Ransomware is Pressuring Public Services

 

The FBI and CISA has indicated that ransomware attacks are becoming a safety risk to public services as they are attractive targets to cybercriminals due to their critical nature. Public services such as utility companies, emergency services, safety operations, healthcare and the education sector are being increasingly targeted and sensitive personal data is being stolen which is putting local residents at risk of fraud.

Local governments will see no decline in these attacks as the deployment of malware continues to evolve. The FBI explained a ransomware attack in January of this year forced a US county to take down their computer systems and enact an emergency response through their backup procedures. The county jail was targeted which meant surveillance cameras were deactivated along with the jail’s data collection capabilities, automated doors, and internet access. This obviously caused alarm amongst employees and resulted in significant safety concerns for the facility.

There are plenty of other examples too, including an attack in September 2021 that closed a county courthouse and the attackers subsequently leaked personal details of employees and residents online after the ransom wasn’t paid. And in May 2021, several local governments were infected with a ‘PayOrGrief’ ransomware attack that led to servers and online services becoming inaccessible.

According to the report, only academia and higher education facilities were attacked more frequently than local government services in 2021. The FBI has restated several times that victims should not pay any ransom demands because it may encourage further attacks. However, some targets decide to pay so they are able to quickly restore their services.

After paying the ransom though, restoring a network can be a complicated and long task to complete, and there is no certainty that the decryption key provided by the hackers will work or that they won’t return later. The FBI encourages all victims to report any ransomware incident to help prevent future attacks.

They have also recommended numerous cybersecurity measures [PDF] that businesses can enact to help prevent becoming a victim, including keeping software and operating systems up to date with the latest security patches, and requiring strong passwords for online accounts. This makes it harder for criminals to exploit network and system vulnerabilities and guess user passwords.

In addition, organisations should keep offline backups of their data that are regularly tested and updated so networks can be restored without decryption keys. Employees should require the use of multi-factor authentication for their webmail, accounts, and VPNs to add an additional layer of protection against such attacks.

Data Literacy Isn’t Keeping Pace

 

Many businesses store data on 6 different platforms on average as data continues to double in size, but many of the employees at these companies are not confident in their ability to fully utilise these platforms as data literacy fails to keep up. Executive leaders believe over 50% of their employees are data literate, while only 11% of the employees agree to this and 45% relied on their own instincts rather than data when making decisions.

This data was provided by a recent Qlik data literacy report which surveyed over 1,200 executives and 6,000 employees from all over the world. While it seems employees wish to increase their data literacy, only 27% have actually had formal training with hands-on exercises. Many workers in finance, marketing, sales, and customer service admitted that they needed to improve their data literacy far more than the training that was provided to them and there was a feeling amongst many employees that employers did not feel responsible for delivering this training.

Executives have focused the training on people working in roles that specifically relate to data such as data analyst or scientists (58% received training), and less so for people working in finance (11%), marketing (10%), and sales (9%). This means entire departments and lines of business are behind others in terms of data literacy and this can lead to a reduction in enterprise value. The data suggests enterprises with higher data literacy can have higher enterprise values by up to $534 million. The focus on data literacy will only increase as well, as many company leaders that were surveyed believed new positions such as ‘Chief Metaverse Officer’ and ‘Workplace Environmental Architect’ will be introduced to their businesses within the next decade.

The Qlik report recommends organisations push a data-literate culture using active intelligence systems and embrace continual learning in order to keep pace. They also recommend democratising tools and literacy amongst all employees, promoting trust in the data, and using data for perpetual improvement and positive change within the organisation.

Another report by Red Hat and Starburst found businesses used an average of 4-6 data platforms and up to 12 different data systems. These trends are only projected to continue rising in 2023. As data becomes more spread over different systems, complexity and security risks rise too. Respondents that were surveyed recommended automating IT and data operations, implementing search tools across multiple platforms, and utilising AI and BI platforms to sift data and make recommendations in order to get these data systems to work together.

The volume of data being stored is also significantly increasing as streaming, video, event data, IoT, and image data is being collected on a far greater scale than previously. The survey identified many priorities for accessing real-time data including customer and employee engagement, real-time changes in risk and market shifts, and engagement on mobile applications.