The ransomware attack on the city of Atlanta in March of this year, which brought down numerous online city services for several days, should be seen as a warning for similar attacks on municipalities in the future with even more drastic impacts as city services become more reliant on IT systems, a senior Department of Homeland Security official said Tuesday.
Scott Tousley, deputy director of the Cyber Security Division for the Homeland Security Advanced Research Projects Agency at the Department of Homeland Security’s Science and Technology Directorate, said at a Digital Government Institute event that the Atlanta attack “is one of those red blinking lights that people talk about–it’s a warning bell.”
“Looking at what an Atlanta-style attack could be in eight years, it gives me nightmares,” he said, adding that some of the worse-case scenarios in such future attacks are “beginning to look like a Hollywood screenplay.”
Central to Tousley’s concerns about future attacks on municipalities is the rapid proliferation of “smart city” technologies including widespread deployment of IoT-connected devices, which he noted, “of course…is going to expand the attack surface.”
“The bottom line,” he said, is “the attack surface is expanding faster…than we are fixing the legacy IT landscape.”
In addition to the attack surface expansion, numerous major “challenge” areas also loom in the path to better security, he said, including: “significant and complex challenges” posed by mobile technologies; software “quality that is not rising as fast scale and growth”; a lack of consensus on adequate levels of testing and evaluation for software and devices including IoT devices; and a continuing failure to match the pace of data collection with adequate privacy rights policies.
Asked about the wisdom of allowing the private sector to “hack back” at adversaries, Tousley said “there are a lot of companies exploring the gray space” in legal policy. But he also warned that “we are the biggest, most target-rich country in the world, so that’s a slippery slope,” as hack-back policies could have the effect of drawing more attacks on U.S. targets.
