Well, you know, I'm in cybersecurity incident
response, so people don't want polio and they
don't want bolio to show up. That's great. Welcome
to County Connection, the official podcast of
the Washington State Association of Counties,
where we dive into the legislative issues shaping
the future of our communities. From budgets to
public safety, infrastructure to elections, we'll
break down what's happening in Olympia and how
it impacts counties from across the Evergreen
State. Stay informed, stay engaged, and join
us as we amplify the voice of Washington's 39
counties. Welcome back to County Connections,
the podcast dedicated to navigating the ever
-evolving world of county government in Washington.
I'm Derek Young, Executive Director for the Washington
State Association of Counties. As a leader in
county government, you carry the weight of your
community's trust. You are the steward of the
most sensitive data, tax records, health information,
Public safety details. You are the guarantor
of the essential services that they rely on every
single day. But what happens when 911 dispatch
center goes silent? When a ransomware attack
freezes the county clerk's office, halting property
sales and marriage licenses? What happens when
the public's trust begins to erode? Today, county
governments are in the crosshairs of sophisticated
cyber criminals. They know you operate with limited
budgets and legacy technology. We'll see you
next time. Thank you. I'm glad to be here. It's
exciting. We've been talking about it for a while
now, so it's great to finally be able to do this
partnership. Yeah, I think we first chatted maybe...
the beginning of the year or even last year at
some point and finally had the chance to meet
at our annual conference at NACO and get a chance
to know a little more about Crow and what you
all do. So appreciate you taking the time. Yeah,
I appreciate you answering my cyber stalking.
So, you know, that's helpful. Well, it's good
that you mentioned that because we're going to
get into it. Give us a little bit of a picture
of what the... The threat landscape looks for
looks like for cybersecurity and county government
or in local governments in general. It is wide
ranging what the threat landscape would look
like. But our number one successful tactic that
we're seeing from threat actors is social engineering.
Unfortunately, that means as from a cybersecurity
side, what can I do? Not as much. It's more about
the education. It's listening to this podcast.
Hopefully everyone's taking it seriously. It's
every employee, every elected official's responsibility
to think when it comes to that social engineering
attack. And when I say social engineering, you
probably just thought phishing, which is hugely
successful. normal attack pattern. And so just
to help define that is, you know, those emails
that you get that say, Derek, click on this link
and fill out this form for me that that gives
me access to our network, basically, that that's
what you're talking about. Yeah. And it used
to be very generic and it could have been misspelled
words. But with the. introduction of artificial
intelligence, especially generative AI, I think
like a chat GPT, the threat actors are able to
write sophisticated emails that make you think
your password needs to be reset, that your benefits
are changing, and to log in to see what those
changes look like. And what they're trying to
get you to do is click a link. or download something
to your computer, open up a file, and they're
doing that through anxiety. They're trying to
make you concerned or want to know why something's
happening, creating a sense of urgency, so that
way they can gain access to your environment,
whether it's your email and nothing further than
that, or into the actual county environment.
That's what we're seeing is the top attack right
now. But it does go beyond what we were describing
with those emails. We're really seeing a movement
towards text messages at this point. Oh, interesting.
Where you're getting a text message. And the
latest one we saw is DMV. I don't know if in
Washington you've been getting those. But over
the summer, I got a lot of them that said the
DMV didn't get your records or your registration
is about to expire. Lots of toll. Yeah, the toll
one. That's a big one. Somehow, I've never been
to Mississippi, but I had overdue tolls there
that I had to pay. That's a two -part attack
because it's not a link. There's nothing in that
text. What you do then go to is Google or some
sort of search engine, and you type in Mississippi
DMV, and most people just click the first link.
But that first link is a sponsored link. It's
a paid link. Oh, wow. Threat actors are paying
to get their fake links on search engines. So
what we advise is never click on a sponsored
or an advertisement. Always look for the ones
that don't say that on the links. That's incredible
because they're reducing your distrust of clicking
on their link by having a secondary step. that
I'm now taking on my own part. But they've planned
ahead and get you to click on that link through
the sponsorship. That's diabolical. Well, threat
actors, this is a business for them. They're
millions of dollars a year just from public sector
alone. They have to keep out. thinking what we're
doing. So as we're evolving, they have to evolve
in order to be successful. So you talk about
it as social engineering. And what that really
means is that, you know, in the movies, we see,
you know, the cyber criminals behind a keyboard
rapidly, like typing out something like, you
know, that's how you attack it. It's like an
artillery barrage of keystrokes. When in reality,
it's more. like uh you know playing on human
behavior and finding the weak links in the organization
that are going to um expose the organization
effectively so that is that what don't you're
getting in yeah when you say that all i could
think of is the movies where they're like oh
they're being rerouted they're bouncing over
to this part of europe now they're going into
africa i'm following them i'm almost caught up
to where they are they keep redirecting uh yeah
it's none of that what what we're seeing is threat
actors uh sometimes in english -speaking countries
most times not uh operating while we're sleeping
that's their you know because it The change in
times, that's when they're awake. They're attacking
through psychological warfare. They're getting
to the anxieties, our urgencies. When it comes
to the social engineering attacks, when it comes
to the threat landscape as far as your networks
go, they're very... They have very few tactics
and techniques that are successful and they just
exploit those same ones over and over. There's
only about 250 total tactics and techniques that
threat actors use to get into our environment.
But they work and they work really well. And
it's just minor adjustments that they're making,
not a full on change of how they're operating.
Gotcha. You know, I kind of reminds me of like
the way people. rob banks is the the because
i used to be in banking and uh there's the ones
you see in a in a movie which usually are takeover
and those exist uh they're very scary and very
dangerous um but they're also extremely rare
uh because you know usually those are the ones
that get caught uh the person that passes a note
and is careful about you know you know what they're
doing to get around your security measures are
unfortunately often very successful. So it's
less brute force and more, you know, permissive,
so to speak. Yeah, the threat actors don't want
to be caught. So they're going to do what they
can to be quiet. When it comes to an actual attack
on the network, the number one technique we're
seeing right now is through the VPN. So if you
have remote workers, if your county allows for
people to work remotely, That is going to be
the number one way that they're going to try
and get into your environment outside of that
social engineering. And it's through either brute
force password breaking, which is just trying
passwords over and over again until one works,
or going on the dark web and seeing if there's
old passwords that are still usable. for your
VPN. And I could name an example every single
month, at least one a month where we're working
with counties because they had a ransomware.
So they, their environment gets encrypted through
them getting in by the VPN. You know, it's a
necessary danger that we have by those VPNs.
Yeah. And that's. That's particularly scary since
these days, almost everyone has a lot of remote
workers. And so if there's lots of paths in there,
they have lots of different access that maybe
in the old days when you needed to be on site
didn't exist. So you kind of touched on ransomware
there, which is what I wanted to get to next.
And talk to me about what. their goal is? Why
are they breaking into these systems? Or why
are they injecting in ransomware or malware,
whatever you want to call it? What's the outcome
they're looking for? Sure. And it depends on
the threat actor. If we're talking ransomware,
most likely it's organized crime. But there are
other... hackers that are getting into your environment,
such as nation states like China, Russia, Iran,
North Korea. I'm happy to talk about those. But
when it comes to ransomware, that's specifically
organized crime like Qilin or Scattered Spider.
Those are two very popular organizations right
now. And Qilin is the number one that's going
to hit the public sector, whether it's state,
local, city, tribal. They are hitting with vengeance
right now. About 50 a month, Chilean is successfully
ransoming different entities, whether it's public
or private sector. So they are the number one
out there right now, and they're looking for
a payout. Whether it is you paying directly or
selling the information to get money from another
threat actor, it's organized crime. This is a
business with hierarchy. They have a leader.
They have KPIs that they have to meet every month.
They have their own HR team, their own help desk.
It is very organized crime. a county trying to
protect against kids in their mom's basement
kind of hacking. This is a multi -million dollar
business that we're trying to prevent. I love
the idea of a gang of cyber criminals going over
their weekly KPIs just to make sure the team
is staying profitable. On that note, I love sharing
stories just to make sure to hit home how real
it is. Earlier this year, I was working with
one ransomware with a county, and they were asking
for $2 million. And we come back and said, no,
we can do $200 ,000. That's all we can do. And
they countered, and we're countering back and
forth. And it got to the point where the threat
actor that we're talking to said, I have to go
talk to my boss. Hold on a second. So just to
think, you know, I have to talk to my boss. It's
it's a very real organization. And another one
that we talked about that feels like a car sales
or like, you know, when you go back and forth
and like, I'm going to have to go back to my
sales manager here. Yeah. And it's very. psychological
back from us to them uh at crow we have a team
that specializes in talking to threat actors
because we sometimes have to hurry them up because
they're too slow uh other times the threat actor
is anxious and we have to calm them down so that
way they don't just exploit or put our clients'
data out on the dark web. So it is very psychological
when we're trying to work with them. But it goes
back to that organized crime. They're looking
to, it used to be what they wanted to do was
just encrypt the hard drives. And then they would
say, you know, pay us $500 ,000, we'll give you
your hard drives back. But thankfully, we've
been evolving as counties and organizations,
and we're starting to do better backups. Because
of that, organized crime needs to figure out
a way to adapt. And they're now introducing,
over the last couple of years, double extortion
is what we call it. Not only do they encrypt
the devices, they try and delete the backups.
But if they can't, they're still going to encrypt
it. But then they threaten to put the data on
the dark web. And that's where we're seeing just
as many payouts coming from, is that data being
threatened to be exploited on the dark web. than
we are actually because of backups at this point.
Oh, wow. In August alone, there were three different
counties that paid, even though they had good
backups, because of the sensitivity of the data.
Yeah, that's scary. So that's the organized crime
aspect of the risk. Profit motive, very clear.
They want to get paid and get out. You briefly
touched on the potentially scary one, and that's...
national actors. Tell me a little bit about what
their motivations might be and what they might
be looking for in county government databases.
From a county perspective, organized crime would
be your number one target. Threat actors are
going after the counties. But when it comes to
nation states, they all act, think, and want
different things from the United States. Going
down the list, China is very much interested
right now. in ISPs, your internet service providers.
They're always looking to try and get into your
Department of Defense and anything tangentially
related. Think F -22s when they stole all that
information. But when it comes to counties, it's
the internet service providers. And why they
want to get in there is they're trying to get
into your AT &Ts, your Verizons, so that way
they can monitor that traffic leaving your environment.
And they can start to see what data is going
back and forth. spy on us. They're not interested
in ransomware. They're not trying to get money
from us. They're just trying to know how we think,
what we're talking about, and any sensitivities
that they could exploit at a future time. Russia
is more in the now. Because of their conflict
with Ukraine, their focus is on infrastructure.
Where could they hurt us? Where could they hurt
Ukraine? And what does that target look like?
What I find interesting is Iran is not doing
much of anything. They used to be a bigger player,
but over the last, we'll say, year, I'm not sure
exactly how long, they've gone very silent. And
that's not normal for them. So it's interesting
to see that they're pretty quiet right now. And
North Korea is focused on trying to get monetary
theft from us. With all the sanctions we have
against North Korea and how... isolated they
are, they're trying to figure out ways to make
money. Sure. And I guess you could say they're
very much more along a criminal enterprise. Yes,
definitely. It's not just cyber. They're constantly
stealing other stuff. And which is, you know,
when you're desperate, I suppose that makes sense.
Are there are there any countries that people
would find surprising that that are risk to us
in our cybersecurity? We do see other nations.
interested in us. There are some South American
countries. I'm always cautious because we are
being in the government for many years. It's
not one way. Sure. There's an argument that could
say we started it when it comes to how nation
states act with the thinking and just trying
to learn how things are going. But yeah, there
are countries all over Europe, Africa, South
America that are interested in learning our secrets
and trying to get in. But they're very much like
a China where they're trying to learn. They're
not trying to be disruptive. Yeah, it's more
traditional intelligence gathering. Exactly.
you know, trade secrets, you know, businesses,
you know, things like that. That makes sense
to me. Maybe not always something that is on
a county radar, but in some cases could be, you
know, we have, you know, members that have relationships
with large industrial companies that might have
some information that would be valuable to other
companies and other countries, but not necessarily,
you know, what we would see is. dangerous per
se. Yeah. What we would be looking for also in
Washington for your counties would be the relationship
with some businesses. You have some pretty large
businesses that are well known in Washington.
And the idea would be if we could get into a
county which typically doesn't have the same
resources to prevent it, is there a backdoor
into those businesses? So I could... I see Washington
as being an avenue for that also. So that'd be
something to, you know, what could raise the
alarm for counties there. Yeah, definitely a
few large companies that have relationships with
our members. And you know who I'm talking about.
I don't want to name any names here. Yes. So
talk about how counties can protect themselves
because. This is very much not the normal, like,
you know, we put up fences to protect ourselves
from, you know, predators. It's they're using
us to get into the hen house, so to speak. So
what can counties do to protect their systems?
Before going into the systems, it's really. focusing
on education. I've seen many counties that say,
you know, I'm a smaller county, I'm a mid -sized
county. I don't have the resources or I don't
have the personnel. We're just trying to get
IT working. We're trying to make sure that everyone
has the laptops to do their job. That is always
number one, right? We have to make sure the employees
are able to meet the expectations of the constituents
in Washington. But we through education and awareness
like this podcast and future webinars, hopefully
that through the association, there's a lot of
free content out there. Just making sure that
everyone knows that this is real. This is something
that involves them directly. Their part goes
through that social engineering attack. How to
prevent that. We saw in July that there was a.
a successful attack through what we call a business
email compromise, where the accounting department
paid out $300 ,000 to a threat actor when they
thought it was to their vendor. So there's nothing
IT could do to prevent that. That is a education
and awareness. And that's where it starts from
a server side or that in the weeds, the geek
side of things. It's looking at it from a multi,
approach. We call it a defense in depth strategy.
Try and keep the threat actors out. But you have
to assume they're going to get in. When they
do get in, we're trying to identify that they're
in there as quickly as possible and make it as
difficult as possible to move around inside the
environment. But we have to assume they're going
to get to the servers themselves. When they are
on there, how can we isolate that server to keep
the rest of the environment operating instead
of the other way around? If the threat actors
aren't able to do a ransomware on us, but they
still take down our network because we isolated
everything, they still won. We're still disrupting
the counties. And to think of the... Prison systems,
not being able to access the data that they need
for the sheriffs, not be able to communicate
with 911, not being able to pay the employees.
That is very disruptive to a county. So whether
or not you paid a ransom doesn't matter at that
point. They were successful in disrupting our
way of living. And so being able to isolate the
problem, not isolate everything else, is really
that last step that we're looking for. It starts
with your remote access. When you're dialing
in, when you're logging in. See, that's how old
I sound right there. I said dialing in. No one
knows what a dial -up is anymore. But when you're
logging in and you're annoyed with that multi
-factor authentication, and hopefully you do
have MFA, just be thankful that your county IT...
put MFA on there, trying to help stop the threat
actors from being able to enter. When they make
you reset passwords on a regular basis that are
complex, 15 characters long, it's to prevent
a brute force attack. It's to prevent going...
known passwords that were exploited on the dark
web from being successful. You know, I'm looking
at my sheet right here and I'm counting 12 different
ransomwares over the past six months that were
from VPNs being exploited and then being able
to move around inside the environment and that
they all paid the ransom either because of backups
or because of that sensitive to the data. Wow.
That's, that's interesting. So tell me about,
I'm sure you've got some. great stories and examples
of, um, uh, of incidents that happened and, you
know, what was the outcome and give me a couple
examples, maybe of counties, if you have any
of, uh, of, uh, successful hacks. Looking through
the different ways that can happen, I can definitely
talk to, uh, all sorts of examples, but one that's
been, I've been focusing a lot on lately. is
vendors which sounds weird because technically
i am a vendor but vendor it or a partner however
you want to use that word we we should be the
greatest asset to a county and county should
use vendors but we they also have to be careful
because they don't control the vendor so whether
it's another entity connecting uh software a
server in your environment You need to have some
sort of protection against things you can't as
a county control. And an example of that is in
the Southwest. In March, they got hit with a
ransomware and took down their entire environment.
They didn't have any backup solution in place.
They refused to pay still, so they just rebuilt
from scratch. But they were taken down because
of a third -party software. It was exploited.
That company was ransomed, and by doing so, it
moved Encrypt into the county environment. The
threat actor didn't even know they took down
the county. They thought they were going after
just a business. Oh, wow. But it ended up crippling
for three weeks the county from being able to
do anything. So we had to stand up. laptops from
Best Buy and wireless routers and, you know,
connecting to the local cell phone towers to
be able to give them some sort of business while
we rebuilt their entire environment from a vendor.
Wow. So because they didn't end up paying, they
had to rebuild everything? Like it was literally
from scratch? Yeah. And even when you have backups,
not too many people understand how it's still
a slow process. When you get hit with the ransomware,
the first step is to call your insurance provider
and then they're going to get counsel involved.
And counsel is usually the one that hires companies
like mine because that way you have that attorney
client privilege. Right. That will call that
a day. From there, we have to scope and contain.
We have to understand where is the threat actor's
movements in the environment because we don't
want to bring you back online if the threat actor
is still in the environment or we don't know
how they got in because they could just get back
in a second time. That's a couple more days.
And then we're going to start to say, what are
the most critical servers or applications that
you need brought online? And typically that's
the sheriff's department and accounting departments.
You know, best case scenario with good backups,
you're talking a week before you're back online.
And that's your best case scenario. So then you
say, how good are your backups? How quickly did
you call us? Two, three weeks later, you're finally
back online. It is, it's a journey. And, you
know, I think of the city in Texas that chose
not to pay. We didn't work this one, but we chose,
they chose not to pay. They didn't have good
backups. It's been six months and they're still
rebuilding their infrastructure. Incredible.
I mean, I can't imagine how disruptive that is,
you know, not only to the government, but to
that community, you know, just that relies on
those services. It just is a local example. The
I don't know what happened to I never did hear
them say it publicly, but the our court system,
the entire court systems websites were down for
like, I want to say a month and a half. something
along those lines. And it was just incredibly
disruptive. And I can't even imagine if you have
like a whole county system, you know, basically.
offline for that much time. Yeah, it's very disruptive.
And unless you experience it, you just truly
can't understand how long it can take and how
disruptive it really is. I highly recommend every
county do tabletop exercises and at least run
through the scenarios. Bring in your vendors,
your most reliable or critical vendors. Bring
in counsel and run through that scenario. If
you need help, maybe... association or counties
near you, we can help. But the more you can practice
bringing everything back online and what that
looks like and how things are affected, the faster
you can make the decisions and get to recovery
in the actual incident when it does occur. What
I like to remind people is not usually an if,
it's a when you're going to get hit. And with
that kind of mentality, you can better prepare
for that cybersecurity protection. Yeah, that
seems like a good strategy. So and this is part
of the part of the conversation that we had at
the conference that I was most interested in.
That seems almost absurd, but it's the it's the
part where you you've you've been you you've
have a ransom ransomware incident and have received
some sort of communication with the actor. Talk
about what those. what those communications with
them looks like, because it's not at all what
I expected. I think at one point you said your
negotiators, you know, earlier you mentioned
that they they need to speed them up or slow
them down, depending on. So they're using kind
of some human engineering, even going the other
direction. Talk a little bit what that looks
like. Well, first, I highly encourage if a county
does get hit. Yeah, you're going to get a ransom
note with a code to talk to them. Please don't.
We've had some counties that start to do the
negotiating on their own. Hold off, bring in
an incident response team and let us communicate
with them and through counsel's advice. I can't
stress that enough. But it is a very interesting
communication back and forth. And it starts with
proof of life. Well, when we say we can put in
the code. We start, we get redirected to someone
that we can talk to. Think of a chat bot on a
website. That's going to be what it's going to
feel like. It's just a chat back and forth. But
because we're on off hours of a threat actor,
it's usually one or two chats. Then we have to
wait another day and then we get, they're going
to get there. the response, and then we submit
it. And then usually the next day they send it
back. So it's a very slow chat back and forth.
And it starts with us wanting to prove that they
have to prove to us that they actually have what
they said they had. So again, double extortion,
they've taken our data, they've data exfiltrated
it. to their environment. So we say, show it
to us, prove it to us. And they're going to give
us a list. And then we'll take that list and
go to the county and say, does this look like
your data? It's just going to be file names.
And they're going to say, yeah, that looks like
it could be ours. And then we'll ask the county,
what file in here do you want to see that would
actually prove that they have the data, not just
file names? And the county should be giving us
three or four. example files and then we'll go
to the threat actor and ask to say decrypt those
to one prove you can decrypt them and two so
we can make sure that you actually have the data
so that that proof of life they're going to give
to us and at that point we've established they
do have the county's data they have we know the
file structure that they took so we can kind
of identify how sensitive it is Especially if
in the sheriff's department or the judicial system,
you know, we're talking very sensitive data,
cases with minors, private police that are under
or sheriffs that are undercover that could be
affected by this. And that's what we're really
trying to find out. But then also from a regulatory
and legal response side of it. Who do we have
to notify and how quickly do we have to notify
who is affected by it? And it's that communication
back and forth where we then start to negotiate
price. And we may be negotiating price not because
we're going to pay, but we always negotiate price
because if you don't negotiate the ransom, they're
going to expose the data. on the dark web. And
we may not be ready for that yet. It could be
that we have backups that we want to test to
see if the backups truly work. And so we're just
delaying it and we're slow playing it. We're
going to lowball them and go back and forth in
price. It's kind of like a discount store. I'm
never going to pay full price. I'm always going
to get some sort of discount off that ransom.
And if you have good backups, but you want to
protect the data, that's another argument that
we can make with them. Give us a price. for you
not to put the data on the dark web, but don't
give us the backups. And then they'll give us
a new price and then we can negotiate from there.
But threat actors are very smart when it comes
to the pricing. They're looking at the county
size. They're looking for your insurance policies
in your file structure. to see what the insurance
company is going to pay out because they're never
going to ask for below that. They're going to
try and ask for more than that, but they know
what the insurance is going to pay. And on the
private side, they're going to like Zoom info
to find out what your revenue is so they can
ask for a percentage of that revenue. Interesting.
So they're gathering quite a bit of intelligence
before they're getting into these conversations.
It's interesting you use the phrase proof of
life because it reminds me of, You know, what
I've heard from friends that were working for
banks and overseas in areas with problems with
gangs using kidnapping and effectively the same
way where there's a there's a negotiator that
is brought in that is, you know, outside of law
enforcement and outside the company. But that's
what they do is talk to these ransomers, basically.
Yeah. And it's not too many people inside Crow
that. have the skill to talk to the threat actors.
And there's just a couple of them. We rely heavily
on them. Yeah, that's incredible. What a strange
negotiation that must be is, you know, just dealing
with these criminal gangs frequently. What we're
looking for, the best case scenario when it comes
to this situation is a county that has gone through
the exercise, through the tabletops, understands.
how the threat actor organized crime works. So
we don't have to go through that explanation
that has the proper backups and that we're just
delaying the tactics with the negotiations to
bring everything back online. Like that's. That's
as good of a situation you can get in a bad situation.
What really slows down the recovery is when it's
a county that's not prepared, that doesn't have
the backups, and it's trying to figure out, can
they pay? Should they pay? Knowing, having as
much as you can ready and understanding can speed
the recovery process up. And in the end, that's
what we're looking forward to. Make it so the
threat actors can't get back in and recover the
environment to get them back to operating per
the usual. That's great. Is there anything that
I missed that you think our members should know?
A couple things. If you aren't sure, something
feels off. Please call the insurance, call the
council, and then they'll work with us or just
bring us in. If we notice that there's a threat
actor in your environment, we'll immediately
stop to go through council. But nation states
and your business emails that are compromised,
your phishing attacks. Those are going to be
very difficult to know if you are already compromised.
And it's still something we have to take care
of and identify what scope has occurred. Ransomware
is easy. We know immediately. Phones are down.
Computers aren't working. Can't access your applications.
There are very telltale signs for ransomware,
but there's so many non -ransomware areas that
can be affected. If something feels off, just
bring us in. And then the other thing would...
be what proactive steps are you taking? I talked
about the defense in depth strategy, but what
actual steps are you taking? How is your password
hygiene? Do you have MFA properly set up? And
are you separating MFA being multi -factor authorization?
Yeah. Multi -factor authentication. Sorry. Authentication.
Gotcha. For at least remote access in is what
you're looking for in for admin. credentials.
But some of the best practices would be IT. If
you're listening, don't be using your admin credentials
for everyday use and have alerts tied to those
admin credentials. So that way, you know when
a threat actor could be using it because you're
not using it that day or at that time. What we're
trying to look for is early warning signs and
what can we do to make it difficult for a threat
actor to move around in your environment, which
could be include, let's separate our data. There's
no reason that someone that is working in accounting
should need to get to HR's data. So separate
them. Make it so that way if a threat actor somehow
got into HR, they're not getting to accounting.
They're not getting to the CJIS data. Separate,
know where your data is and separate that data.
And then test your backups. You should have backups.
Test your backups to see in this situation, will
they actually provide you the data that you're
looking for? One thing that I think, You know,
our largest members probably have, you know,
an IT team, risk managers. And so they probably
know, you know, have a picture of what their
needs are. But a lot of our smaller ones may
be thinking, gosh, this sounds pretty overwhelming.
Does your company, you know, provide like a scalable
resource that, you know, our smaller members,
maybe more even, you know, the medium sized ones
that they're able to work with you to help, you
know, practice, you know, good password hygiene
and all those things that you talked about? We
do. I solely work on the public sector side.
It's a passion I've had. When I left the Department
of Defense, it felt. We're going private sector.
So at Crow, I stayed in the public sector so
I can help. I can do my part to help the state
and local governments. And I'm very conscious
of not, you know, not every county has a large
budget. And but every county is susceptible and
exposed to threat actors. So what can we do either
at Crow? But also the larger counties, what are
you able to provide through knowledge transfer
to the smaller counties? And as an association,
you're doing your part. You're bringing us in
as a trusted partner. So I appreciate that. From
our conversations, you're bringing us in. We're
here to help. Small counties, we will work with
them in a different way. Maybe it's through checklists.
It's through identifying the key areas, doing
more of the work for them, getting them. Connected
with a managed service provider that could be
hands -on keyboard. We tend to be more in the
advising role with this is what best practices
look like. These are your action plans. This
is your three -year strategy. And then connect
you with a service provider that can do that
work for you. And as the county grows in size,
we switch from that kind of advisory role to
more of the assessment and audit to your bigger
counties. So the larger counties, it's going
to be us coming in and testing your response.
What you have in place, will that suffice? Are
you ready? Are you trained? Do you understand
what the alerts you have are telling you? And
are you ready to respond to those alerts? Thank
you. And one last question I have to ask, and
you can skip this one if necessary. But does
the Cyber Command really have a big map on the
wall with a bank of computers with a bunch of
people behind it, like Mission Control, you know,
in the movies? I don't know anymore. Again, I
started before Cyber Command was even stood up.
I remember when the Army and the Air Force Ones
were really becoming what they are today. And
they all do have large maps, not nearly as cool
as they look like on movies. You know, I think
of so many movies where they like grab the screen,
like something on the screen to throw it up on
the wall. And like now they expand it and they
use the words like enhance, enhance. You know,
it's nothing nearly that sophisticated. But it's
when it comes to proactive work. It's really
looking for the anomaly. What's not right? What
doesn't fit what we're expecting? That's what
I would call that Snowden effect, that where
is something where they're not supposed to be?
And then we kind of pull and tug at that string
until we figure out what's happening. That's
ideal because that means we hit it before the
ransom occurred. Gotcha. Well, thanks again,
Joe. Really appreciate you coming on the pod
with us. And I look forward to you meeting all
of our members. Yeah, thank you. I'm excited
and we're excited and really getting to know
all the different counties in Washington. Thanks.
All right. Thank you. Thanks, Joe. Thanks for
tuning in to County Connection. Stay in the loop
by subscribing to us through your preferred podcasting
app and following us on LinkedIn, Facebook and
Instagram. And don't forget to join the hub,
your go to source for the latest news and updates
from the Washington State Association of Counties.
Until next time, stay connected and stay informed.