As Ransomware Targets Town Halls, Workers Left Behind: IBM Study

‘Seventy-percent of government employees feel like they have a responsibility to help prevent cyberattacks, but we’re not even seeing 40 percent of them trained on the response or the prevention,’ IBM Security's Christopher Scott, Global Remediation Lead, IBM X-Force IRIS tells CRN.

An IBM survey of small government’s ransomware preparedness found city and town workers are more than willing to pickup the fight against cybercriminals, but training and budgets lag behind the enthusiasm, hampering efforts to help.

With more than 100 ransomware attacks against government targets last year, the malicious code found its sweet-spot as criminals reaped thousands of dollars locking down computers that provide critical citizen services in small towns and big cities across the U.S. that were unprepared to take on the threat. With a number of those attacks spreading through MSP tools, vendors across the IT industry have taken steps to fight back, including security researchers at IBM who carried out a study this year of about 690 respondents inside local government to gauge the preparedness of those workers to face ransomware in 2020.

[RELATED: MSP At Center Of Texas Ransomware Hit: ‘We Take Care Of Our Customers’]

“I think the big thing for me on the findings side is 70 percent of government employees feel like they have a responsibility to help prevent cyberattacks, but we’re not even seeing 40 percent of them trained on the response or the prevention,” IBM Security's Christopher Scott, Global Remediation Lead, IBM X-Force IRIS told CRN. “How do we make sure that people who believe they have a responsibility to help – which I think by itself is powerful – get the help they need and understand how to respond?”

Those polled included government workers in education, emergency services, administration, as well as IT, and as a group, they were most concerned about ransomware’s potential hit to their local elections.

“You’ve written about some of the impact when it comes to collecting data digitally, at caucuses and things like that,” Scott said. “I think that’s where the greatest impact would be, in the trust of the system. People are concerned with that, but I think overall the election systems are still very distributed. They’re not centralized. You’d have to go to lots of places to cause a large impact.”

The problem was also pronounced in public education, which emerged as not only a popular target, but also the least prepared to handle it. According to IBM’s findings ransomware hit school districts in New York, Massachusetts, New Jersey, and Louisiana among others last year. Yet, the poll respondents in education had the least cybersecurity training compared to workers in other parts of state and local government. The study found 44% of those in public education said they hadn't received basic cybersecurity training, and 70% said they hadn't received adequate training specifically on how to respond to a cyberattack. The study found that perhaps due to a lack of training, the 200 respondents in education felt 20 percent less prepared than their colleagues in government to handle a ransomware attack.

“When we talk about public education, over 1,200 individual schools were actually affected,” by cybercrime, Scott said. “Eighty-nine university, college, and school districts. But if the average school has 528 students, when you are talking public schools, that’s well over a half million students impacted by some form or ransomware or cyber attack. That is people not in school. Not having time to learn.”

The Harris Poll was conducted online between January 16 and February 3, 2020 among those with full time or part time employment in local or state government, IBM said.

One way leaders can help is to give employees permission to admit when they have made mistakes.

“What you want people to do is not feel threatened about a bad response,” Scott said. “You’ll get that. People will click on a link. They’ll think in the back of their head that it was bad, but they don’t want to report it and be thought of as the person who clicked the link. We have to get past that. We need to get people to talk about it, because the quicker they can get to the response, the less impact it will have.”

There is a growing sentiment among local workers that the federal government should bear some of the burden in helping cities and towns handle the threat. Scott said 78 percent of the 1,000 respondents felt the federal government should take a greater role in combating the problem, compared to 50 percent the previous year. A majority of those polled also believe the federal government should treat its response to ransomware like a natural disaster.