Loading...
9.1 SR 07-20-2020 Request for Action To Item Number Mayor and City Council 9.1 Agenda Section Meeting Date Prepared by Work Session July 20, 2020 John Dietz, Mayor Item Description Reviewed by Cyber Ransom Committee Cal Portner, City Administrator Reviewed by Action Requested Discuss and provide staff direction. Background/Discussion An Elk River business was the victim of cyber ransom case about one year ago. The owner came to the city for help. The city IT Manager, who felt strongly that the city should go to the affected business site and try to help them out of the mess, told the business owner he would ask his supervisor, the finance director, and the city administrator if he could help on city time with city resources. Both the finance director and the city administrator denied the request citing it did not meet Minnesota Public Purpose Expenditure Law requirements and would expose the city to legal liability. Mayor Dietz received an email request from the businessman asking for the city to establish a Cyber Ransom Team. The outline of the team is as follows: • To assemble a team of both public and private people (about 3-6 people) • Work with the team to build materials and resources to help businesses protect themselves from Cyber Ransom • Deploy this information to all the businesses in our community • Meet quarterly to discuss and update material • Connect with businesses in the area and help them prepare • Make the team available to help these businesses basically for the first 24-48 hours or until we can get them handed off to the right people. Here is an additional comment from the businessman: “There is much to do in the first 24 hours of the ransom, if you handle it wrong, it may affect a positive outcome. I find it sad that these crimes are so large and we have no one available from the local police or county to help. Our IT team at the City of Elk River is trained on this. I asked them. I'll bet they are at the county level also. We could help our community so much with your support on this. It's so simple. They need some basic hardware and software, some information on what the next steps are and some hand holding. This would not be expensive or complicated. All I need from you two (Sheriff and Mayor) is approval to work with your IT staffs.” Mayor Dietz told the businessman he would do some research on this topic and get back to him. His main issue was using city personnel to work on private business computers. The Elk River Vision A welcoming community with revolutionary and spirited resourcefulness, exceptional service, and community engagement that encourages and inspires prosperity The businessman reached out to the County Sheriff for help when the Mayor didn't immediately get back to him. The Sheriff sees this more as an informational issue, not one that would involve government personnel. The Sheriff said: (he has) “some staff working on some best practices and guidelines for these types of situations. Many of which you are unfortunately aware of and have provided valuable feedback and insight from your victimization. When it's complete, I will email out to everyone. I think this is a good starting point for future conversations and strategy.” The Mayor reached out to the League of Minnesota Cities to get their take on city employees working on computers of private businesses. Following is the response from Dave Unmacht, Executive Director: “Mayor, I consulted with four staff members, two attorneys, my CIO and a former (and well respected) law enforcement officer who works in loss control. None of us have heard of a city providing IT support for a business. I have been around many years and this is not anything I have heard of or would support. Our Research Manager offered this quote: 'I do not know of any cities that provide this service. Not sure it would meet the public purpose expenditure test since it's for a private benefit. The police likely have a role in investigating the crime, at least initially, but fixing the problem seems out of the city's authority. And a potential for liability—if they don't 'fix' the problem and it happens again, will the business want them to be responsible for the loss. Our CIO knows of cyber-security firms that can advise local governments and businesses. Let me know if you want to talk to them.” The Mayor told the businessman that he would bring this to a Council work session this summer for discussion. Financial Impact N/A Attachments  Hostage Rescue Manual  SCSO Ransomware Letter O P J U J E F ! E F T J W F S SBOTPNXBSF Iptubhf!Sftdvf!Nbovbm Xibu!Zpv!Offe!up!Lopx!Up!Qsfqbsf boe!Sfdpwfs!gspn!b!Sbotpnxbsf!Buubdl SBOTPNXBSF;!Iptubhf!Sftdvf!Nbovbm Jouspevdujpo 2/Xibu!jt!Sbotpnxbsf@ ”Uif!bebhf!jt! d/Dszqupnjojoh usvf!uibu!uif! 3/Bn!J!Jogfdufe@ tfdvsjuz! 4/J“n!Jogfdufe-!Opx!Xibu@ tztufnt!ibwf! up!xjo!fwfsz! 5/Ofhpujbuf0Qbz!Sbotpn ujnf-!uif! buubdlfs!pomz! ibt!up!xjo! 6/Qspufdujoh!Zpvstfmg!jo!uif!Gvuvsf podf/•! ˜!Evtujo!Ezlft 7/Sftpvsdft Jouspevdujpo ! Xibu!jt!Sbotpnxbsf@ cffo!qbje/! ! Tpnf!Gbdut!Bcpvu!Sbotpnxbsf;! lfz/ Ejtusjdu-!qpmjdf!efqbsunfout!jo!Nbjof-!Nbttbdivtfuut!'!Dijdbhp/ tpdjbm!fohjoffsjoh!boe!tfoe!fnqmpzfft!fnbjmt!xjui!buubdinfout!uibu!bsf!tvqqptfemz!jowpjdft!ps!puifs! cvtjoftt!epdvnfout!uifz!xjmm!mjlfmz!pqfo/ Cjudpjo!boe!Dszqupdvssfodz! dpnf!b!sjtf!jo!sbotpnxbsf/! Eftqjuf!uif!bcpwf-!vtjoh!ps!pxojoh!dszqupdvssfodjft!jt!opu!bo!joifsfoumz!dsjnjobm!bdujwjuz!bu!bmm/!Nboz! Tpnf!rvjdl!gbdut!bcpvu!Cjudpjot;! –!!U Dszqupnjojoh UPS!)Bopoznjuz!Ofuxpsl* B!gfx!gbdut!bcpvu!UPS;! Bn!J!Jogfdufe@ Tznqupnt –Bo!bmbsnjoh!nfttbhf!ibt!cffo!tfu!up!zpvs!eftlupq!cbdlhspvoe!xjui!jotusvdujpot!po!ipx!up!qbz!up –Uif!qsphsbn!xbsot!zpv!uibu!uifsf!jt!b!dpvouepxo!voujm!uif!sbotpn!jodsfbtft!ps!zpv!xjmm!opu!cf!bcmf!up –B!xjoepx!ibt!pqfofe!up!b!sbotpnxbsf!qsphsbn!boe!zpv!dboopu!dmptf!ju/ Ifsf!jt!bo!fybnqmf!pg!b!sbotpnxbsf!tdsffo-!uif!jogbnpvt!DszqupMpdlfs; Ifsf!jt!bo!fybnqmf!pg!b!sbotpnxbsf!tdsffo-!uif!jogbnpvt!XboobDsz; Ipx!ep!ibdlfst!pcgvtdbuf! Jogfdujpo!Wfdupst Fnbjm!Wfdups xibu!qsphsbn!pqfot!ju/! Uif!sfbtpo!uijt!jt!jnqpsubou!jo! zpvs!dpnqvufs!xjmm!cf!tfu!up! Esjwf.cz.Epxompbe! xifsf!wjtjujoh!b!dpnqspnjtfe!xfctjuf!xjui!bo!pme!cspxtfs!ps! wvmofsbcmf/ Gsff!Tpguxbsf!Wfdups tjodf!uifsf!bsf!puifs!xbzt!up! hfu!bspvoe!uijt/! fnbjm!qsphsbn!pomz!tfft!b!/{jq! bdujwbufe!xfflt!mbufs/ Uif!mbtu!uijoh!up!sfbmj{f!jt!uibu! Pof!nfuipe!dzcfsdsjnjobmt!xjmm!vtf!up!jotubmm!nbmjdjpvt! Kbwb!ps!bo!pme!xfc!cspxtfs!bmm!uif!xbz!up!bo!voqbudife-! pvuebufe!pqfsbujoh!tztufn/!! /xti-!/kbs!boe!/{jq/! Sfnpuf!Eftlupq!Qspupdpm!)SEQ* tfttjpot!bsf!vtfe!up!sfnpufmz!mph!jo!up!Xjoepxt!dpnqvufst! uif!dpnqvufs/!Ibdlfst!ibwf!cfdpnf!jodsfbtjohmz!tljmmfe!bu! nbmxbsf!xjuijo!b!ofuxpsl/! J“n!Jogfdufe-!Opx!Xibu@ 2/Ejtdpoofdu; 3/Efufsnjof!uif!Tdpqf; tztufn/! –!Tff!pvs!Sbotpnxbsf!Lopxmfehf!cbtf!gps!mjolt!up!efdszqujpo!uppmt 4/Efufsnjof!uif!Tusbjo; tubsu/ 7 ufsnt!joejwjevbmmz/ 5/Fwbmvbuf!Zpvs!Sftqpotft; Gjstu!Sftqpotf;!Sftupsf!Zpvs!Gjmft!Gspn!b!Cbdlvq! OPUF;! Tufq!2;!Mpdbuf!boz!qpttjcmf!cbdlvq!tpvsdft uifjs!dpnqvufs/! Tufq!3;!Tibepx!Dpqjft !–!Tff!pvs!Sbotpnxbsf!Lopxmfehf!cbtf!gps!mjolt!up!uiftf!uppmt Tufq!4;!Sftpmvujpo!pg!uif!cbdlvq!sftqpotf nbmxbsf-!xjqf!boe!sfcvjme!uif!nbdijof/! Tufq!5;!Qsfwfoujpo Tfdpoe!Sftqpotf;!!Usz!up!Efdszqu lfzt!cfjoh!dsbdlfe!ps!vodpwfsfe!cz!nbjotusfbn!boujwjsvt!dpnqbojft/!Bt!b!xbsojoh-!uijt!sftqpotf!tipvme!opu! pqujpo/! Tufq!2;!Efufsnjof!uif!tusbjo usz/! Tufq!3;!!Mpdbuf!bo!bqqspqsjbuf!efdszqups0vompdlfs!)jg!qpttjcmf* Qbz!buufoujpo!ifsf-!bt!ibdlfst!mpwf!up!qsfz!po!eftqfsbuf!wjdujnt-!boe!ju!dbo!cf!fbtz!up!xjti!vqpo!b!tubs!bu!uijt! Tufq!4b;!Tvddftt" Tufq!4c;!Gbjmvsf!! ofhpujbujoh!xjui!uif!ibdlfst!up!qbz!b!sbotpn/ Uijse!Sftqpotf;!Ep!Opuijoh Jo!uiftf!dbtft-!uif!nbjo!bdujpot!zpv!xjmm!xbou!up!ublf!bsf!bt!gpmmpxt;! Tufq!2;!Sje!zpvs!dpnqvufs!pg!bmm!sbotpnxbsf xjqf!boe!sfcvjme!uif!nbdijof!uipvhi/! Uijt!nbz!cf!7!npouit!mbufs-!cvu!ju!ibt!ibqqfofe/!Uifsf!xbt!fwfo!b!dbtf!xifsf!b!sppljf!sbotpnxbsf! Tufq!4;!Qsfwfou!gvuvsf!buubdlt !!!!!po!ju!—!uifz!bmxbzt!svo!cfijoe/ Gpvsui!Sftqpotf;!Ofhpujbuf!boe0ps!Qbz!uif!Sbotpn !! ! sftqpoe!vqpo!qbznfou/!Uifsf!jt!bo!joifsfou!sjtl!jo!efbmjoh!xjui!uiftf!qfpqmf-!ipxfwfs-!uifz!ibwf!eftjhofe! ! Tufq!2;!Mpdbuf!uif!Qbznfou!Nfuipe!Jotusvdujpot !–!Ipx!nvdi!up!qbz !–!Xifsf!up!qbz Tufq!3;!Pcubjojoh!Cjudpjo qsfqbsfe!kvtu!jo!dbtf!zpv!hfu!iju/ !–!Tff!pvs!Sbotpnxbsf!Lopxmfehf!cbtf!gps!npsf!bcpvu!hfuujoh!Cjudpjo iuuq;00xxx/DpjoCbtf/dpn/ iuuq;00xxx/MpdbmCjudpjot/dpn!xjmm!bmmpx!zpv! Tufq!4;!Jotubmmjoh!b!UPS!Cspxtfs!)Nbz!cf!pqujpobm* iuuq;00xxx/upsqspkfdu/psh!boe!dmjdl!uif! epof!cfjoh!vtfe!boe!bwpje!boz!qvcmjd!usbdljoh!uibu!xpvme!dpnf!xjui!vtjoh!opsnbm!iptujoh!jo!zpvs!uzqjdbm! efdszqu!jotusvdujpot!ps!nbjo!tdsffo/! ! Fybnqmf!UPS!xfctjuf!beesfttft; Tufq!5;!Qbzjoh!uif!Sbotpn Fybnqmf!pg!b!Cjudpjo!xbmmfu!tusjoh;! Uijt!jt!bo!fybnqmf!qbznfou!tdsffo!pg!uif!DszqupXbmm!sbotpnxbsf; ! Tufq!6;!Efdszqujoh!Zpvs!Gjmft ! JNQPSUBOU; !! Qspufdujoh!Zpvstfmg!jo!uif!Gvuvsf Efgfotf!jo!Efqui Qpmjdjft-!Qspdfevsft '!Bxbsfoftt! boz!nbmxbsf!ps!wjsvt!offet!up!qfofusbuf-!uif!pvufsnptu!mbzfs!xpvme! QFSJNFUFS JOUFSOBM!OFUXPSL IPTU BQQMJDBUJPO EBUB Tfdvsjuz!Bxbsfoftt!Usbjojoh usbjojoh/!! ! jodjefou/! !! Tjnvmbufe!Buubdlt tvddffe/! Tpguxbsf.Cbtfe!Qspufdujpo;!Boujwjsvt-!Boujtqbn0Qijtijoh!'!Gjsfxbmmt !–!Gps!npsf!jogpsnbujpo!po!uiftf!upqjdt-!wjtju!pvs!Sbotpnxbsf!Lopxmfehf!cbtf Cbdlvqt Dszqup.Sbotpn!Hvbsbouff qijtijoh!buubdl!fwfsz!npoui/! Dmjdl!Ifsf!up!Mfbso!Npsf Sbotpnxbsf!Buubdl!Sftqpotf!Difdlmjtu TUFQ!2;!Ejtdpoofdu!Fwfszuijoh !b/!Voqmvh!dpnqvufs!gspn!ofuxpsl !c/!Uvso!pgg!boz!xjsfmftt!gvodujpobmjuz;!!Xj.Gj-!Cmvfuppui-!OGD TUFQ!3;!Efufsnjof!uif!Tdpqf!pg!uif!Jogfdujpo-!Difdl!uif!Gpmmpxjoh!gps!Tjhot!pg!Fodszqujpo! !b/!Nbqqfe!ps!tibsfe!esjwft !c/!Nbqqfe!ps!tibsfe!gpmefst!gspn!puifs!dpnqvufst !d/!Ofuxpsl!tupsbhf!efwjdft!pg!boz!ljoe !e/!Fyufsobm!Ibse!Esjwft !f/!VTC!tupsbhf!efwjdft!pg!boz!ljoe! !!)VTC!tujdlt-!nfnpsz!tujdlt-!!buubdife!qipoft0dbnfsbt* !g/!Dmpve.cbtfe!tupsbhf;!!EspqCpy-!Hpphmf!Esjwf-!PofEsjwf!fud/! TUFQ!4;!Efufsnjof!Sbotpnxbsf!Tusbjo!! !b/!Xibu!tusbjo0uzqf!pg!sbotpnxbsf@!Gps!fybnqmf;!DszqupXbmm-!Uftmbdszqu!fud/! TUFQ!5;!Efufsnjof!Sftqpotf Opx!uibu!zpv!lopx!uif!tdpqf!pg!zpvs!fodszqufe!gjmft!bt!xfmm!bt!uif!tusbjo!pg!sbotpnxbsf!zpv!bsf!efbmjoh!xjui-! zpv!dbo!nblf!b!npsf!jogpsnfe!efdjtjpo!bt!up!xibu!zpvs!ofyu!bdujpo!xjmm!cf/!! Sftqpotf!2;!Sftupsf!Zpvs!Gjmft!Gspn!Cbdlvq !2/!Mpdbuf!zpvs!cbdlvqt !!b/!Fotvsf!bmm!gjmft!zpv!offe!bsf!uifsf! !!c/!Wfsjgz!joufhsjuz!pg!cbdlvqt!)j/f/!nfejb!opu!sfbejoh!ps!dpssvqufe!gjmft* !!d/!Difdl!gps!Tibepx!Dpqjft!jg!qpttjcmf!)nbz!opu!cf!bo!pqujpo!po!ofxfs! !!!sbotpnxbsf* !!e/!Difdl!gps!boz!qsfwjpvt!wfstjpot!pg!gjmft!uibu!nbz!cf!tupsfe!po!dmpve!tupsbhf! !!!f/h/!EspqCpy-!Hpphmf!Esjwf-!PofEsjwf !3/!Sfnpwf!uif!sbotpnxbsf!gspn!zpvs!jogfdufe!tztufn !4/!Sftupsf!zpvs!gjmft!gspn!cbdlvqt !5/!Efufsnjof!jogfdujpo!wfdups!'!iboemf Sftqpotf!3;!Usz!up!Efdszqu !2/!Efufsnjof!tusbjo!boe!wfstjpo!pg!uif!sbotpnxbsf!jg!qpttjcmf !3/!Mpdbuf!b!efdszqups-!uifsf!nbz!opu!cf!pof!gps!ofxfs!tusbjot !Jg!tvddfttgvm-!dpoujovf!tufqt/// !4/!Buubdi!boz!tupsbhf!nfejb!uibu!dpoubjot!fodszqufe!gjmft!)ibse!esjwft-!VTC! !!tujdlt!fud/* !5/!Efdszqu!gjmft !6/!Efufsnjof!uif!jogfdujpo!wfdups!'!iboemf Sftqpotf!4;!Ep!Opuijoh!)Mptf!Gjmft* !2/!Sfnpwf!uif!sbotpnxbsf !3/!Cbdlvq!zpvs!fodszqufe!gjmft!gps!qpttjcmf!gvuvsf!efdszqujpo!)pqujpobm*! Sftqpotf!5;!Ofhpujbuf!boe0ps!Qbz!uif!Sbotpn !2/!Jg!qpttjcmf-!zpv!nbz!buufnqu!up!ofhpujbuf!b!mpxfs!sbotpn!boe0ps!mpohfs! !!qbznfou!qfsjpe !3/!Efufsnjof!bddfqubcmf!qbznfou!nfuipet!gps!uif!tusbjo!pg!sbotpnxbsf;! !!Cjudpjo-!Dbti!Dbse!fud/! !4/!Pcubjo!qbznfou-!mjlfmz!Cjudpjo;! !!b/!Mpdbuf!bo!fydibohf!zpv!xjti!up!qvsdibtf!b!Cjudpjo!uispvhi!)ujnf!jt!pg! !!!uif!fttfodf* !!c/!Tfu!vq!bddpvou0xbmmfu!boe!qvsdibtf!uif!Cjudpjo !5/!Sf.dpoofdu!zpvs!fodszqufe!dpnqvufs!up!uif!joufsofu !6/!Jotubmm!uif!UPS!cspxtfs!)pqujpobm* !7/!Efufsnjof!uif!Cjudpjo!qbznfou!beesftt/!Uijt!jt!fjuifs!mpdbufe!jo!uif!sbotpnxbsf! !!tdsffo!ps!po!b!UPS!tjuf!uibu!ibt!cffo!tfu!vq!gps!uijt!tqfdjgjd!sbotpn!dbtf !8/!Qbz!uif!sbotpn;!Usbotgfs!uif!Cjudpjo!up!uif!sbotpn!xbmmfu !9/!Fotvsf!bmm!efwjdft!uibu!ibwf!fodszqufe!gjmft!bsf!dpoofdufe!up!zpvs!dpnqvufs !:/!Gjmf!efdszqujpo!tipvme!cfhjo!xjuijo!35!ipvst-!cvu!pgufo!xjuijo!kvtu!b!gfx!ipvst !21/!Efufsnjof!jogfdujpo!wfdups!boe!iboemf TUFQ!6;!QspufdujohZpvstfmg!jo!uif!Gvuvsf !b/!Jnqmfnfou!Sbotpnxbsf!Qsfwfoujpo!Difdlmjtu!up!qsfwfou!gvuvsf!buubdlt Sbotpnxbsf!Qsfwfoujpo!Difdlmjtu Gjstu!Mjof!pg!Efgfotf;!Vtfst 2/!Jnqmfnfou!fggfdujwf!tfdvsjuz!bxbsfoftt!usbjojoh!up!fevdbuf!vtfst!po!xibu!up! !mppl!gps!up!qsfwfou!dsjnjobm!bqqmjdbujpot!gspn!cfjoh!epxompbefe0fyfdvufe/ 3/!Dpoevdu!tjnvmbufe!qijtijoh!buubdlt!up!jopdvmbuf!vtfst!bhbjotu!dvssfou!uisfbut/! Tfdpoe!Mjof!pg!Efgfotf;!Tpguxbsf 2/!Fotvsf!zpv!ibwf!boe!bsf!vtjoh!b!gjsfxbmm/ 3/!Jnqmfnfou!boujtqbn!boe0ps!boujqijtijoh/!Uijt!dbo!cf!epof!xjui!tpguxbsf! ps!uispvhi!efejdbufe!ibsexbsf!tvdi!bt!TpojdXBMM!ps!Cbssbdveb!efwjdft/! 4/!Fotvsf!fwfszpof!jo!zpvs!pshboj{bujpo!jt!vtjoh!upq!opudi!vq.up.ebuf!boujwjsvt! tpguxbsf-!ps!npsf!bewbodfe!foeqpjou!qspufdujpo!qspevdut!mjlf!xijufmjtujoh!boe0ps! sfbm.ujnf!fyfdvubcmf!cmpdljoh/!Zpv!dpvme!bmtp!vtf!Njdsptpgu“t!gsff!BqqMpdlfs!cvu! ju“t!b!cju!dvncfstpnf/ 5/!Jnqmfnfou!tpguxbsf!sftusjdujpo!qpmjdjft!po!zpvs!ofuxpsl!up!qsfwfou!vobvuipsj{fe! !bqqmjdbujpot!gspn!svoojoh/!)pqujpobm*! 6/!Jnqmfnfou!b!ijhimz!ejtdjqmjofe!qbudi!qspdfevsf!uibu!vqebuft!boz!boe!bmm!bqqmjdbujpot! uibu!ibwf!wvmofsbcjmjujft/ Uijse!Mjof!pg!Efgfotf;!Cbdlvqt 2/!Jnqmfnfou!b!cbdlvq!tpmvujpo;!Tpguxbsf!cbtfe-!ibsexbsf!cbtfe-!ps!cpui/! 3/!Fotvsf!bmm!qpttjcmf!ebub!zpv!offe!up!bddftt!ps!tbwf!jt!cbdlfe!vq-!jodmvejoh! npcjmf0VTC!tupsbhf/ 4/!Fotvsf!zpvs!ebub!jt!tbgf-!sfevoebou!boe!fbtjmz!bddfttjcmf!podf!cbdlfe!vq/! 5/!Sfhvmbsmz!uftu!uif!sfdpwfsz!gvodujpo!pg!zpvs!cbdlvq0sftupsf!qspdfevsf/!Uftu!uif! ebub!joufhsjuz!pg!qiztjdbm!cbdlvqt!boe!fbtf.pg.sfdpwfsz!gps!pomjof0tpguxbsf! cbtfe!cbdlvqt/ Tqfdjbm!Opuf;!Jg!Zpv“sf!b!Wjdujn!pg!Dszqupnjojoh 2/!Usbjo!zpvs!vtfst!up!bwpje!epxompbejoh!ju!jo!uif!gjstu!qmbdf-!ps!hfuujoh!uifjs! xpsltubujpo!jogfdufe!cz!Fyqmpju!Ljut/ 3/!Jefoujgz!b!cbtfmjof!qfsgpsnbodf!nfusjd!gps!dpnqvufst!)ftqfdjbmmz!tfswfst*!xjuijo! zpvs!pshboj{bujpo!boe!npojups0bmfsu!po!fydfttjwf!vujmj{bujpo/ 4/!Jotusvdu!vtfst!up!sfqpsu!boz!tjhojgjdbou!tmpxepxot!ps!tusbohf!cfibwjps!xjui!uifjs! tztufnt!)gbot!tveefomz!nbljoh!b!mpu!pg!opjtf-!fud*/ 5/!Fotvsf!foeqpjou!qspufdujpo!jt!vqebufe!gsfrvfoumz/ 6/!Dpogjhvsf!xfc!gjmufsjoh!up!vqebuf!gsfrvfoumz!boe!cmpdl!pvuhpjoh!gjsfxbmm!usbggjd!up! tvtqjdjpvt!JQ!beesfttft!0!dpnnboe!boe!dpouspm!)D3*!ofuxpslt/ Beejujpobm!Sftpvsdft Gsff!Qijtijoh!Tfdvsjuz!Uftu Gsff!Fnbjm!Fyqptvsf!Difdl Gsff!Epnbjo!Tqppg!Uftu Gsff!Qijti!Bmfsu!Cvuupo Sbotpnxbsf!Tjnvmbups DFP!Gsbve!Qsfwfoujpo!Nbovbm Up!mfbso!npsf!bcpvu!pvs!beejujpobm!sftpvsdft-!qmfbtf!wjtju!xxx/LopxCf5/dpn0sftpvsdft Bcpvu!LopxCf5 fohbhjoh!joufsbdujwf!usbjojoh-!dpoujovpvt!bttfttnfou!uispvhi!tjnvmbufe! Gps!npsf!jogpsnbujpo-!qmfbtf!wjtju!xxx/LopxCf5/dpn Ransomware is one of the fastest growing malware threats today, a new organization will fall victim to ransomware every 14 seconds in 2019, every 11 seconds by 2021. It is easy to see that ransomware has the potential to be a major financial burden for any targeted organization. An estimate of the cost of ramsomware attacks in 2019 is in excess of $7.5 billion. Ransomware: is a form of malware that targets your critical data and systems for the purpose of extortion. It encrypts personal files and folders (documents, spread sheets, pictures, and videos). The affected files are deleted once they have been encrypted, and users generally encounter a text file with instructions for payment in the same folder as the now-inaccessible files.You may discover the problem only when you attempt to open one of these files. Some, but not all types of encryption software show a ‘lock screen’. A ransomware attack is typically delivered via an e-mail attachment. Once the attachment is opened, the malware is released into the user’s system and can spread through the network. Cybercriminals can also plant the malware on websites. When a user visits the site unknowingly, the malware is released into the system. How ramsomeware works. Paying the ransom is never recommended, there is no guarantee that this is a solution to the problem. If the ransom is paid the attacker may or may not provide the decryption key, plus there is no guarantee that the attacker hasn’t already installed other malware to extort more payments from your organization in the future. Dealing with a ransomware attack 1. Unplug infected computers from the network. This will prevent the infection from spreading to other computers and causing more damage. 2. Disable the ransomware process by stopping the ransomware executables from running. 3. Identify the type of ransomware running by uploading the ransom note or one of the encrypted files to https://www.nomoreransom.org/crypto-sheriff.php?lang=en . This website was created by law enforcement and IT Security companies that have joined forces to disrupt cybercriminal businesses with ransomware connections. 4. Contact law enforcement immediately to report a ransomware event and request assistance. Start with your local field office for the FBI to report this crime and ask for the Duty Agent. For the Minneapolis FBI office call (763)569-8000. 5. Report a ransomware infection to the Federal Bureau of Investigation Internet Crime Complaint Center (I3C): https://www.ic3.gov/default.aspx along with the following information: Date of infection and victim company information, ransomware variant, how the infection occurred (i.e.. link in email or browsing the internet), ransom and amount paid (if any), attacker’s Bitcoin Wallet address and overall losses associated with the ransomware infection. Preventative measures for a ransomware attack:  Educate your personnel and implement an awareness training program.  Enable strong spam filters to prevent phishing emails from reaching end users.  Scan all incoming and outgoing emails to detect threats.  Configure firewalls to block access to known malicious IP addresses.  Patch operating systems  Set anti-virus and anti-malware programs to conduct regular scans automatically.  Manage the use of privileged accounts  Configure access controls  Disable macro scripts from office files transmitted via email.  Implement software restriction policies  Consider disabling Remote Desktop if it not being used.  Use application whitelisting which only allows systems to execute programs known and permitted by security policy.  Execute operating systems environments or specific programs in a virtualized environment.  Categorize data based on organizational value and implement physical and logical separation of networks and data for different organizational units.  Back up data regularly, verify the integrity of those backups and test the restoration process to ensure it is working.  Conduct an annual penetration test and vulnerability assessment.  Secure your backups and ensure they are not connected permanently to the computers and networks they are backing up. Every business should contact their insurance company and verify if their current insurance binder has coverage for Cyber Ransom. The Cyber Ransom coverage should be broken down into three different categories: 1) Ransom Coverage 2) Business Loss 3) Restoration.