The Gilmer County government has been able to move past a March cyberattack on its computer network, but there are still some technological components to be replaced as the county also explores ways to strengthen its protection against future ransomware threats.
“We came out of this really not that bad. The very most important critical stuff never got affected. Some departments had no downtime at all. (Some) of them weren’t down for more than a couple of days. It didn’t stop people from being able to come in and get their car tags or pay their taxes or get their court files,” said Gilmer Commission Chairman Charlie Paris. “Everything is restored, and I’m not aware of anything that’s not. It cost us money, and it’s going to cost us more because, even though everything is restored and functioning, we are revamping our entire IT configuration.”
The Cybersecurity and Infrastructure Agency, a division of the Department of Homeland Security, defines ransomware as “a form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption.”
Precautionary steps taken prior to the cyberattack included county departments regularly backing up files stored on the main server using duplicate backup drives. Each department devised a plan on how to handle their files either by backing them up on physical media or moving to cloud storage.
“We had a server that had a lot of shared files on it for different departments. Of course, those files are critical. That server was backed up every night. We had become concerned about something like this long before it happened and had started trying to make plans to mitigate it if it did happen. I became concerned about if we got hit with ransomware, and they got into the backups and encrypted those as well,” Paris said. “All the departments basically worked to have, in addition to those backups, an alternate set of backups. When we were hit, they did get into the server backups, and they were encrypted (making them) useless to us. But each of the departments had already implemented their own plans for in case those backups were hit.”
As for how different departments functioned after the cyberattack, Paris said the sheriff’s office was able to ensure that 911 was never interrupted and their other services were restored relatively quickly. The clerk of court and tax commissioner’s offices “didn’t miss a beat,” he added.
“The tax assessors were in a little different situation because they have some special requirements that make it a little more difficult to put everything on the cloud. They had some files that got corrupted on their server and had to upload everything and validate it. (That was in) probably the timespan of a week. Planning and zoning, the board of commissioners, finance and human resources were all backed up (with alternate backups),” he added.
With its cyberinsurance coverage, the county received outside help from “some of the most highly regarded people in the country,” Paris noted.
“Once we filed a claim and let them know what was going in, they called in the experts. We could not have done what we did and are still doing without all this outside help,” he added.
The county will still have to have a new main server installed to replace a temporary framework that’s been used since the attack.
“Even though it’s not all put back together, it’s all still functioning, and everybody can do what they need to do,” Paris said.
This was the first ransomware attack for Gilmer’s government, but with the criminal activity becoming more prevalent, Paris knows it may not be the last. He’s only at liberty to discuss so much about how the cyberattack was handled due to security concerns, but did say that the county is taking additional precautions and using lessons learned from this incident to revamp its entire IT configuration.
“More and more county governments have been hit with ransomware over the past year. Fulton County, for instance, is a year out and over a million dollars in and still doesn’t have everything done. A lot of those (that have been hit) are smaller county governments and part of them are in north Georgia. That kind of brought this on, (saying), ‘OK, we are seriously at risk here,’” Paris said.
“I think we did everything we could think of to do to try to prepare for it before this hit. Now, of course, we know other things to do, and we’re implementing that,” he added. “We’re still putting things together and making changes that will protect us in the future. We want to try to get a situation to where, if we’re hit again, everybody doesn’t miss a beat.”