FBI urges local agencies to prepare for ransomware attacks
GettyImages/xia yuan
Connecting state and local government leaders
To fend off attacks and avoid unnecessary exposure, the FBI issued a notice calling on local governments to deploy timely patching, awareness campaigns and regular encrypted backups.
To help local governments better protect themselves against financial loss, public safety risks and service disruptions caused by ransomware, the FBI on March 30 issued a private industry notification detailing recent attacks against smaller county and municipal networks and making recommendations for proactive contingency planning.
Budget and staff limitations, legacy systems and responsibility for mission-critical services and residents’ personal information have made local government agencies an attractive target for cyber criminals. According to a recent global survey, “local governments were the least able to prevent encryption and recover from backups, and had the second highest rate of paying the ransom compared to other critical infrastructure sectors,” the FBI said.
In 2021, the top initial infection vectors were phishing emails and exploitation of software vulnerabilities and remote desktops. Moreover, a rise in ransomware-as-a-service business models widened the scope for potential victimization.
Over the next year, the FBI said it expects ransomware and malware attacks on local governments to continue as hackers’ targeting tactics evolve, and it urged agencies to deploy timely patching, awareness campaigns and regular encrypted backups to help fend off attacks and avoid unnecessary exposure.
The report recommended regular software updates and automated security scanning and testing when possible. In cloud environments, that means ensuring virtual machines, serverless applications and third-party libraries are also patched regularly, the alert said.
Investment in workforce training and awareness programs is also critical, according to the FBI, as cyber criminals often breach an organization via phishing emails and then move laterally through a network. To counter these threats, the FBI advised requiring strong, unique passwords for accounts with logins and multi-factor authentication wherever possible. Privileges for both human and non-person, i.e. software, identities should be limited.
The FBI also urged agencies to quickly identify, detect and investigate abnormal activity in network traffic, especially from external remote connections. Artificial intelligence-enabled network intrusion detection systems, endpoint detection and response tools are particularly useful in detecting lateral movement, the FBI suggested, and network segmentation could help restrict cyber criminals’ access to an agency’s subnetworks.
Encrypted, immutable backups across an agency’s entire data infrastructure will protect against data loss and minimize potential downtime, the report said. To secure cloud backups, the FBI advocated separating account roles and storing encryption keys outside the cloud.
“The FBI does not encourage paying ransoms,” the report stated. Payment does not ensure agencies get access to their data and it encourages similar activity. “However, the FBI understands that when victims are faced with an inability to function, all options are evaluated to protect shareholders, employees, and customers,” it added.
“Regardless of whether your organization decides to pay the ransom, the FBI urges you to report ransomware incidents as soon as possible to your local FBI field office,” the notice stated.