State and local digital infrastructure is rife with vulnerabilities

Over the past year, state and local government authorities have rightfully devoted their energies and their budgets to fighting the coronavirus and providing services to those impacted. It’s been a difficult fight, full of challenges, and it’s not over yet.

It seems doubly cruel that in the midst of the pandemic, governments have been forced to deal with cyberattacks that have interfered with their ability to deliver essential services to their constituents. Following a virus attack in September 2020, for example, police officers in Key West, Fla., were forced to use pen and paper for their reports until servers could be rebuilt and IT systems restored.

Then in November, Delaware County, the fifth most populous county in Pennsylvania, was hit with a ransomware attack that disrupted significant portions of its network. The perpetrators had access to networks containing police reports, payroll, purchasing and other databases. The threat actors demanded -- and eventually received -- a $500,000 ransom in exchange for a key to decrypt the systems held for ransom.

Fortunately for Delaware County, its emergency services department was not part of the affected network. However, the threat does go beyond just government, impacting critical infrastructure as a whole. The ability to disrupt emergency medical services is giving attackers extra incentive to target the country’s public-sector and health-care organizations in the hopes of scoring even larger payouts.

For instance, this past October, just as COVID-19 cases began to surge, heartless attackers used ransomware to disable computer systems at health-care facilities in Oregon, New York, Vermont, Michigan and Wisconsin. The attacks on this critical infrastructure could potentially result in tragic outcomes as has already been observed in other parts of the world.

Most of these cyberattacks -- whether or not they involve ransomware -- make their way into environments by first exploiting vulnerabilities in completely different parts of an organization. Recently we found out about the large supply chain SolarWinds campaign that was used as a vector into both commercial and public-sector entities.  Remote attackers often exploit unpatched servers, misconfigurations, compromised credentials and other conditions that demonstrate poor security  hygiene.

As an example, Atlanta was the subject of a massive cyberattack in March 2018. Caused by ransomware, the attack was notable for both the extent and duration of the resulting service outages. Prior to the attack, a January 2018 IT audit uncovered 1,500 to 2,000 vulnerabilities in the city’s systems, which left the infrastructure open to attack.

The Atlanta government was criticized for failing to upgrade equipment, which could have prevented the successful attack. City authorities blamed the inaction on a lack of funding -- certainly something every agency can relate to today. 

The national election infrastructure is vulnerable

The recent 2020 election also put a huge spotlight on the security of the digital infrastructure that underpins voting systems. Rather than being one monolithic system that is centrally controlled, the technology used to support elections is actually owned and operated by thousands of individual state and local government agencies. This means the equipment and systems are managed locally, and likely with vastly differing levels of security hygiene.

As a security  practitioner, I wondered whether there could be vulnerabilities in these systems that put our elections at risk of unintended manipulation.  Together with our team of cyber threat researchers, we took a non-partisan, purely technical approach to evaluating the risk in the attack surface of these systems. We only used publicly available information to identify the external facing infrastructure that could be targeted and infiltrated by an outside attacker.

We found many common vectors for ransomware and other destructive attacks to gain entry into the state- and county-run systems. For example, there are thousands of internet-facing applications, many of which appear to be running vulnerable and out of date software. Some of the systems expose services like Kerberos, which have been previously exploited in attacks such as WannaCry and ZeroLogon.

Fortunately the Department of Homeland Security declared the 2020 election to be one of the safest and most secure in recent history. But the fact is, the vulnerabilities remain and must be addressed to reduce the risk of cyberattacks in future election cycles. There are still many adversaries looking to wreak havoc at all levels of government and the focus on cybersecurity around the election should serve as a  clear call to shore-up cyber defenses.

The coffers for cybersecurity are empty

Perhaps the main hindrance to securing digital critical infrastructure is lack of funding. Cities and states are undergoing severe budget crises due to dramatic revenue declines during the pandemic and uncertainty about federal aid.

Congress recognizes the need to help fund cybersecurity at the state and local level but hasn’t yet codified the aid into law. In 2019, the Senate passed the State and Local Government Cybersecurity Act designed to create grants and other programs to help states and localities fend off ransomware attacks and other threats. In 2020, the House passed its own bill, the State and Local Cybersecurity Improvement Act, also creating a federal grant program to go toward state and local government cybersecurity efforts. Despite the similarities of the bills, neither has yet passed into law, thus leaving states and municipalities without federal funding in the foreseeable future.

This highlights the unfortunate reality that agencies either don’t prioritize the threat correctly or don’t have the money -- or the technical expertise -- to address the dire need to harden their computing environments on their own. This conundrum might need a collective approach to finding a solution -- perhaps public/private partnerships or grants from private sources.

Goldman Sachs CEO David Solomon, who views cybersecurity as a significant problem that poses a threat to critical infrastructure and the economy, agrees. "I think more coordination between companies and government on this issue is super important," he said.

One thing is certain: doing nothing to enhance cybersecurity of public infrastructure will only grow the vulnerabilities and continue to put vital services at risk.