Blog / Oh, the Shame! – Simple Steps to Avoid a Cyber Security Meltdown.
Recent news articles about Cyber Attacks on municipalities in Canada and the U.S. reveal a depressing reality about the information systems and practices of many municipal governments.
As Information Technology becomes more integrated into daily municipal operations, the threats of debilitating Cyber Attacks increase dramatically. Midland, ON, St. John, NB, Stratford, ON, Wasaga Beach, ON, Lake City, FL, Riviera Beach, FL, Baltimore, MA, and Key Biscayne, FL, have all fallen victim to devastating Cyber Attacks in recent months.
In this case, size doesn’t matter, and more than one municipality has paid a hefty ransom to retrieve their files. But costs aside, it erodes confidence that Administration are in control of the sensitive information entrusted to them.
But it doesn’t have to be this way.
There are three things a municipality can do to mitigate their Cyber Risks, and all are easy to implement with some simple planning and forethought. Here’s a quick synopsis:
- GET YOUR IT HOUSE IN ORDER – Most attacks come to you through the Internet connection. That means you need a best-in-class firewall with Subscription Services to constantly check ALL Internet traffic against real-time databases of known threats. Firewalls need to be sized correctly, to prevent Internet slowdowns for users. Your Anti-Virus Software also needs to be top-notch and installed on EVERY piece of Technology: Workstations, Laptops, Tablets, Servers, AND (often overlooked) Smartphones. The Anti-Virus Subscription needs to be current and all devices need to be centrally-managed. It also needs to be locked, to prevent tampering. Restrict access to WiFi by using strong passwords – and change them often.
It is estimated that over 80% of Email traffic is either SPAM or virus, so your incoming Emails need to be extensively filtered by a service outside your organization, BEFORE it reaches your servers.
Summary: Don’t scrimp on your Technical Cyber Security Counter-Measures – Buy the Best.
- ENSURE YOUR BACKUPS ARE BULLET-PROOF – State-of-the-art Backup Systems use Image Technology to take snapshots of servers and critical systems that can be overlaid onto replacement or emergency servers, in case the primary servers are rendered inoperable – for any reason. DAILY backup versions need to span more than one week; ideally, at least one month’s worth (savvy organizations take “archive” images each month.) Backups need to be stored offsite – preferably on a private, secure Cloud host. Offsite means truly offsite; NOT another connected facility in your organization. Backups need to be tested regularly (at least weekly) by restoring one or more files at random – or a complete server image.
An IT Disaster Recovery Procedure should be written, tested and include instructions on the alternate hardware to be used, and where.
Summary: KNOW that your Backups are current, safe, complete, and work as advertised.
- EDUCATE YOUR USERS – The Microsoft CEO was recently quoted, saying: “Every organization has at least one employee who will click on anything. It’s hard to protect against that.” Thus, constantly-reinforced User Education is key to ensuring staff members are kept up-to-date on the latest threats. Weekly Email alerts, reminders at staff meetings, and periodic webinars are excellent tools to keep Cyber Security top-of-mind. Your Staff Education portfolio should include a written procedure for what-to-do if someone has clicked on a virus attachment. Make it simple and easy to understand, and have employees post it near their workstations. Savvy organizations even practice these procedures.
User Education should also reinforce the proper management of passwords; changing them often, using appropriately strong passwords, and NEVER sharing them.
Summary: Enlighten your staff with permanent and relevant Cyber Security Education; a constant drip of Cyber Security anti-venom is better than invasive surgery.
Of course, more advanced measures start with a full Cyber Security Assessment to uncover hidden vulnerabilities. Don’t become a poster-child for the next Cyber Attack news report; follow these simple guidelines and start down the path to stress-free Cyber Security.
Dave White
TRINUS
stress-free IT
