CASPER – When cybersecurity expert Greg White spoke to 60 municipal clerks and treasurers from around Wyoming at an April meeting, he delivered a sobering message about the fallout from cyberattacks facing communities around the nation.
“You’re on your own,” said White, the executive director of the Center for Infrastructure Assurance and Security at the University of Texas at San Antonio.
White, who also serves as the executive director of the Information Sharing and Analysis Organization Standards Organization, was the keynote speaker for the spring educational session of the Wyoming Association of Municipal Clerks and Treasurers (WAMCAT) at Casper College.
In addition to identifying the vulnerabilities Wyoming communities face, White presented ways WAMCAT members could enhance cybersecurity practices and encouraged them to take more control in preparing for threats.
Having policies in place to limit vulnerabilities to phishing attacks aimed at employees; isolating key computer systems to only those who are required to have access; education and training programs for employees; updating software on a regular basis; and backing up data in a secure and timely manner were among the solutions White offered to help reduce cyberthreats.
“One of the biggest things, of course, that we came away with was the need for backing up,” said Kathy Lenz, clerk-treasurer for the City of Sundance and WAMCAT board president. “The information was very helpful.”
Many of Wyoming’s small municipalities don’t have IT staffs or have limited budgets for contracting for IT services, so it’s up to officials like her to manage cybersecurity, among other technical responsibilities, Lenz said. That made White’s presentation even more relevant, she added.
White said municipalities can’t expect help from the state, because if it’s dealing with cyberattacks, the state is on its own as it’s unlikely to get any help from the federal government.
He pointed to statistics gathered in 2017 for State of Wyoming computer networks to emphasize the daily cyberthreats, which have only increased.
“You might think that a small state government like Wyoming’s would not be an interesting target for cybercrimes,” White said. “But the number of attempted hacks into our state government top 220,000-225,000 cyberattacks on those systems every day, or around 6-7 million attacks each month.”
Wyoming, its communities and residents aren’t being overlooked by cyberthreats for a basic reason.
“If you are connected to the internet, you are a target,” he said.
Residents, schools, libraries, businesses and other organizations use the internet for a variety of tasks, including keeping in contact with family and friends, managing finances, conducting research, enhancing education and conducting official businesses, White said.
In a slideshow, he pointed out that the cyberthreat to Wyoming is ever-changing.
“Wyoming offers such a dynamic landscape,” White said, “from the type of industry and commerce we provide to the people that support it. We must protect our citizens and critical infrastructure.”
An example of the enormity of cyberthreats facing communities was found in a project done by one of his graduate students, who created a fake municipality online. The faux city had many of the functions found online, including utility payment, school menus and directories. Within a few days of launching the project, it had more than 3,000 cyberattacks.
“But many of the attacks were below the threshold that would bring attention,” White said.
He pointed out the fact that everyone mistypes their user name or password at some time. If that triggered a security alarm, response efforts would be overwhelmed, so they tend to be ignored. Intruders know that, as well, and will try testing one computer, then another, but not all on a system at one time.
He presented examples of municipalities with much more tech resources than found in Wyoming communities that were vulnerable to cyberattacks. Cities like Atlanta, Baltimore and Denver have been hit by ransomware that cost millions of dollars in computer system repairs, data restoration, down employee work time and lost services to the public.
Wyoming and its communities are victims in a much larger conflict involving cyberthreats originating from foreign nations and criminal organizations aimed at destabilizing U.S. political, economic and social structures, White said. But online cyberthreats like ransomware or viruses aren’t the only way to disrupt services. He outlined how 911 systems can be overwhelmed by an auto-dialer, essentially making emergency response services unavailable.
“I think 911 is pretty important, don’t you?” White asked WAMCAT members.
White said another reason communities are on their own is that states themselves acknowledge they don’t put enough of a priority on cybersecurity.
Referring to Department of Homeland Security national preparedness reports by states over the past five years, he said while recognition of the importance of cyberthreats is high, the actual level of preparedness is still ranked at the bottom by the states themselves.
Even the largest organizations can find staying ahead of the challenges posed by cyberthreats daunting. His experience in helping communities enhance cyberhygiene shows that increased communication and cooperation among all areas of public and private sectors are needed. If several individual entities noticed low threshold security activity, that, by itself, might not cause an alarm. But informing other entities about their experience might alert a community that something much larger was happening, White said.
By building on the Community Cybersecurity Maturity Model his organization has developed, sharing information and solutions can help everyone meet the challenges posed by cyberthreats, he said.
“When it comes to security, your business competitors are not your security opponents,” White said of bringing community members together.
He described the approach as “three-dimensional” in that individuals, businesses and agencies come together to strengthen a community, and communities then come together to strengthen the state.
With that kind of approach, White told WAMCAT members communities will make a discovery.
“You’re not on your own,” he said. “That there is help out there.”