October is Cybersecurity Awareness Month. For municipalities, school districts, public libraries, utility departments, parks and recreation teams, public works departments, and other public agencies, it is a good time to take a closer look at what you know, what you assume, and what is actually protecting your systems.
Not all cybersecurity advice is accurate. Some advice has been repeated for so long that it sounds like fact, even when it is outdated, incomplete, or not built for how public-sector organizations actually operate.
That creates blind spots. Cybercriminals look for those blind spots, especially in local governments and public agencies where one exposed Microsoft 365 account, one missed update, one untested backup, or one bad click can disrupt citizen services, public records, GIS data, utility billing, emergency communications, payroll, or board operations.
The good news is that these gaps are usually simple to address once you know where to look. For agencies serving Burlington, West Burlington, Des Moines County, Southeast Iowa, and the surrounding Iowa and Illinois region, practical planning matters. Many public organizations are working with limited internal IT resources, aging infrastructure, grant requirements, geographically dispersed facilities, and a responsibility to keep essential services running during cyberattacks, Mississippi River flooding, severe weather, equipment failures, and other disruptions.
Here are six cybersecurity myths we hear from organizations of all sizes, along with the facts behind them for municipal and public-sector operations.
Myth 1: We are too small for cybercriminals to care about
There is no city, department, library, utility district, school office, or public agency too small for an opportunistic cybercriminal. It does not matter if you serve a few hundred residents, several thousand citizens, or a regional population across Southeast Iowa.
If you have exposed accounts, citizen data, employee records, financial systems, remote access, public safety information, water and sewer infrastructure, GIS maps, or vulnerable devices, you may be a target. Your agency could also provide an entry point into a county system, state portal, software vendor, emergency services partner, or regional planning network.
This matters across communities like Burlington, West Burlington, Middletown, Danville, Mediapolis, Fort Madison, Keokuk, Mount Pleasant, Wapello, Monmouth, Macomb, and Quincy, where public services often depend on shared vendors, regional coordination, and cross-agency communication.
Fact: Hackers choose targets based on opportunity, not population size or department size.
Myth 2: Staff will recognize a phishing email
The obvious phishing emails filled with typos and suspicious senders are not the only threat anymore. Many scams are polished, personalized, and designed to look like they came from someone you trust.
Artificial intelligence has made it harder to spot a scam by reading the message alone. Public employees also need to look at the behavior behind the request.
Ask whether the supposed sender would:
- Make an unusual request outside normal procedures
- Change payment instructions for a vendor or contractor
- Ask for employee, student, resident, or patient information
- Send a new or unusual Microsoft 365 login link
- Request urgent action related to grant funding, procurement, or payroll
Public agencies are especially vulnerable because employees are expected to respond to residents, vendors, state agencies, elected officials, contractors, consultants, and partner organizations. A message that appears to involve infrastructure planning, transportation, utilities, economic development, public health, or emergency services may get quick attention.
If something feels unusual, slow down and verify it through a separate channel. Call the person using a known phone number. Do not reply to the message or use the contact information it provides.
Fact: A convincing email can still be a scam.
Myth 3: MFA fully protects our accounts
Multi factor authentication is an important layer of protection, especially for Microsoft 365, remote access, finance systems, records management platforms, and administrative accounts. But MFA is not invulnerable.
Criminals use MFA fatigue attacks to take advantage of employees who receive repeated approval requests. For example, prompt bombing can flood a phone with login requests. The attacker hopes the employee eventually approves one just to make the notifications stop.
MFA should be supported by strong passwords, managed devices, access controls, security awareness training, conditional access policies, and monitoring. Where possible, use phishing resistant authentication methods instead of relying only on approval notifications or text messages.
For public agencies, access control also needs to match roles. A seasonal parks employee, library volunteer, utility billing clerk, public works supervisor, police administrator, GIS coordinator, and city clerk should not all have the same level of access. Good security protects both citizen data and taxpayer resources.
Fact: MFA should be part of a broader security strategy.
Myth 4: Our backups have us covered
Ask yourself a practical question. If ransomware locked up your files tomorrow, could your agency restore its data? How long would that take? Which services would be affected first?
A backup only helps when it is available, protected, and tested. Many organizations discover during an incident that backups were incomplete, connected to the network, too old, or impossible to restore quickly.
For public-sector organizations, the stakes can be high. Backups may need to protect council packets, board records, utility billing, permitting, payroll, public safety files, GIS data, library systems, park reservations, economic development documents, grant reporting, and long-term public records. Microsoft 365 also needs attention. Storing files in OneDrive, SharePoint, or Exchange Online is not the same as having a tested backup and disaster recovery plan.
Review your backup schedule, retention periods, access controls, cloud systems, and recovery process. Test the process regularly so you know what will happen before there is a crisis.
Fact: Having backups is not the same as being able to recover.
Myth 5: Cybersecurity is only IT responsibility
Your IT team or technology provider does a lot to protect your systems. They cannot control every click, password, file transfer, vendor payment request, open records response, or email attachment handled by staff.
Cybersecurity decisions happen throughout a public organization. A single bad click can open the door to malware, stolen credentials, fraudulent payments, exposed citizen records, or interrupted services.
Security awareness training helps employees recognize unusual requests and know when to ask for help. The goal is not to make everyone a technical expert. The goal is to help people make safer decisions during a busy workday.
This is especially important for agencies with small teams. In many Southeast Iowa communities, the same person may handle utility billing, records requests, payroll, board packets, website updates, and vendor communication. Practical training gives staff a better chance to pause before a small mistake becomes a major incident.
Fact: Training employees to make good decisions strengthens your cybersecurity.
Myth 6: We know what to do if something happens
Imagine it is Tuesday morning and several employees suddenly cannot access their files. Or the utility billing system is unavailable. Or email is down during a severe weather event. Or a ransomware message appears on a shared workstation at a public facility.
That is when many organizations discover they have not answered a few basic questions.
- Should employees shut down their computers?
- Who contacts IT or your technology provider?
- What happens if email and phone systems are unavailable?
- Who contacts elected officials, board members, department heads, or agency leadership?
- When should cyber insurance, legal counsel, law enforcement, or state reporting contacts be involved?
- Who communicates with residents, vendors, partner agencies, and the media?
- How will employees receive updates if Microsoft 365 or the phone system is down?
- Which services must be restored first to protect public health, safety, and continuity of operations?
Do not rely on memory during an incident. Create a written incident response plan, assign responsibilities, and test the plan with your team. Your response process should include backup communication methods, a clear escalation path, and priorities for restoring essential services.
For Burlington and the surrounding region, continuity planning is not just about cyberattacks. It should also account for severe weather, flooding along the Mississippi River, power interruptions, equipment failures, transportation disruptions, and coordination with neighboring communities, counties, utilities, and emergency services.
Fact: Your recovery plan should not debut during an incident.
Cybersecurity awareness starts with the facts
Cybersecurity Awareness Month is a good reminder to check the assumptions guiding your technology decisions.
Myths are comfortable. They can make an organization feel protected without requiring anyone to look closely at the details. But many cybersecurity gaps come from believing everything is handled when it is not.
At Tigerhawk Technologies, we help local organizations separate real protection from false confidence. For public agencies, that starts with understanding your Microsoft 365 environment, accounts, devices, backups, policies, regulatory responsibilities, records management needs, and response plans.
Burlington serves as a regional center for government, education, healthcare, economic development, transportation, and public services in Southeast Iowa. That makes reliable technology planning important not just for one department or one building, but for the residents, businesses, schools, utilities, and partner agencies that depend on those services every day.
If any of these myths sound familiar, take a closer look at where your organization stands. Schedule a discovery call and let us help you identify the practical steps that can reduce your risk.
Questions public agencies are asking right now
How should a small city or public agency in Burlington or Des Moines County start improving cybersecurity?
Start with the basics: know your accounts, require MFA, review Microsoft 365 permissions, patch devices, test backups, and document who does what during an incident. Small agencies do not need to solve everything at once. A practical roadmap helps prioritize the highest risks first while respecting staff time, budget limits, and taxpayer resources.
Do local governments and public agencies need separate backup for Microsoft 365?
In many cases, yes. Microsoft 365 provides resilient cloud services, but it is not a complete substitute for agency-controlled backup and recovery. Deleted files, compromised accounts, ransomware, retention gaps, and user mistakes can still create problems. Public agencies should understand what is protected, how long data is retained, and how quickly records can be restored.
What should be in a cybersecurity plan for public works, utilities, libraries, and school districts in Southeast Iowa?
A good plan should cover account security, device management, backups, vendor access, incident response, staff training, cyber insurance contacts, and continuity of essential services. It should also reflect real local conditions, including rural facilities, severe weather, Mississippi River flooding, emergency communications, grant requirements, and coordination with city, county, school, utility, and regional partners.