As public safety agencies across the world increasingly find themselves the targets of sophisticated cyber threat actors, creating a network for cyber threat intelligence sharing is one key way agencies are fighting back. 

The Public Safety Threat Alliance (PSTA) has identified some key cyber concerns heading into 2024, along with ways to mitigate them:

Ransomware and extortion threats growing against computer-aided dispatch (CAD)

Let’s say that late one night in a small North American county, a public safety answering point’s (PSAP) personnel noticed they had been locked out of their CAD system. On their printer sat a ransom note from the attacker. Despite pulling the county’s internet connection, the extortion attack had already caused havoc. A six-week CAD shutdown forced dispatchers to track calls with pen and paper, with the agency losing an evidence computer and decades of records as well. 

Bad actors who gain access to a CAD system can stop 9-1-1 from dispatching police, fire or EMS to the scene of an emergency until a ransom is paid — with downtime often unacceptable given the mission-critical nature of their work. Security leaders have seen threat actors act more boldly against mission-critical communications infrastructure, with eleven confirmed attacks impacting PSAPs and CAD systems so far this year. Furthermore, with many PSAPs adopting Next Generation 9-1-1 and modernizing their infrastructure to accept text, photo, video and digital content to enhance situational awareness, threat actors may have more entry points to access public safety systems. 

Protecting against ransomware attacks requires a multi-layered approach. Regular patching, disabling unused systems that could provide gateways for bad actors and basic cyber hygiene practices like setting up multi-factor authentication can help reduce the risk of a ransomware attack. Ransomware attacks can often originate in adjacent networks that connect to those owned by public safety officials, so it’s also important that public safety agencies have a clear map of the other municipal agencies within their jurisdiction and neighboring jurisdictions that connect to their network which could leave them open to vulnerabilities.   

Credential abuse is an easy access point for bad actors

Credential abuse gives threat actors high-level privileges and the ability to deploy malware. These kinds of attacks underscore the vital importance of regular cybersecurity maintenance like enforcing two-factor authentication and patching. It’s also important to restart systems following patches in order to ensure updates are functional.

Public safety agencies’ abilities to keep communities safe starts with the safety and security of their networks, operations and data.