When we think of the targets of malevolent digital threats, we consider the financial sector. We think of identity theft. But do we consider the wild importance of energy cybersecurity?
11/23/2018
Nobody is unaware of the importance of cybersecurity in today’s cloud-based world. But that doesn’t mean that you wouldn’t be nervous or surprised when you hear about the issues that municipalities and public utilities face in the world of cybersecurity.
Why would anyone want to hack into your local government? Or the companies that provide your home with electricity, water, or natural gas?
The reality is that these companies have everything that a hacker would want, including sensitive information about millions of people, such as their addresses and their payment information.
Security incidents in the world of municipal governments and utility companies are becoming more prevalent with every year that goes by. Which leads us to the question: what are the biggest security vulnerabilities among municipalities… and what can be done about them?
Lack of staffing
Most local governments and utility companies just don’t have adequate staffing to deal with a cyber attack. In some smaller governmental institutions and utilities, there may be as little as one person managing all of the cybersecurity! This simply isn’t enough, especially when you consider how much data they’re actually trying to protect. One solution to this would be an increase in funding to increase cybersecurity staff. Another, perhaps more cost-effective solution, would be to outsource security to a professional security partner.
Lack of planning
Another issue is a lack of planning, and a lot of local councils and utility providers simply don’t have any backup options when faced with a security incident. The lack of staffing may be a factor here, as one individual would have a hard time putting together detailed cybersecurity plans for the data of a whole utility company. But establishing a thorough security incident management plan is essential.
Lack of funding
In many past cases, (which we’ve witnessed firsthand,) both municipalities and utility providers have been guilty of simply not putting the cash aside for cybersecurity. Ultimately, a lack of funds and investment in the essential tools and personnel can really leave a company exposed to potential cybersecurity incidents and attacks. Yet many of the people in charge simply aren’t making the necessary investment in their security architecture. Where spending does get funneled into IT departments, it may be focused more on operational issues rather than security.
Weak passwords
Some municipalities and utility companies are guilty of using simple passwords. If there is no system in place to remind people to change their passwords every so often or ensure that the passwords strong enough, it could leave thousands of consumers’ personal data exposed to unseen threats. If these organizations want to increase their security, then password strategies must be improved.
Avoiding the cloud
The Cloud is a great tool for any business. No more filing cabinets, or keeping all of your documents on old local hard drives. However, local governments and utility companies aren’t actually utilizing it, due to misplaced fears of its reliability or just plain unwillingness to invest in new technology procedures. Instead, they’re still keeping a lot of their data on workplace computers. This means that hackers can find the information much more quickly, and getting rid of malware may also mean getting rid of all of the data.
Lack of email encryption
Emails are probably one of the easiest ways for hackers to get into the most sensitive information about an organization. Some email hosting services are more vulnerable to this than others, but regardless, a business or institution should have some form of encryption on their emails. Encryption codifies data so that hackers cannot see the message or files that are being sent. For example, if a utility company sends you a bill with all of your information on from an unencrypted source, then your home address and payment details could potentially be seen by a hacker.
What can be done?
Municipalities and utility companies can do many things to protect themselves from these threats, but the truth is that the funding does need to be there if local governments and municipalities want to bring their security systems up to snuff while keeping them in-house. Staffing and training a cybersecurity team is an expensive and timely proposition, and on-prem installation of crucial tools like SIEM (Security Incident Event Management) software is not without cost. Many organizations simply cannot afford to have in-house security team members. However, there is another option: managed detection and response.
With BitLyft AIR®, you can secure your critical infrastructure without the need for costly in-house resources. Let our team of cybersecurity experts protect your systems and data, so you can focus on serving your community. Get started with a free demo of BitLyft AIR® and see how you can safeguard your municipality's digital assets.
