Cybersecurity is Everyone's Business

Because New Jersey Judiciary judges and staff handle sensitive, personal information in their daily work, they are aware of importance of being information security aware all the time. There are several ways this is accomplished.

They include the scheduled changing of passwords on Judiciary-owned devices, implementing two-factor authentication for devices, regularly acknowledging policies regarding the safeguarding of personal information, and continuing education that includes in-person and virtual trainings and a monthly video series that addresses issues such as phishing, online scams and cybercrime.

Judiciary leaders recognized the importance of cybersecurity more than a decade ago, when they created a position of information security officer separate from the courts’ Office of Information Technology.

“A lot of our information security efforts at this point is showing people potential scams or things people can use to break into our computers,” said Sajed Naseem, the Judiciary’s Chief Information Security Officer. Naseem, who has been with the Judiciary since 2017, said his primary focus has been emphasizing the importance of protecting the public’s confidential information.

While cybersecurity has always been at the forefront of the minds of Judiciary leaders and staff, it took on added importance in March 2020, when the start of the COVID-19 pandemic forced the courts to transition nearly all of its operations online. The organization embraced the concept of zero-trust architecture, a framework that requires users in and outside of an organization to be authenticated, authorized, and continuously validated before being granted access to applications and data. New Jersey Judiciary Chief Information Officer Jack McCarthy told Government Technology that zero trust allows the Judiciary to safeguard remote and hybrid operations and limits the damage a hacker could do if they breach the many layers of security. “[Zero trust has an] ability to kind of limit things jumping laterally — if one device got hit, it doesn’t mean everything should get hit,” McCarthy told the magazine in its February 2022 issue. Such demand for both on-premises and remote operations emphasized that the Judiciary needed a security approach that could be applied consistently, he said.

“Our understanding that it was going to be an unpredictable environment to us. (That led us to say,)‘Let’s not look at what we’re doing remote or on-prem, let’s just do everything in the same building, in the same manner, in the same way we were doing it,’” McCarthy told the magazine.

Constantly aware of current threats to its infrastructure, the Judiciary earlier this year temporarily barred access to court records to those outside the United States. The move was not based on any imminent threat to the courts computer system. “The Judiciary is blocking all internet traffic from outside the country to ensure the security of our data. This includes access to all of our websites, applications, and other services,” the courts said in statement. “We are also blocking all email traffic to and from all sites outside the U.S.”

Cybersecurity is all about preparation and vigilance, planning for a potential breach before it occurs and reacting appropriately, Naseem said. “We definitely have cybersecurity awareness, but we also have what I call cybersecurity readiness and performance,” he told Government Technology magazine in its October/ November 2020 edition. “To me, awareness is knowing something, and readiness and performance is having the right amount of knowledge and the right amount of training to be able to act on a problem.