State of Arizona

Whole-of-state security — Cloudflare partners with the Arizona Department of Homeland Security to empower Cyber Readiness Program for local and community organizations statewide

The State of Arizona has embraced the cloud as the most flexible, efficient, and cost-effective way to create an infrastructure that satisfies its population of 7.5 million citizens' demands for online services and information.

In its quest to provide its residents with safe universal access to information, the State of Arizona also emphasizes the importance of protecting its citizens and services from online threats. In 2019, to address increasing security concerns in a climate where cyber attacks against state and local governments are becoming commonplace, the state developed the initial version of what has grown into the Arizona Statewide Cyber Readiness Program (CRP). What began as a federally-funded cybersecurity grant program has been designed to be the backbone for a whole-of-state approach to cyber defenses, where an attack against one entity is viewed as an attack against all entities.

Challenge: Providing simple but effective online security for public entities with limited resources

"Our IT priority is modernizing legacy technologies and securely delivering better digital services to our citizens” explains J.R. Sloan, State Chief Information Officer, Arizona Department of Administration. “By leveraging the cloud, we can move more quickly to deliver incremental services that already have security built in.”

The Cyber Readiness Program is now in its fourth year and has grown to become a critical statewide initiative, providing five cybersecurity tools that are protecting more than 210 entities, including 124 K-12 school districts, 59 cities, all 15 counties and 13 entities that represent other local services like libraries, fire districts, county associations, and tribal partners.

“Cyber attacks against school systems have historically shut down school operations, especially now that schools have become increasingly dependent on the use of technology following the COVID-19 pandemic,” said Ryan Murray, Deputy Director of the Arizona Department of Homeland Security, and Interim State Chief Information Security Officer (CISO). “As more technological tools and programs are introduced to classroom environments, more cybersecurity efforts are required in order to mitigate these new threats and vulnerabilities.”

Many state organizations benefiting from the Cyber Readiness Program don't have dedicated full-time cyber-security professionals or even IT staff, which makes it even more important to help secure these entities with protections they wouldn’t otherwise have.

Solution: Joining forces to supply Cloudflare security solutions for government agencies

Cloudflare security solutions, is one of five tools available through the CRP and currently secures more than 80 domains statewide. In addition to security, the CRP provides on-demand administrative support and IT management services for departments in need.

“Arizona has been a Cloudflare customer since we started using it in 2017 to protect what is now our Drupal website infrastructure,” says Murray. “We really needed something that was not an on-premise application firewall and we've had remarkable success with advanced Cloudflare features, especially the bot management and advanced firewall rules our on-premise security solutions didn’t support.”

Complete layer-seven protection with the Cloudflare WAF, Bot Management, Rate Limiting, and content delivery

Maricopa County, the state’s largest county is home to 3.75 million citizens, is another advocate of Cloudflare cybersecurity solutions. The county began its Cloudflare journey in 2020 with Project Athenian, the free Cloudflare service to secure its election websites and protect voters’ confidential data.

Today, the county is the state’s largest user of Cloudflare application security services under the CRP. Cloudflare protects everything from Maricopa County’s top-level sites to its school districts and tribal communities.

“We've had only positive experiences with the Cloudflare services built into the grant program,” says Michael Moore, Information Security Officer for the Maricopa County Recorder's Office. “Before Cloudflare, we had firewalls in place, but we didn't have layer seven denial of service protection or anything to protect against sophisticated attacks that emulate end users. Now, we have everything — the Cloudflare WAF, bot management, rate limiting, and caching.”

Maricopa County uses Cloudflare to ensure its websites are always available and its users can easily locate important information. Using the website beballotready.vote as an example, Moore explains how, using Cloudflare custom page rules, Maricopa County redirects the memorable vanity URL to a page in the county recorder’s website that most users would struggle to locate.

Similarly, using intelligent, integrated, and scalable Cloudflare services, every organization in the county can identify and thwart attacks by blocking problematic IP addresses. Cloudflare also protects the county’s online forms from credential stuffing or brute force attacks without exposing users to excessive CAPTCHAs.

By caching static content on the Cloudflare global network, local and state entities can provide their constituents and communities with instantaneous information from the network edge, mitigating network bottlenecks, and traditional bandwidth limitations. Cloudflare-supported Anti-Phishing and Security Awareness Training empowers employees to recognize and avoid socially engineered online threats.

Making security simple with easily deployed cloud-native solutions and Cloudflare support

“The biggest impact of the Cyber Readiness Program is providing high-quality solutions at no charge to our organization and others like Maricopa County,” says Moore. “But, even if we didn't have the program, we would still use Cloudflare.”

In addition to the cost savings for security grant recipients, the ease of implementing Cloudflare tools has been central to the initiative’s wide acceptance.

“With the Cloudflare platform, we're getting very high-powered, very technical cybersecurity detection and protections that take little to no effort to deploy,” says Murray. “That's especially poignant when we're talking about vulnerable organizations that already struggle with resources, let alone managing another complicated tool.”

Cloudflare support has also been crucial to the program. Since day one, Cloudflare support and training have led to a transfer of skills that have empowered smaller entities to independently manage their own security infrastructure.

“Cloudflare has been a great partner, training us and improving our skills to enable us to solve problems autonomously as we go,” says Sloan.

“Cloudflare's customer and technical support representatives have been very helpful and quick to respond. We have established an excellent relationship with talented people who have stood by the state since the beginning," adds Murray.

The final factor in the collaboration’s success is the way the partnership has evolved beyond the protections Cloudflare provides; which is based on the company’s conviction that cybersecurity should be universally accessible.

“Because Cloudflare shares our belief that we're all in this together — government or business, large or small — they are a critical partner in everything we want to achieve,” says Murray.