Suffolk County, NY, leaders blame clerks office for cyberattack

[ad_1]

HAUPPAUGE, NYA series of technical errors, delayed security upgrades, inadequate management structures and obstructive behavior by a senior official led to a September cyberattack on New York’s Suffolk County that has so far cost more $5 million to repair, County Executive Steve Bellone said Wednesday.

Speaking to reporters on Wednesday and flanked by county commissioners, Mr. Bellone outlined the preliminary findings of a forensic investigation by Palo Alto Networks Inc. into the Sept. 8 ransomware attack, which forced a month digital shutdown of county services and caused severe disruption to residents. and staff.

Suffolk County Executive Steve Bellone in July. Photo: EDUARDO MUNOZ/REUTERS

City services such as processing title deeds had to be done in person, while food stamp applicants were warned they could face delays, among other issues.

Attackers gained access to county clerks office systems around December 19 and 20, 2021, exploiting an unpatched vulnerability in the open-source Log4j software that was leaked earlier that month and caused panic among experts in cybersecurity, according to the report. Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency, described it at the time as the worst she had seen in her career. Once inside the Clerks Office system, the attackers then installed cryptocurrency mining software and began collecting credentials that would allow them to access county systems on the network.

The hackers finally established access to county systems on August 20 through the creation of an administrator account. The name of the account referred to the name of a former IT supervisor in the clerk’s office.

The hackers then struck 18 days later, making a demand for $2.4 million, which the county refused to pay. Bellone said $3.4 million has been spent on the recovery so far, and another $2 million on the Palo Alto Networks forensic investigation.

Due to Suffolk’s decentralized security structure, the Clerk’s Office largely manages its own technology and security environment independently of the county as a whole, Bellone said. That means the clerk’s office was directing internet traffic through its own firewalls and managing its own security upgrades, which were frequently delayed, he said.

The county clerk’s office did not respond to a request for comment on the findings.

Bellone said the county clerk’s office failed to install a critical $1.4 million hardware update that could have prevented the attack, Bellone said. The Palo Alto report also found that the Log4j vulnerability exploited by hackers persisted in office systems until at least July 1, seven months after US officials advised organizations to apply relevant patches.

As I understand events now and know what happened in retrospect, I certainly would have acted more aggressively to address this issue, Bellone said.

Mr. Bellone also pointed to the office’s chief information officer, whom an aide later identified as Peter Schlussler, for direct criticism. Mr. Schlussler failed to respond adequately to warnings of security threats, delayed upgrades, and hampered the forensic investigation into the attack by denying access to the Registrar’s Office servers, a declared Mr. Bellone.

This obstruction first prevented and then slowed forensic experts in their attempts to examine the Registrar’s IT environment, so that more than three months after the start of the main attack, the Registrar’s IT environment n still hasn’t received a clean bill of health, he said. . The county’s systems were given the green light Oct. 17, he said. As of Dec. 21, Mr. Schlussler had been removed from his position and placed on paid leave, Mr. Bellone said.

Mr. Schlussler denies any wrongdoing. He said Federal Bureau of Investigation warnings about attack indicators were sent to the county but not acted upon, and his office tried to buy a firewall from Palo Alto Networks. in June, but his request had been blocked.

Newsletter Sign-Up

WSJ Pro Cybersecurity

Cybersecurity news, analysis and insights from the WSJ’s global team of reporters and editors.

No one is perfect with decision making in the highly complex technological world, however, I know that I have done my best in trying to raise awareness of the cyber issues that my team and I have witnessed over the course of the year, Mr. Schlussler said in an emailed statement.

Bellone said in June a county committee awarded an additional $700,000 for security upgrades and the county already had the firewall Mr. Schlussler requested.

A county spokeswoman said emails between the clerks office and the county’s IT department show Mr. Schlussler initially told a county technology contractor that his office saw no signs of the attack indicators that the FBI had warned against. He then sent an email to his staff warning them of security issues in a product they were using for remote work, she said.

The IT manager position for the clerk’s office has since moved to the county’s IT department. The county is poised to institute a single enterprise technology and security environment in the future, Bellone said.

The existing system is failing the county government and taxpayers, resulting in millions of dollars in unplanned expenses and the potential exposure of personal information, Bellone said.

Write to James Rundle at [email protected]

Copyright 2022 Dow Jones & Company, Inc. All rights reserved. 87990cbe856818d5eddac44c7b1cdeb8

[ad_2]