Mitigating the Risk of Ransomware Attacks against Government Entities

Government institutions are among the top targets for ransomware. In 2020, cyber attacks cost US government organizations about $18.88 billion in recovery costs and downtime. In 2021, the trend continued, with US government institutions suffering 79 ransomware attacks, which potentially impacted approximately 71 million people. These numbers highlight the fact that governments are at heightened risk from significant incidents⁠—especially the longer they wait to thoroughly and adequately mitigate the threat of ransomware. But in order to secure their systems and the valuable services they provide to all citizens, these institutions first need to understand why they seem particularly vulnerable targets.

Why Government Institutions Are a Top Target

1. They Hold Sensitive and Classified Data

State agencies are responsible for massive amounts of data, and much of it is sensitive and vital for national security as well as the security of individual citizens.

Some examples of the types of classified information agencies generate and manage include:

• Military activities
• The identities of terrorists and suspected terrorists
• Identities of intelligence agents
• Other critical issues pertaining to foreign policy and national security

Additionally, states generally maintain databases containing critical personal data from their citizenry. Individuals must supply this information when regularly interacting with agencies (when they file and pay taxes, apply for licenses, etc.)

All this stored information has tremendous value for potential cybercriminals. Nation-states may covet this data for intelligence purposes. Political parties or activists could benefit from breaches that damage their opponents or further their aims. Meanwhile, others cybercriminals might seek agency data for financial gain in the form of ransom payments.

When this information is compromised, stolen, or unlawfully disclosed, the consequences can be widespread and significant across multiple sectors. That is true, not least of all due to the symbolic importance that state agencies hold for their respective populations. Whenever there is a cybersecurity incident at the government level, it can shake citizens' confidence in their collective safety and the relative strength of their nation-state on the world stage.

The fear or uncertainty inspired by one of these attacks can itself be a goal or a benefit to the attacker. Foreign powers, activists, or terrorist groups could each have reasons to undermine a populace's faith in state agencies.

2. They Have an Extensive Attack Surface

States almost universally have a massive attack surface, meaning there are myriad points of vulnerability and potential exploitation throughout the sector. These points include the hundreds of thousands to millions of people, emails, devices, cloud applications, servers, and credentials that constitute state technological systems and infrastructure.

Bad actors need only to find and exploit a single weakness (such as a stolen or guessed username and password) to infiltrate a network. Once a piece of a system's security is compromised, the bad actors can rapidly take advantage of further vulnerabilities and magnify the scale of their attack.

The fact that many agencies still rely on legacy systems (old, outdated software, servers, computers, etc.) exacerbates this problem. Some agencies still run Windows 7 or an earlier version and have similarly aged client applications. Plus, it is not just a governmental department's own infrastructure that puts them at risk; it is also that of third parties. Trusted partners and contractors might suffer from many of the same deficiencies. Thus, they can extend the attack surface for governments even further.

The presence of legacy systems combined with insufficient funding and a short supply of security professionals adds up to a state of low cybersecurity readiness for many institutions. Chronic failure to invest in modernizing critical cyber structures means that many of these issues have become systemic.

3. They Operate Critical Infrastructure

Another reason cybercriminals target state institutions is because some of them operate critical infrastructure. Regional and local agencies, in particular, are frequently responsible for municipal facilities, transportation, communications, power supplies, and other essential services. Disruption of these vital functions due to ransomware attacks can have significant effects on individual constituents and local economies.

How Government Entities Are Responding to Cyberthreats

Given the severity of the ransomware threat, many governments are now taking more initiative in dealing with cyber threats. Below are several recent measures adopted by the US, UK, and Europe.

United States

The Biden administration has demonstrated an appetite for improved security against cyber threats for governmental agencies and American businesses alike. A few key initiatives worth noting are:

• Executive Order on Improving the Nation's Cybersecurity: This order mandates the adoption of stronger security standards at the federal level and improved communication between the private and public sectors concerning cyber issues.
• StopRansomware.gov: Stopransomware.gov is a website launched by several federal agencies that centralizes ransomware resources into one place instead of leaving them dispersed among multiple sites and departments.
• Joint Cyber Defense Collaborative (JCDC): The JCDC was formed in 2021 to spearhead cyber defense in the United States. It works with both the private and public sectors to protect national infrastructure and interests.

United Kingdom

The UK made cyber defense one of four main objectives in its 2021 policy paper on development, security, and foreign policy. It has established a National Cyber Force (operating under its Ministry of Defense), and the nation is prioritizing ransomware as a top governmental issue. In addition, the UK's National Cyber Security Centre has revised and renewed its guidance concerning attack preparedness and response.

Europe

In December 2020, the EU presented its new Cybersecurity Strategy. The document describes general aims such as enhancing Europe's resilience to cyberattacks. It also outlines concrete plans like installing rapid response security centers across the union and addressing cyber defense workforce shortages. It also envisions the formation of a Joint Cyber Unit in the near future, which would deftly respond to significant cyber incidents whenever they arise within the EU.

How to Mitigate the Risk of a Ransomware Attack

1. Reinforce Identity and Authentication

To improve their cybersecurity posture, government institutions should avoid total reliance on usernames and passwords as these are susceptible to brute-force attempts, phishing attacks, and other offensives. There are several methods for bolstering protection capabilities:

Single Sign-on

Single sign-on reduces the number of credentials needed to access a system down to just one, making it easier to secure, simpler to adopt, and straightforward to revoke when employees leave an organization.

Better Multifactor Authentication (MFA)

Implementing MFA can be a strong prevention strategy, but it is necessary to distinguish between the different options available. More advanced multifactor authentication requires public-key cryptography or biometrics (stronger methods than typical SMS codes and email notifications).

Risk-based Features for Authentication

Many modern authentication systems behave the same way every time, but smarter set-ups vary based on assessed risk. Programs and applications can integrate risk attributes like whether the attempt is coming from an untrusted network, unmanaged device, foreign country, or breaks the user's normal pattern in some other way. The system can then manage the extent to which it allows login attempts based on how suspicious they appear to be.

Unified Citizen Identity Service

A unified governmental identity service would simplify the way citizens interface with state agencies. Having a single identity to interact with makes it easier to enforce login protections. It also reduces the number of credentials needed and access points that cybercriminals could exploit.

2. Adopt Anti-phishing Solutions

Phishing is one of the primary vectors for multiple types of cybercrime, including ransomware attacks. Taking steps to prevent and mitigate phishing attempts will be essential to mitigating the threat of ransomware. Some areas where government institutions can implement anti-phishing solutions are:

Email Authentication

Governments should invest in email protection and strengthen authentication by implementing the three DNS protections: DMARC, DKIM, and SPF. They work together toward the prevention of sending and receiving unauthorized messages.

Searching for Known Threats

Organizations and agencies should remain aware of known threats and regularly scan messages and attachments for evidence of them.

Looking for Internal Phishing

Sophisticated campaigns like spear-phishing and business email compromises target individuals and can use internal, trusted accounts to extract funds and data or gain a stronger foothold in an organization.

Machine-intelligent Email Protection

Because cyber threats are continually evolving, governmental agencies need to keep up by investing in the latest and best protection available. Currently, the most advanced protection and prevention systems involve machine intelligence. Machine-intelligent programs are a form of AI and can therefore perform smarter and more comprehensive checks that go beyond searching for standard indicators of a problem.

In the realm of email protection, machine intelligence can be indispensable for guarding against spear-phishing, ransomware, and other emerging threats. Such programs will monitor email activity within organizations or agencies, understand and learn from routine patterns, and subsequently flag deviations from the norm. They can thus identify and stop any email threats before any damage is done.

3. Invest in Security Awareness Training

Technological solutions are essential to cyber defense but do not constitute the entire picture. For those systems to be effective, they need to be supported by well-trained employees, managers, executives, and officials. Agencies must appropriately update their training for the current context of cyber threats, and they should administer it regularly to prevent anyone from falling behind. Security awareness training can be implemented via training campaigns, testing and assessment, and organizational processes.

Conclusion

Governmental entities are a prime target for ransomware because of the almost endless supply of valuable data they maintain and their significance for critical infrastructure and symbolic safety. Nation-states and their agencies are also particularly vulnerable to these attacks due to outdated systems, multiple points of weakness, and an insufficient cyber professional labor supply, among other deficiencies.

While the central administrations of various countries have announced new cybersecurity measures in recent years, much work remains. Governmental agencies everywhere can benefit from adopting a comprehensive security strategy. Making changes like updating authentication standards for most systems, adopting machine-intelligent solutions for email security, and investing in widespread security training will go a long way toward strengthening citizen protections and, ultimately, national security.

If you’re looking to protect your organization against ransomware attacks, xorlab ActiveGuard can help. Get a look at how the solution can work for you with a free demo.