May 2022 - Parks & Recreation - 37

the city crippled for months.
For Justin King, chief of information
technology (IT) at the Baltimore
City Department of Recreation and
Parks, the 2019 ransomware attack
resulted in major changes. " It took
the worst thing that could possibly
happen [to make change]. Previously,
there wasn't enough investment in cybersecurity;
it was overlooked. There
have been astronomical changes since
then. We looked at our network from
the ground up, and we completely rebuilt
it. One of the most substantial
changes to our system is two-factor
authentication. It's something people
don't think is critical, but it changes
everything and makes such a tremendous
difference. The root cause of
the ransomware was someone's password
being compromised. [To keep
current,] we have calls daily with all
the IT leadership in the city. We get
briefed every single day by our information
security department, and they
tell us what's going on. "
When Cyberattacks
Affect Individuals
While devastating and costly for a
municipality, cyberattacks also can
affect the individuals who work
for or do business with that entity.
For " Laura, " the nightmare of
a cyberattack started with a piece
of technology she used every day
- her cellphone. (Editor's Note:
" Laura " is a pseudonym to protect
her identity.) " I would go to use it,
and a cursor would move across
the screen. Then I was working on
my home computer one night, and
I got a pop-up, so I turned off the
computer and went to bed. I turned
the computer back on the next day,
and the screen didn't look familiar,
and someone was controlling the
screen. So, I went to another computer
in the house, and it was doing
the same thing. When I went into
Refused Ransom Demand vs. Recovery Cost
(adapted from The Economic Impact of Cyber Attacks on
Municipalities, KnowBe4, tinyurl.com/2yevmucn).
State
Maryland
Colorado
Georgia
Louisiana
Population
Affected
619,493
619,968
523,738
390,144
the office, the same virtual screen
was on my computer, " she recalls.
The cyberattackers were able to
access all her passwords and gain
access to her online tax records,
which contained both her and her
husband's social security numbers.
From there, they were able to access
her bank accounts and her
mutual funds. She had some of her
mother's health records stored on
her computer, which allowed the
attackers access to her mother's retirement
accounts as well. " Everywhere
I turned - from my house
to my work to my phone to my car
- they were there. They were in
every single electronic account you
Target Area of Attacks
Other
15.7%
Education
25.0%
Demand
$76,000
$51,000
$55,000
unknown
Recovery Cost
$10-18 million
$1.5 million
$17 million
$7-10 million
can think of, " Laura says.
While she first noticed activity on
her cellphone in August 2021, the
forensic investigators found traces
of the activity a year prior. " The police
still don't know where it started
or when it started or who did it, "
she says. " I had to leave my job and
move to another area of the country,
just to feel safe. " Now Laura uses a
password manager and has hired a
company to secure her home internet
at a personal cost of $750 per
month. However, she still isn't sure
if she is completely protected.
Best Practices
While cybercrime is ever changing
Law Enforcement
12.9%
Library
4.3%
Counties
13.9%
Cities and Townships
28.2%
PARK S ANDRECRE AT ION . OR G | MAY 2 0 22 | Parks & Recreation
37
CHART COURTESY OF KNOWBE4
http://www.tinyurl.com/2yevmucn
May 2022 - Parks & Recreation

Table of Contents for the Digital Edition of May 2022 - Parks & Recreation
