This article is posted with permission from VC3's blog and shares non-technical, municipal-relevant insights about critical technology issues, focusing on how technology reduces costs, helps better serve citizens, and lessens cybersecurity risks. VC3 is solely responsible for the article’s content.
This article originally appeared on Sophicity's CitySmart blog.
If you work for a larger city, you might understand why hackers target it. The size of an Atlanta, a Lexington, or a Little Rock attracts a lot of cybercriminals, but those cities also spend a great deal on resources to defend themselves. We often hear that hackers should consider smaller cities to be so inconsequential that these cybercriminals wouldn’t bother attacking them.
Wrong.
The media only reports on the biggest hacking and data breach cases, leading many of us to think that only large government organizations get attacked. But many data and cybersecurity breaches occur at smaller cities that go mostly unreported and unnoticed.
So why do hackers go after your small cities? Here’s why.
- Hackers look for easy targets. Similar to the mentality of burglars or robbers going after unarmed, defenseless people or breaking into cars with visible valuables in them, hackers often see small cities as easy targets due to relatively unsophisticated security. It’s the same reason why individual computers without proper firewalls or antivirus software usually become compromised. With so many cities in the United States, hackers are betting on the chance that their security is not up to snuff.
- Smaller cities unfortunately often do have weaker security. It’s unfortunate that cities often live up (or down) to a hacker’s expectation. Vulnerable hardware, software, network equipment, wireless access points, physical security, and weak points are usually more frequent at a smaller city that hasn’t taken the time to examine its security weaknesses. If the probability increases for hackers to exploit these smaller cities, hackers will target those cities.
- Smaller cities tend to forget about internal security weaknesses. Many smaller cities at least invest in a firewall and some antivirus software. Usually, that will take care of many external hacking threats. But what about internal threats? Many data breaches are the result of weak server and computer passwords, users given access to data that they should not be authorized to access, and employees clicking on malicious websites and email attachments. Without also addressing the sources of internal threats, your city will be incredibly vulnerable to an attack.
- Smaller cities often have vulnerable, open wireless access points. Often overlooked, unsecured and unencrypted wireless access points are easy points of entry for hackers. Larger cities might have more physical obstacles that make it hard to sniff out any wireless access points, but smaller city buildings are usually modest in size and easy to get near. You need to secure and encrypt all wireless access points to shore up this weakness.
- Smaller cities often don’t have IT staff or a vendor providing ongoing, independent monitoring and maintenance to look for security anomalies.Again, if cities just have a firewall focused on external threats, it’s like having a guard only watching for intruders that approach a building—rather than understanding if something is going on inside a building. Independent monitoring and maintenance identifies and raises red flags about both internal and external attacks. Unusual repeated log-in attempts, abnormally high data usage, or unidentified users accessing data should alert your IT staff or vendor. They will then flag these events as possible security risks and investigate further. Without that kind of internal, as well as external, monitoring, you might miss an attack that originates from inside your city.
Hackers bet on your probable lack of security. For a quick assessment, ask the following questions that we posed in a
recent webinar:
- Are my passwords strong enough to prevent hackers from stealing city information?
- Is my city at risk for getting a computer virus that allows hackers to steal information?
- Is outdated software and a lack of regular software maintenance leaving me open to a cybersecurity attack?
- Is my technology physically protected from unauthorized people stealing data or equipment?
- Is my city website secure and hosted by a reputable provider?