Why Local Governments Need to Take Cybersecurity More Seriously
Videowokart / Shutterstock.com
The IT security risks are high and the resources for effective defense aren’t always there.
CINCINNATI — During this week’s National Association of State Technology Directors annual conference, Tom Duffy, the executive director of the Multi-State Information Sharing and Analysis Center, detailed the spectrum of cybersecurity risks state and local governments are facing now or will be facing down the road.
It’s not necessarily news that state and local governments are facing these risks—and certainly, the federal government gets its fair share of cyberattacks and will continue to face such threats into the future as well.
But many municipalities and county governments and the agencies that serve them probably aren’t paying close enough attention to the various cybersecurity risks they face.
And what’s especially scary is that there are plenty of smaller local jurisdictions and agencies out there that might be running a one-person IT shop on a shoestring budget with outdated and vulnerable IT infrastructure and systems.
“There’s no way one person can adequately protect their network with all the threats out there these days,” Duffy said on Tuesday during his NASTD session.
Additionally, these same local jurisdictions might not have robust procedures in place to promote IT security best practices within their workforces. The high number of local government employees caught up in the Ashley Madison hack who used their work email address to register for the website, for instance, is an excellent but unfortunate example of bad IT practices by local employees. (And if they were foolish enough to use their local government email address, it wouldn’t be necessarily surprising if they also had matching passwords for Ashley Madison and their work systems.)
With state governments, there’s a higher likelihood of having better resources and a more unified approach to IT security and cybersecurity defense across agencies. But the exposure to risk in some ways is far greater at the local level just because of the sheer number of local jurisdictions around the nation. Each local jurisdiction might be using different systems and the levels of IT security and cybersecurity resources can vary considerably.
Sure, local governments might not hold classified information that a hostile foreign government might salivate over. But there’s certainly plenty of sensitive information that cities and counties hold, including law enforcement, health, financial and employee data, that shouldn’t get into the wrong hands.
But not all attacks are meant to steal and exploit information that governments hold.
Website vandalism—hacking into a website to maliciously change something on a public-facing webpage—used to be a big deal 10 years ago, Duffy said. But since there’s usually not data involved, it’s not as big of a threat these days.
But ransomware is. And Duffy noted that local governments have been at higher risk for such attacks compared to other levels of government. There are plenty of examples to look at.
Take, for instance, a CryptoLocker ransomware attack last December on the police department in Tewksbury, Massachusetts, where a cyberattacker had locked down critical department files and demanded a 500 bitcoin ransom in order to unlock them.
As the Town Crier newspaper reported earlier this year:
This kind of malware has the ability to find and encrypt files located within shared network drives, USB drives, external hard drives, network file shares and even some cloud storage drives. If one computer on a network becomes infected, mapped network drives could also become infected, which is what happened in Tewksbury. CryptoLocker then connects to the attackers’ command and control (C2) server to deposit the asymmetric private encryption key out of the victim’s reach.
The department ended up paying the ransom because it had few other options. The department’s IT systems had been crippled, its external hard drive backup was corrupted and the latest available uncorrupted backup was 18 months old, according to the Town Crier—way too old to reconstitute its systems.
Local government agencies, especially smaller ones, should ask themselves: Could they effectively deal with a similar situation? Do they have the resources to protect their IT assets? And do they have the necessary relationships with other governmental, private-sector and association entities that can effectively help them deal with such cybersecurity threats?
Each local jurisdiction is a potential target and the threats those targets face are only going to grow more complex and more menacing. It’s just a matter of being proactive or reactive dealing with those threats.
Michael Grass is Executive Editor of Government Executive’s Route Fifty.
NEXT STORY: NASA building next-gen hurricane forecasting satellites