Officials confident in ransomware defenses, but most lack incident response plan, survey finds
About four-fifths of state and local officials believe their organizations have the ability to fend off cyberattacks like ransomware, denial-of-service and data destruction, according to a survey released Tuesday. But more than half said their agencies lack incident response plans for dealing with ransomware, despite the fact that a vast majority believe the threat is unlikely to recede any time soon.
The survey, released by the cybersecurity firm Palo Alto Networks, interviewed 200 state and local government officials across several fields, including public works, government operations, finance and IT.
Seventy-seven percent of respondents said they either “somewhat” or “strongly” disagreed with a statement that ransomeware would “subside significantly” over the next 12 to 18 months, while 81% said they were “very ” or “somewhat” confident they could prevent attackers from infiltrating their networks.
Yet at a time when states and localities are constantly encouraged to draft and revise incident-response plans specifically for ransomware, only 31% have done so, the survey found. Another 17% said ransomware is listed in broader cybersecurity planning documents, while 10% said they are drafting plans.
Officials who said their organizations had drafted plans were more likely to trust in their abilities to deal with cyberattacks, but even among those without plans, 57% said they were confident against ransomware threats.
Still, most officials who responded to the survey said that better protection from ransomware will require more spending: 59% said that “some” or “significant” new investment is needed, while 5% said they needed a “complete overhaul” of their response capabilities.
The Palo Alto Networks report mentions that some new funding could arrive in the form of the $1 billion cybersecurity grant program included in last year’s federal infrastructure law. The grants, which are expected to begin by summer, will be awarded competitively, meaning governments hoping for a slice will need to be able to show they have plans for the money.
“To win grant awards and other federal funding, organizations need to start planning now,” the survey reads. “They need to accurately assess their cybersecurity posture, identify gaps, prioritize needs and design a roadmap.”
