State calls for threat sharing and ransomware payment bans
solarseven/Getty Images
Texas’ Department of Information Resources said localities should be required to report incidents and called for a state ban on paying ransomware demands.
Local governments in Texas should be required to report cyberattacks and other cybersecurity incidents to the state’s Department of Information Resources (DIR) and prohibited from making ransomware payments, according to a report from the agency.
In its 2022 Cybersecurity Report, DIR said that requiring local governments to report incidents “will improve transparency surrounding the threat landscape in Texas and strengthen the state’s ability to defend against attacks.” Currently, only state agencies are required to report cyber incidents to DIR.
The agency said local governments in Texas have faced on average 32 cyber incidents a year since 2019 that required assistance or guidance from the state. It noted that local governments “often face challenges relating to aging infrastructure, lack of qualified security personnel, and strict budgets that leave their information assets vulnerable.”
But local governments in the state — unlike public schools — are not required to follow cybersecurity reporting regulations. They do not have to designate a cybersecurity coordinator or a point of contact or share information with their peers. Doing so, DIR said, “could potentially fill the knowledge and skill gaps of the workforce.”
Several states now demand greater coordination between state and local governments on the reporting and mitigating of cybersecurity incidents. Indiana, for example, now requires local government organizations to report attacks or suspicious activity to the state within 48 hours of discovery.
And in a GCN webinar earlier this month, Hemant Jain, chief information security officer at the Indiana Office of Technology, said having beefed up reporting requirements for local governments reflects “how interconnected we are,” as a threat faced by one locality can quickly spread.
“When we look at the entire state, our goal and priority is ensuring the successful delivery of our services to our constituents,” Jain said. “That involves all levels of government and involves all levels of information and services that we're trying to deliver. The better we can be at helping ensure that we can elevate the security readiness, the better.”
The DIR report also called for banning government entities from making ransomware payments, saying that the paying of ransoms “incentivizes the use of ransomware and funds criminal organizations.” Both Florida and North Carolina have already banned ransomware payments with other states looking to follow suit.
But there are ambiguities in laws that prohibit the paying of ransomware, especially in Florida. In an analysis of Florida’s payment ban, Alfred Saikali of Shook, Hardy & Bacon LLP said it is unclear if local governments are prohibited from communicating with bad actors in a bid to “buy more time” to respond to an attack.
Several of Texas’ local governments were victims of ransomware attacks in 2019, but DIR said it was not aware of any ransom being paid. But the agency’s report this month said that risks are intensifying, and it called on entities to “all do our part to protect our information resources” and be “proactive” against threats.
NEXT STORY: Are we building cyber vulnerability into EV charging infrastructure?