[av_textblock size=” font_color=” color=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” admin_preview_bg=”]

Don’t let your data get held hostage: Avoiding a ransomware attack? 

Most of our global economy is stuck in idle at the moment, but hackers never rest. The pace of cyberattacks, including ransomware, picked up speed last year and has continued this year. The bad news: State and municipal agencies are increasingly the subject of ransomware incidents, in which hackers seize control of the agency’s data and block access until they are paid a sum, often in bitcoin.

Ransoms can run into the equivalent of hundreds of thousands of dollars. If the ransom is not paid, the hackers theoretically erase years’ worth of data, with obviously disastrous results. In some cases, entire networks, including those serving critical functions, were shut down completely for days, or even weeks.

Public housing authorities (PHAs) have been targeted in ransomware attacks, though few are anxious to talk about it, understandably. Unfortunately, public housing offices can be an easy mark, as they face budget constraints and pressure to do more with less. Oftentimes cybersecurity is the first area to suffer when cuts are required. Indeed, outdated IT infrastructure, inadequate data-backup processes and difficulty in retaining experienced IT security staff have put PHAs at a distinct disadvantage. Smaller agencies are more vulnerable than larger ones, which have more funding to use in an emergency.

Recently, one of our customers was hit with a ransomware attack that struck not only its servers but its backups, as well. As you can imagine, this was a major disruption to the PHA’s operations. When the PHA approached us for assistance, we assigned an incident team which was able to locate back-up data that we used for restoration. Working together, we were able to get the PHA’s operations up to full performance within just a few days.

That’s better than many PHAs do. When a ransomware attack takes a housing authority offline, it can’t execute key functions such as paying landlords, collecting money or making submissions to its voucher management system in order to maintain HUD funding. With no electronic access, PHAs have to resort to paper processes, which are cumbersome and prone to errors. The consequences of not being able to do these core functions can quickly become dire. While trying to recover data from a backup, it can be difficult to know if the data is valid, another major problem.

Here are some basic tips to share with your PHA employees for avoiding a ransomware attack:

• Do not click on any email attachment that is unexpected or from a new sender. Make sure your whole staff understands the potential consequences of opening attachments.
• Do not provide personal information when answering an email, unsolicited phone call, text message or instant message.
• Use reputable antivirus software and a firewall.
• Set your system to do automatic malware scans of attachments that come onto the network. Consider disallowing executable or very large files.
• Consider putting an “airlock” around your agency’s executive staff, so they are unable to open attachments. Hackers often target the director level, so restricting access can stop or at least slow down cybercriminals.
• Make sure all of your software systems are running the latest security patches.

Beyond these basics, consider using a version of your PHA system that is hosted in the cloud, just like Emphasys offers its customers. Hosting removes the hassle of doing backups and maintaining the software. And should you become the target of a ransomware attack, a hosted system is easier and faster to restore.
[/av_textblock]