Linkedin
Facebook
Email
more
Are you scared of being a victim of ransomware? Are you wondering how you can protect your government agency from a ransomware attack?
Hardly a day goes by where we aren’t reminded of the threats posed by nefarious online entities seeking to steal proprietary data from Australian businesses and government agencies…and for good reason.
The latest report from the Office of the Australian Information Commissioner (OAIC) shows ransomware incidents increased by 24% in the first half of 2021, with government agencies among the top 5 sectors to notify the Commissioner of a data breach.
However, the report also revealed that only 71% of agencies identified a breach within 30 days. 65% took more than 30 days to report it.
The OAIC report follows a string of high-profile attacks targeting government agencies this year, including NSW Health, Eastern Health in Victoria, the WA Parliamentary Email Network, and NT Health, among others.
The events of COVID-19 have left the door wide open for cyber attackers, with greater numbers of people accessing secure systems from home – while being under pressure to maintain productivity at a time when following normal processes and procedures may have been impossible.
Coupled with the accelerated use of technology and massively expanding collation of data, there’s little wonder why hackers are attempting to make hay while the sun shines.
In particular, for the public sector, taking comprehensive measures to prevent an attack is crucial. Not only are there potential compliance repercussions of a data breach, but financial and reputational consequences that can be very difficult to recover from.
For example, one study on ransomware attacks (where hackers lock down information until a ransom is paid) found that two-thirds of the Australian organisations surveyed had suffered a ransomware attack in 2020, with one-third choosing to pay the ransom at an average of $1.25 million.
In addition to the immediate financial impact, there’s a reasonable chance that the attack will happen again.
Other financial impacts often include difficulty securing insurance, higher insurance premiums, and possible fines for breach of data privacy laws.
With this in mind, here are 3 tips every government agency should consider when evaluating their likelihood of a targeted attack…
1. Take it as seriously as hackers do
The entities that conduct cyber attacks are much more sophisticated than people may realise. Not only are they incredibly well-funded, but they also invest in technologies far beyond what the average business would consider to be advanced.
Luckily, protecting your systems doesn’t have to mean investing millions in the latest security hardware and software – but rather, selecting the right hardware and software to address key risks specific to your agency.
This is why it’s essential to conduct a full audit of IT systems and a thorough risk analysis, which will help you determine where money is best spent to provide maximum protection.
2. Invest in quality security architecture
People are often the biggest risk within an organisation, with 25 of the 34 government agency data breaches reported to the OAIC due to human error.
Developing a security architecture that accounts for these vulnerabilities is critical – be it through superior email filtering, role-based access controls, two-factor authentication, endpoint protection, and other security measures.
No single measure is ever truly effective in itself. The key is to design a quality security architecture that closes gaps and minimises the likelihood of error and a range of other risks.
3. Have a solid disaster recovery plan
In the event of an attack, there is the potential for your backups to be compromised. Modern cyber attack techniques frequently lay dormant until they find the perfect time to strike, which may be after they have found a way into your backup systems.
For this reason, consider housing backups in a secondary location. While it may add to the ongoing cost of your security, it will also boost the chances that you can restore data that was saved before the attack so you can circumvent the need to pay a ransom.
Let our security team manage the complexity and risk for you
At RSM, our managed IT services team takes the complexity and risk out of evaluating, planning for, and managing your IT security.
We can conduct a full audit of your agency’s systems and vulnerabilities, and design a fit-for-purpose security architecture designed to significantly reduce the potential for an attack. We then oversee the entire system for you, to ensure your security measures are always up to date and any issues are addressed quickly.
If we do detect a problem, our skilled security team will analyse the vulnerability and provide timely advice on how to mitigate it.
As a vendor-agnostic solutions provider, every security element we recommend is completely tailored to your agency and its unique risks – ultimately giving you peace of mind that your systems are protected when it matters most.
The threat of ransomware is very real and can affect every aspect of your business or government agency. To learn more about RSM’s Managed IT Security services, simply contact your local RSM office.
