Ransomware Readiness for Local Government and Public Safety
Ransomware attacks on cities, counties and public safety agencies keep making headlines. Here's how to reduce your risk and be ready to respond.
Ransomware has become one of the most disruptive threats facing state and local government. When an attack succeeds, the impact goes well beyond IT: dispatch centers fall back to paper, records become unavailable, payroll stalls and residents lose access to services. For public safety agencies, downtime isn’t just inconvenient. It can affect response.
The good news is that most ransomware incidents begin with a small number of familiar weaknesses. Closing those gaps, and planning for the day something gets through anyway, puts your organization in a much stronger position.
How attackers usually get in
Most ransomware incidents start in one of a few ways:
- Stolen or weak credentials, especially on remote access tools and email accounts without multi-factor authentication
- Phishing emails that trick a user into opening a malicious attachment or entering their password on a fake login page
- Unpatched internet-facing systems such as VPNs, firewalls and remote desktop services
- Third-party access from vendors or contractors whose own security is weaker than yours
Once inside, attackers often spend days or weeks quietly moving through the network, finding backups and copying sensitive data before they encrypt anything. Many now threaten to publish stolen data, which adds pressure even when systems can be restored.
Six steps that make the biggest difference
1. Turn on multi-factor authentication everywhere you can. Start with remote access, email, administrator accounts and any system that holds sensitive or criminal justice information.
2. Keep backups offline and test them. Backups that sit on the same network can be encrypted along with everything else. Keep at least one copy offline or immutable, and regularly test that you can actually restore critical systems, and how long it takes.
3. Patch what faces the internet first. Prioritize VPNs, firewalls, email servers and remote access tools. Remove or restrict services that don’t need to be exposed at all.
4. Limit administrator privileges. Use separate admin accounts, give people only the access they need, and monitor privileged activity closely.
5. Train your people. Short, regular phishing awareness training helps staff recognize and report suspicious messages before they click.
6. Know your vendors’ access. Inventory every vendor connection to your network, require MFA for it, and turn it off when it isn’t needed.
Have a plan before you need one
An incident response plan should answer practical questions ahead of time. Who makes decisions? How will you communicate if email is down? Which systems get restored first? When do you call law enforcement, your insurer and legal counsel? For public safety, the plan should also cover how dispatch and records will operate in manual mode.
Federal partners offer free guidance. CISA, the FBI, NSA and the MS-ISAC updated their joint #StopRansomware Guide in May 2023 with prevention best practices and a response checklist, and the federal agencies behind it advise against paying a ransom. State and local governments can also join the MS-ISAC at no cost for threat information and support.
How GTEL can help
We help agencies assess their security posture, prioritize the fixes that reduce the most risk, implement security controls and train staff. For criminal justice agencies, we do this with CJIS requirements in mind from the start. Contact us to talk about where your organization stands today.
Resources: CISA StopRansomware · MS-ISAC
