<a href="https://www.nytimes.com/2018/03/27/us/cyberattack-atlanta-ransomware.html?mtrref=www.google.com">“We are dealing with a hostage situation.”</a>
On March 22nd, Mayor Keisha Lance Bottoms and the citizens of the City of Atlanta awoke to a ransomware cyberattack that had compromised <a href="https://www.atlantaga.gov/government/ransomware-cyberattack-information">“multiple applications and client devices”</a> in the City. The list of the affected includes billing systems, the court system, and <a href="https://www.wired.com/story/atlanta-ransomware-samsam-will-strike-again/">“vital communications like sewer infrastructure requests.”</a> The attackers, believed to be a group notorious for using SamSam ransomware, locked these systems and demanded six-bitcoin  (roughly $51,000).
Over three weeks later, Atlanta Information Management (AIM), the City’s information technology department, is still working to restore service. Residents in Atlanta <a href="https://www.cnn.com/2018/03/27/us/atlanta-ransomware-computers/index.html">“can’t pay their water bill or their parking tickets”</a> while City employees are using paper forms to ensure the continuity of vital services. This attack is estimated to have cost the City <a href="https://www.wsbtv.com/news/local/atlanta/ransomware-attack-cost-city-27-million-records-show/730813530">$2.7 million</a>.
With recent attacks across the country and globe, such as <a href="https://www.nytimes.com/2018/03/15/technology/saudi-arabia-hacks-cyberattacks.html?action=click&amp;module=Top%20Stories&amp;pgtype=Homepage">the cyberattack in Saudi Arabia</a>, and the <a href="https://www.nytimes.com/2018/04/04/business/energy-environment/pipeline-cyberattack.html?mtrref=www.linkedin.com&amp;mtrref=www.nytimes.com&amp;gwh=DDF7F5F7DB17A5805B098D2750BA4A66&amp;gwt=pay">apparent weaknesses</a> of other important systems in the United States, it’s more pressing than ever to question whether your community or organization is prepared for a cyberattack. Often, it is not a question of whether a cyberattack will happen but whether your organization will be prepared to respond and to limit the damage when one does occur.
Hagerty’s Cyber Nexus Approach to Cyber Program Management
<figure id="attachment_4837" aria-describedby="caption-attachment-4837" style="width: 1600px" class="wp-caption alignnone"><a href="http://hagertystg.wpengine.com/wp-content/uploads/2018/04/59d3fffe97fdc100010a1ad5_DNA-03-p-1600.png"><img loading="lazy" decoding="async" class="wp-image-4837 size-full" src="http://hagertystg.wpengine.com/wp-content/uploads/2018/04/59d3fffe97fdc100010a1ad5_DNA-03-p-1600.png" alt="" width="1600" height="535" srcset="https://hagertystg.wpengine.com/wp-content/uploads/2018/04/59d3fffe97fdc100010a1ad5_DNA-03-p-1600.png 1600w, https://hagertystg.wpengine.com/wp-content/uploads/2018/04/59d3fffe97fdc100010a1ad5_DNA-03-p-1600-300x100.png 300w, https://hagertystg.wpengine.com/wp-content/uploads/2018/04/59d3fffe97fdc100010a1ad5_DNA-03-p-1600-768x257.png 768w, https://hagertystg.wpengine.com/wp-content/uploads/2018/04/59d3fffe97fdc100010a1ad5_DNA-03-p-1600-1024x342.png 1024w" sizes="(max-width: 1600px) 100vw, 1600px" /></a><figcaption id="caption-attachment-4837" class="wp-caption-text">Hagerty&#8217;s CNA strategy ensures that emergency management teams (including law enforcement and public safety officials) and information technology teams interact at critical points before, during, and after a cyber disruption in order to implement a coordinated response.</figcaption></figure>
As these recent incidents exemplify, attackers can disrupt both virtual and kinetic systems, causing massive disruptions to daily life, which is why cyber incidents are not just an issue for your information technology department. For this reason, Hagerty’s <a href="https://www.cyberthreatready.com/">Cyber Nexus Approach</a> (CNA) emphasizes the need for coordination between emergency management partners and information technology partners on a continuous basis.
<ol>
<li>Pre-Incident. To effectively prevent, respond to, and recover from cyber disruptions, emergency management and information technology partners must first collaboratively establish and test plans for managing complex cyber incidents. A collaborative planning, training, and exercise process establishes important relationships and reveals strengths and areas for improvement related to cyber incident preparedness, response, and recovery.</li>
<li>Incident Response. A response that is coordinated across emergency management and information technology is a streamlined response. Coordination will ensure that each team is aware of overlapping operations while performing their functional missions, thereby minimizing or eliminating unnecessary duplication of efforts.</li>
<li>Post-Incident. Coordinated recovery and mitigation operations will facilitate the restoration of virtual and physical systems, ultimately supporting the jurisdiction’s ability to recover quickly and strengthen future response operations.</li>
</ol>
Enhancing your jurisdiction’s cybersecurity program requires collaboration across primary and secondary response partners to make sure a cyber “hostage situation” does not impact your community.
Caroline Brown is an Operations Associate at Hagerty’s Headquarters in (sometimes) sunny Evanston, IL, where she supports the development of technical proposals issued by federal, state, and local governments across the country. Ms. Brown also leads Hagerty’s <a href="http://hagertyconsulting.com/about-us/newsletter/">Disaster Discourse Monthly</a>, a newsletter that curate news about innovations, advancements in technology, and groundbreaking practices in the emergency management space. When she’s not writing for Hagerty, Ms. Brown is a <a href="http://www.carolinejbrown.com/">freelance illustrator</a> and dog spotting enthusiast.
&nbsp;
&nbsp;
&nbsp;

The “Hostage Situation” in Atlanta and Hagerty’s Integrated Approach to Cyber Preparedness

Steve Hagerty Selected for FEMA’s Vanguard Executive Crisis Leaders Fellowship

Bird Flu and Beyond: Preparing Our Nation’s Healthcare System

Preparing for Increasing Climate-Driven Hazards

The Hagerty Advantage – Our People: Jessi Widhalm, Tori Abbott, Meagan Flanagan, and Joely Bertram

Blizzard Conditions Impact The West Coast While Record Breaking Wildfires Affect The Texas Panhandle

Migrant Arrivals: Local and State Response and the Role of Emergency Management

Atmospheric River Brings Extreme Flooding, Winds, and Mudslides to California

The Hagerty Advantage – Our People: Andrew Bohnert, Marina Conner, Harrison Newton

Extreme Winter Weather Continues To Impact Nearly 80 Percent Of The US With More Winter Storms To Come

Extreme Winter Storms Impacting Large Portions the US with More Severe Weather on the Way this Weekend