MINOT, N.D. — The relentless cyber threats and the ransomware attacks on governments across the country isn't catching North Dakota unaware.
The state's "One State, One Security" initiative has the North Dakota Information Technology Division working across government agencies to raise the collective cybersecurity posture of the state as a whole, according to Sean Wiese, chief information security officer for the division.
"There is a ton of interest as most, if not all, entities understand the importance of being able to defend against the steady barrage of cyberattacks," he said in an email.
The initiative includes the executive, judicial and legislative branches; elementary, secondary and higher education; and cities and counties.
Nationwide, attackers are generally kept out of networks, but depending on how far the malware gets into a system, it can be costly to recover, Wiese said. He noted the Colorado Department of Transportation spent more than $1 million to repair its system after a ransomware attack.
This month, Texas officials were left scrambling after nearly two dozen Texas cities were hit by a coordinated ransomware attack, according to the Associated Press. Ransomware is a type of malicious software, or malware, designed to deny access to a computer system or data until a ransom is paid.
In June, two Florida cities were both hit by ransomware attacks and decided to pay off the hackers, according to media reports. In 2018, several Atlanta city systems were crippled after a ransomware attack extorted the municipality for $51,000, which the city refused to pay. The city of Baltimore was targeted last May, impacting services such as water bills and permits.
North Dakota governments haven't been immune. For instance, the North Dakota Department of Mineral Resources experienced a ransomware attack in 2016. The agency had files backed up and was able to restore them and continue business. About a third of the state's schools came under a malware attack in February 2018, and the North Dakota University System has received multiple threats in recent years, including ransomware.
The Legislature granted North Dakota Information Technology a $15.4 million appropriation for the 2019-21 biennium and eight additional full-time equivalent staff positions to help the state stay abreast of the cyber threats.
The office has been reporting that about 5.7 million attacks occur monthly on state and local governments in North Dakota.
"What that number fails to articulate is that it is only one view into our overall threat landscape," Wiese said in the email. "Due to our shared network infrastructure (STAGEnet), we are well positioned to defend against the latest cyberattacks from a network perspective; outside of that, it becomes much less clear. With 400+ entities managing their own cybersecurity, there are 400+ different ways of effectively managing it."
However, he added, "When you consider the low number of cyber-focused staff spread throughout these 400+ entities, it becomes painfully clear that they are underpowered and just don't have the time or expertise to take this huge task on."
NRG Technology Services in Bismarck has teamed up with North Dakota Information Technology to jointly aid county governments in beefing up their network security.
They completed the first phase of work, which essentially places a firewall around every county, allowing only trusted traffic into the system. A firewall is the part of a computer system designed to block unauthorized access while permitting outward communication.
NRG reports Phase 2 will be more time-consuming and costly because it will involve in-depth study of each county's network and the creation of customized plans. Phase 2 is addressing internal network security, policies and procedures. That work is ongoing as needs become identified for counties. Phase 2 is voluntary rather than mandatory for counties.
Counties, such as Ward, that have in-house information technology departments may have different or additional technologies to enhance their cybersecurity.
Blake Crosby, executive director for the North Dakota League of Cities, said the league will be holding workshops on the topic at its convention in September. The conversation will cover not just government cybersecurity but also personal, home cybersecurity. In small cities, often the city auditor may be using a home computer to process city business, but beyond that, city employees and officials need to keep their families safe, Crosby explained.
"It's not a matter of 'if.' It's a matter of 'when,'" he said of the cybersecurity threat.
"We are pushing that information out there. We talk about it regularly," he added. "It's on our radar."