Can California Afford Another Cyber Attack?
With the growing number of ransomware attacks occurring in the US, are California agencies prepared to deal with the overwhelming damage and financial cost of a cybersecurity attack?
When Kaseya was faced with a complete shutdown of over 1,500 businesses and agencies, they were forced to pay $4.4 million (of the $7 million they were threatened by) in order to get back online and regain control of their systems.
California can’t afford to lose millions of dollars to these cyber criminals with pressing issues such as the devastating heat affecting revenue from agriculture, a spike in people experiencing homelessness, and a significant amount of people living in the state without health coverage.
California’s agencies have been taking the necessary steps toward digital transformation, although this has led to increased fragmentation and a more vulnerable attack surface.
For government agencies, security models need to be able to see clearly through the massive flow of data that goes along with cloud computing solutions.
Solutions that allow compliance, measurability, and a reduction in critical response necessities are an inevitability as ransomware attacks continue to threaten multiple agencies.
Recent Attacks Threaten the Security of Agencies
In recent years we have seen many instances that prove how governments and companies are prone to cyber attacks. And in the last couple of months alone we have seen a rise in ransomware attacks specifically, including the following:
1 – Colonial Pipeline Attack
This attack served the US a shocking wakeup call when it comes to the impact that hackers can have on our socioeconomic well-being. It caused a shutdown of America’s largest fuel pipeline that lasted days and resulted in gas shortages across the country.
Gas prices spiked and sent consumers in a panic. A cyber security researcher from the UC Berkeley School of Information, Nick Merell, told CNN that he was not surprised that this event had occurred, citing that cyber security experts have been warning about these types of events for years.
“Thank god it wasn’t water,” he said. It’s a foreboding thought that we are still unprepared for.
2 – Meat Plant Attack
The exploitative attack against JBS (the world’s largest meat supplier) caused them to go dark for only a day, but the impacts have yet to be fully realized. Employees located in the US, Australia, Brazil, and Canada were all affected as plants shutdown to resolve the attack.
There are also fears surrounding the effects this ransomware attack will have on already rising beef prices, but it is still too soon to tell.
3 – Kaseya Attack
This IT company connects thousands of companies across the world using software tools to help small to
medium-sized enterprises find the resources that they need to operate on a larger scale.
All it took was for one of Kaseya’s tools to become subverted to cause companies on five continents to go dark.
4 – Solarwinds Attack
The worst hack that the world has ever seen affected 18,000 organizations including governments and private users across the globe and caused the worst data leak in history. The number of people affected by this attack is still rising almost a year after the attack was launched.
As a result of attacks like these, companies and states are losing millions of dollars to these criminals. Let’s find out what are the top reasons for these attacks and how can we prevent them from happening in the future:
Top Reasons for Cyber Attacks
After checking into the security policies of several different agencies, we were surprised to see that these agencies are still using outdated infrastructure and website frameworks, making them easy targets for hackers.
All of the vendors who interact with government systems should also have continuous security policies, since it only takes one instance of malicious code to infect thousands of machines.
Although a security bill was introduced several years ago that ensured security assessments would be required every other year, from the attacks that have occurred it is clearly not enough.
Another bill was introduced in 2020 that contains provisions for securely deploying IoT devices in the future, but government agencies and businesses are still lacking the protection that they need today.
The fact is that agency CISO’s do not know enough about the overall health of their organization, which is a huge issue where cybersecurity is concerned, especially considering they should be at the head of influencing cybersecurity protocols.
Instead of maintaining security just for compliance, cybersecurity should be a 24/7 job.
Cybersecurity Is 24/7 Job
California agencies are no exceptions. In 2016, then Attorney General of California’s DOJ (now Vice President of the United States), Kamala Harris, issued a report highlighting the inevitability of cyber attacks and the need to reinforce the state’s cybersecurity policies, hardware and software.
Since then, California has been subject to all manners of attacks. Most recently, California DMVs were hacked and affecting taxpayers across the state. Billions of stimulus dollars were stolen, resulting in massive financial loss.
Students at the University of California also fell victim to an insidious attack.
Sensitive and personal information such as names, emails, student IDs, background, personal characteristics, academic engagement, educational goals, mental health information, experiences of diversity and sexual misconduct as well as other campus cultural climate factors were all leaked after an attack released private survey information of students.
The California EDD (Employment Development Department) admits that it mistakenly paid $31 billion in payment because they didn’t have robust security policies in place.
Julie Su, the secretary of the California Labor and Workforce Development Agency told news crews that, “There is no sugar coating the reality, California did not have sufficient security measures in place to prevent this level of fraud.”
With no one being held accountable for these immense losses, taxpayers routinely bear the burden of the mistakes made by California CISOs and other heads of IT and cybersecurity who are not taking the actions required to effectively monitor and protect the state’s vulnerable cyber infrastructure.
How CloudDefense.AI Can Help Prevent Cyber Attacks
Currently, California’s leadership is not equipped with the tools that are necessary to ensure the security and health of their organizations.
Security needs to be an ongoing protocol instead of an annual check box. Every agency’s security review should be automated and reviewed regularly at smaller intervals, such as biweekly or monthly.
Security committees and board of directors need to be holding CIOs and CISOs accountable for cyber security protections and losses.
California’s State Chief Information Officer, Amy Tong, should also have visibility into each agency’s cyber security measures and vulnerabilities via a centralized dashboard. This way, she can easily find out what the most vulnerable agencies are and where she should prioritize.
Opting for simple and robust solutions, we can save a fortune for our state and save billions of dollars for taxpayers. CloudDefense.AI provides robust technology, vulnerability management and automated reporting to achieve that.
CloudDefense.AI plug and play is a single platform that provides comprehensive coverage right out of the box, so organizations can effortlessly gain the protection and security that they need for their companies and constituents.
CloudDefense.AI is also an extremely affordable solution, reducing security expenditures up to 60% and increasing cyber security coverage from the average 30% to almost 90%.
When asked how the health of their organization is, CISOs can retrieve the answer from CloudDefense.AI with the click of a button thanks to the centralized reporting feature.
Integrating necessary cyber security tools that reduce hours and manpower spent learning, maintaining, and analyzing reports through a single easy-to-use platform is possible. Californians deserve better cyber protection, and they need it now more than ever.
Abhishek Arora, a co-founder and Chief Operating Officer at CloudDefense.AI, is a serial entrepreneur and investor. With a background in Computer Science, Agile Software Development, and Agile Product Development, Abhishek has been a driving force behind CloudDefense.AI’s mission to rapidly identify and mitigate critical risks in Applications and Infrastructure as Code.
