County spends $102K to fend off future cyberattacks

Sparty Hammett Pasquotank Manager

By Jon Hawley
Staff Writer

Friday, June 22, 2018

Pasquotank County commissioners voted Monday to spend up to $102,000 to upgrade the county's information technology infrastructure, in response to a cyberattack last month that took county servers hostage and shut down employees' email.

Following a closed session Monday, commissioners voted unanimously to hire The Soundside Group, of Plymouth, for a host of IT upgrades.

Price quotes from the company call for installing new firewalls, new malware detection and system monitoring programs, and a new backup server, among other services. The quotes total $102,120, $42,000 of which will go for “technical services,” or labor. The IT upgrades will be in addition to Pasquotank hiring the company to help it recover from the cyberattack and assess the county’s vulnerabilities, work that could cost about $19,000.

County Manager Sparty Hammett acknowledged The Soundside Group’s work will be expensive, but said the company has offered better prices than competing companies — and the work is greatly needed.

“We have to take these measures,” Hammett said, explaining cyberattacks are a growing risk for local governments. Cyberattacks can steal sensitive data, including citizens' personal data, and disrupt vital government services, he said.

“It could have totally shut down Pasquotank County,” Hammett said of last month's attack.

The “ransomware” attack encrypted several departments' data and the attack’s perpetrators demanded payments to make them usable again. It also took down the county's website and email; a temporary website is up and the county's email is close to returning to normal, Hammett said.

The county paid no ransom, he also said.

Hammett said the $102,000 the company will be paid is broken into four tasks.

The first, for $24,848, is to install new and additional firewalls for all county systems. Hammett said the county will have firewalls at each user device, meaning malware should be detected as soon as it enters an employee's company, not just when it starts spreading across the network.

Second, for $27,755, the company will establish 11 “virtual local area networks” covering key county services. Going from one large network to multiple virtual networks will make it easier to quarantine malware while also improving network performance, Hammett said.

Hammett also noted establishing those virtual local area networks is “labor intensive” and may require a lot of troubleshooting, hence the expense.

Third, for $36,186, Soundside will establish a new backup server for the county. The server will also operate “off domain,” Hammett said, meaning malware won't easily spread to it like it can the current backup server. Better backup capability means the county can rebound easily from a loss of data, whether due to a cyberattack or a natural disaster, he added.

Fourth, for $13,330, Soundside will set up remote monitoring allowing immediate detection of problems at employees' workstations or on servers. Such remote monitoring would have immediately alerted the county of last month's attack, though new firewalls likely would have stopped it as well, Hammett said.

Hammett previously reported last month's cyberattack would have done more damage, except IT Director Colin Flatness happened to be in the office while it was happening and interrupted it.

Once Soundside gets started, Hammett said it likely will take the firm several months to complete the upgrades. The company will have to work after hours and on weekends to avoid disrupting county operations, he added.

Hammett said Soundside is providing upgrades the county would have eventually needed; it will need a strong network backbone for future improvements to services, he said. He noted, however, that the company's work doesn't include a new, permanent county website. The county is still studying what it needs in a new website and doesn't want to rush that process, he said.

Hammett also acknowledged Soundside's work won't make Pasquotank immune to all cyberattacks, but he's tasked it with providing the maximum protection possible.

“It brings our entire network structure up to 2018,” Hammett said.

Pasquotank will pay for Soundside's costs out of its capital reserve fund, which can cover the expense thanks in part to a recent land sale to Camden, Hammett noted. Notably, the company’s price quote totals just over $102,000, but Hammett said commissioners approved a flat $102,000.