded for his efforts with the new title of chief cyber officer, a role overseeing incident response, assistance to local governments and coordination with the military and law-enforcement agencies. The CISO role, which Glover had held since 2014, is going to remain focused on enterprise IT security across the 23 statewide departments OTS supports.

Glover told StateScoop his job change is also an attempt by OTS to return the CISO job — now held by Chase Hymel, a longtime enterprise security architect — to its core duties serving state agencies, while Glover focuses on incident response and intergovernmental coordination. He said the idea came from Deputy Chief Information Officer Neal Underwood.

“He wanted to figure out a way to get the CISO position back in OTS because CISO is a full-time job that, in my opinion, has not been performed as well as it needs to be because there hasn’t been someone that has been in that role with without having to also manage this emergency management piece since 2019,” Glover said. “This is going to give OTS the ability to provide that that CISO leadership portion, while also not giving up any ground related to the progress we’ve made with our partners, in the in the value we’re adding to local government entities managing cyber emergencies.”

Glover said that approach furthers Louisiana’s adoption of a whole-of-government strategy as it weathers constant threats. The closer partnerships with other authorities also mean that Glover’s people in OTS can avoid duplicative work when investigating and mitigating a cyberattack, he said.

“Why would OTS want to go and recreate any sort of forensic capabilities in our organization when we could partner with [the Louisiana State Police] and improve upon and invest in their capabilities and utilize them as how we do forensics?” he said. “I want to invest in each one of those operational areas and make them as successful as possible and integrate them as much from an OTS perspective as possible.”

Glover said his promotion to chief cyber officer also comes amid an expansion of Louisiana’s cybersecurity workforce. The Office of Technology Services and Louisiana Military Department are both in the process of adding 10 personnel each, while the Louisiana State Police are adding five positions, he said.