Hot Topics in Cybersecurity Day 1: Responding to Ransomware

Ransomware is one of the biggest cyberthreats facing government at all levels in the U.S. According to the Federal Reserve Bank of St. Louis, there were 90,837 local government entities in 2022. A 2024 study found that ransomware attacks against state or local agencies declined in last year – only about a third of study participants said their agency had been hit by such an attack. While this is far better than 2023, when 69% of participants said their agency had been targeted, it still means almost 31,000 agencies had to defend themselves. And almost all the attacks attempted to compromise the agencies’ backups.

The federal government has been aggressive in responding to ransomware across all sectors, both public and private. The FBI has a web page dedicated to the topic and a guide to existing best practices and mitigation strategies; the Federal Trade Commission offers guidance to small businesses. The Cybersecurity and Infrastructure Security Agency (CISA) offers a one-stop portal for information and assistance in dealing with ransomware and set up a Joint Ransomware Task Force for coordinating, deconflicting, and synchronizing efforts to combat ransomware across federal, state, local, tribal, territorial, private sector, and even international partners.

Learning Objectives:

• Review the role of encryption in protecting against ransomware, including understanding end-to-end communications channels to identify which devices are not encrypted
• Delineate your agency’s policies and practices regarding data backups (how frequently they should happen, criteria for prioritizing the systems and devices, etc.)
• Outline how your agency can get assistance from law enforcement to remediate a ransomware attack