El Dorado County (Feb 15, 2024) – As small towns across the USA bask in the charm of their bustling main streets and close-knit communities, they face an increasing threat from cybercriminals targeting critical infrastructure. In 2024, these locales are proving to be prime targets, with devastating cyberattacks disrupting essential services. Recent incidents in Huber Heights, Ohio, Cullman, Ala., and Scotland, Conn., underscore the vulnerability of smaller municipalities, often lacking resources to combat cyber threats effectively.
While headlines often focus on cyberattacks against major corporations and federal agencies, attacks on local infrastructure can be equally crippling. The high-value nature of small towns makes them attractive targets, especially considering their reliance on public services. The inability to dispatch first responders, inaccessible financial accounts, and offline control systems in utilities or hospitals highlight the severe consequences.
The rising frequency of attacks on smaller cities begs the question: why target them? The answer lies in their significant population share, as 76 percent of the approximately 19,500 incorporated places in the U.S. have fewer than 5,000 residents. With residents heavily dependent on public services, these municipalities are more likely to pay hefty ransoms to restore their systems quickly.
Despite the lack of federal resources for every incident, state and local levels offer assistance. Bladen County, N.C., faced a major cyberattack and successfully rebuilt its IT systems with the help of a multidisciplinary team, showcasing the importance of collaborative efforts. Public-private partnerships, like InfraGard, connect local governments with resources, training, and education to bolster cybersecurity defenses.
The need for collaboration extends beyond government agencies to include critical business sectors. Taking inspiration from New York City’s model, where a voluntary task force was convened to share cybersecurity intelligence, such partnerships enhance cyber resilience across sectors. Urgent action is required to fortify the cybersecurity defenses of small communities, ensuring trust in public institutions and safeguarding the essential services powering the nation.
The good news is there are several straightforward steps local governments can take related to planning and preparation:
- Create a network diagram and data map, which will lay out how data is collected, used, stored, shared and integrated within an IT framework. This can help identify risks and implement security measures commensurate with the volume and types of data used.
- Set rules for retention and deletion of data and implement privileged access management solutions. This helps to ensure data isn’t kept longer than needed and is accessed only by those whose jobs require it.
- Review available or existing cyber insurance and related policies to consider whether coverage is adequate. There can be unique issues for public agencies looking to insure themselves against cyber risk, and some carriers may not offer policies given the risk profile. Municipal and other small government entities may want to consider self-insuring or explore other alternatives to traditional cyber insurance.
- Take advantage of available resources to make sure they are following best practices, staying on top of software vulnerabilities and implementing patches as needed. The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) coordinate with other agencies to distribute current and actionable information on the cyber threat environment and best practices. To give just one recent example, the FBI, CISA and the Environmental Protection Agency released a joint press release to assist owners and operators of water and wastewater systems with best practices for responding to a cybersecurity event.
