Cyberattacks on state, local government up 50%

Many of the cyberattacks on state, local, tribal and territorial governments are not complicated and could be avoided through simple steps such as improved cyber hygiene and two-factor authentication, a new report states.

Since 2017, attacks – which the report defines as targeted instances of intrusion, fraud or damage by malicious cyber actors rather than discovery of insecure databases or accidental online leaks – rose an average of almost 50%, according to the “State and Local Government Security Report” that BlueVoyant, a cybersecurity firm, released Aug. 27. That amount that is likely only a fraction of the true number, the report adds.

The research confirmed the company’s belief that active threat targeting happens across the board. “For every selected county’s online footprint, evidence showed some sign of intentional targeting,” the report states. What’s more, five counties -- or 17% of the 28 studied -- showed signs of potential compromise, indicating that traffic from governments assets was reaching out to malicious networks.

“There’s a collective risk here because there is no standardization,” said Austin Berglas, former FBI special agent in New York and head of ransomware/incident response at BlueVoyant. “You have certain state and locals that are on dot-coms and dot-us or dot-orgs. One would think that these should be on the dot-gov domain because [that] means that you not only check the box as being a certified government site, but you get forced two-factor authentication and you’re always going to have HTTPS.”

Ransomware is the main way municipal assets are attacked. What’s more concerning than the growing number of attacks, however, is the increase in how much bad actors demand in ransom, the report states. Average ransom demands rose from a monthly average of $30,000 to nearly half a million dollars, with total monetary value of ransom demands reaching into the millions.

Even when cities don’t pay, the costs can be staggering. For instance, the 2019 ransomware attack on Baltimore cost the city more than $18 million in damages and remediation.

“The notion of ‘Hey, I’m small. The bad guys aren’t going to be targeting me’ is no longer applicable,” Berglas said. “The bad guys know how valuable” state and local government data is, so they go after  the personally identifiable information in tax records or disrupt entire networks in an extortion attempt. “We’ve personally seen a municipality in the past year get completely compromised, locked up with ransomware and the entire 911 system was locked down.”

Other attack vectors include data breaches and typosquatting, in which threat actors impersonate trusted domains with near-identical website URLs, according to the report. “Such sites are often created as a means of advanced threat infrastructure: pre-positioning for many phishing, spear-phishing and [social media] influence campaigns,” it states.

The coronavirus response and upcoming presidential election have helped put cybersecurity in the limelight.

“We immediately expanded our attack surface immensely,” Berglas said of the pandemic. “If I’m an IT section of a company and I’ve got the responsibility of protecting and maintaining the endpoints -- the laptops, the computers, the phones -- and all of a sudden that just tripled, quadrupled in number and now my company is allowing people to use their own devices, [I need to know how] those devices managed,” he said. “Are there endpoint sensors on those devices to protect them? Are there containers that separate work from personal information? Is there data-loss protection capability on there? All of these questions come into play.”

In terms of election security, what’s at stake is not the potential for changing votes, but rather undermining faith in the process, he added. For instance, when people vote by mail, could votes tallied on a spreadsheet be locked up by a ransomware attack?

State and local governments can take three immediate steps to improve their security postures, Berglas said. The first is to implement password hygiene, or the use of complex passwords that automation would struggle to detect. Second is two-factor authentication, which deters bad actors who don’t want to have to take extra steps to gain access, and the third is a review of remote desktop protocols, including ensuring that ports are closed after employees finish using them.

Agencies can build on their security from there by accounting for sufficient backups, planning for defense-in-depth and following the least-privilege principle, which states that people on the network can access only the information they need to do their jobs. On top of that, Berglas said, agencies need visibility into the entire network so they can monitor it round-the-clock.

“Resiliency takes a front seat here,” he said.

This article first appeared in GCN.com.

Featured

  • Report Reveals Security Training Reduces Global Phishing Click Rates by 86%

    KnowBe4, the cybersecurity platform that comprehensively addresses human risk management, today launched its “Phishing by Industry Benchmarking Report 2025” which measures an organization’s Phish-prone Percentage (PPP) — the percentage of employees likely to fall for social engineering or phishing attacks, indicating the organization’s overall susceptibility to phishing threats. This year’s report found a global average baseline PPP of 33.1%, meaning a third of employees interact with phishing simulations before taking part in best-practice security awareness training (SAT).COVER 2025-PIB-NA-Report_EN-US Read Now

  • TSA Begins REAL ID Full Enforcement Today

    Today, the Transportation Security Administration (TSA) announced the imminent implementation of its REAL ID enforcement measures at TSA checkpoints nationwide. Read Now

  • Body-Worn Cameras on the Rise

    On the evening of Oct. 29, 2024, the owner of 300 Guard based in Houston, was shot while on duty at a convenience store. He returned fire. He was wearing a plated vest and thankfully recovered in the hospital. Read Now

  • Brazil Port Enhances Surveillance and Supports Wildlife Conservation with Sustainable Technology

    Ferroport, which operates the iron ore terminal at the Port of Açu in São João da Barra, Rio de Janeiro, Brazil, has deployed state-of-the-art video surveillance cameras from Axis Communications to enhance nighttime security and visibility, while decreasing environmental impact and prioritizing sustainability. With cutting-edge technology, the port now has precise surveillance cameras that capture high-quality nighttime images, while reducing the amount of artificial lighting that negatively impacts the surrounding ecosystem. Read Now

  • Fast-Forward from 1,000 B.C.E. to Today

    The lock and key have been around since time immemorial. In fact, the locksmith profession is one of the oldest in the world when you consider the earliest wooden tumbler lock debuted three-plus millennia ago. Read Now

New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.