An IT Disaster Recovery Blueprint for Municipal Leaders

Municipalities are often targets for ransomware and other cyberattacks. Ransomware attacks get a lot of attention, but there are other cyberattacks that can also be devastating. 

• Distributed Denial of Service (DDoS) Attacks: DDoS attacks overwhelm a municipality’s servers with traffic, causing service disruptions and potentially taking down websites and online services. 
• Business Email Compromise (BEC): BEC attacks involve fraudsters impersonating executives or trusted partners to trick employees into transferring funds or sharing sensitive information. 
• Malware: Malware includes various types of malicious software such as viruses, worms, and trojans designed to damage, disrupt, or gain unauthorized access to systems.

Tornadoes 

In the United States, tornado season lasts from approximately March through July, although a tornado can strike at any time. The South usually gets the most tornadoes between March and May, while the Northern Plains and Midwest are most at risk during June and July. 

Remember, all it takes is an “average” tornado such as an F2 tornado, with winds upward of 150 miles per hour, to cause serious damage. 

Hurricanes 

Hurricane season lasts from approximately June through November, although a hurricane sometimes appears outside of that monthly range. States that most need to worry are the Gulf Coast states (Texas, Louisiana, Mississippi, Alabama) and East Coast states (especially Florida, Georgia, South Carolina, North Carolina, Virginia, and New York). 

Even “mild” hurricanes can cause enormous flooding, power outages, and wind damage, from the coast to far inland. 

Wildfires

Wildfire season lasts from approximately October through January, although wildfires can spread any time. While California gets most of the media attention for its massive wildfires, Texas actually experiences the most. The Southeast is also quite prone to wildfires. 

There is often little warning before a wildfire tears through an area, giving people evacuation as an only option. The devastation to a city or town can be apocalyptic. 

Earthquakes

Thankfully, massive earthquakes are rare, but they can happen out of nowhere. Again, California is an obvious state at higher risk, but states such as Alaska and Hawaii also experience many earthquakes. Earthquakes can quickly destroy buildings—which contain your servers and IT equipment—and lead to permanent data loss and operational disruption. 

Use onsite local data backups to lessen  time to recovery for smaller incidents (such as a server failure). 

An onsite backup solution can get you up and running again in minutes, which is crucial for minimizing downtime in the event of data loss or corruption. Local backups do not rely on an internet connection, ensuring data can be backed up and restored even during internet outages. IT staff can manage and maintain local backup systems directly, sometimes allowing for quicker troubleshooting and problem resolution. 

For example, you might have an older server that dies after a severe power outage as a result of a bad thunderstorm. The onsite backup will take over and operate as that server until you can order and replace the hardware. Because there is a power outage that also prevents your connection to the internet, you are able to run the local backup once your generator starts working, allowing you immediate access to your data. 

Use offsite data backup to plan for worst-case scenarios. Offsite means storing your data backups far from your geographical location. 

Offsite does not mean nearby, or a few blocks down the road. It means geographically distant in case of disasters that take out all your local equipment. Flooding, hurricanes, and tornadoes can easily destroy backup servers onsite, leaving you with permanent data loss. And ransomware can infect all equipment on your network, including your local backups. 

Storing backups offsite reduces the risk of losing all data due to a single catastrophic event affecting your primary location. By keeping backups in a different geographic location, you can mitigate risks associated with localized events, ensuring business continuity. Plus, as long as you have an internet connection, you can remotely access your offsite data while restoration and repair takes place. 

Offsite backups are also less susceptible to ransomware and other malware attacks that can encrypt or delete on-premises data. Data can be stored redundantly across multiple locations or cloud regions, providing additional layers of protection and availability. 

Monitor your data backups. It’s important to identify problems with your onsite and offsite backups before a disaster occurs. 

Data backup monitoring ensures the integrity, reliability, and availability of your data when needed, confirming that backups are completed successfully without errors. 

Monitoring systems can send alerts in real-time if a backup fails or if there are issues. By detecting failures proactively, you can promptly troubleshoot and resolve problems.  

Monitoring includes regularly checking the integrity of the backed-up data to ensure it is complete and uncorrupted. This guarantees that the data can be reliably restored.  

Monitoring can help identify unusual activity that may reveal a ransomware attack or other security threats, allowing for immediate action. 

Ransomware is bad enough—but you don’t want your employees to increase that risk. Yet, many employees are tricked by clever cybercriminals who use sophisticated social engineering tactics by means of emails that contain malicious attachments or links to malicious websites. 

A cyberattacker’s strategy might involve posing as a trusted entity (such as a colleague, boss, or well-known company) and convincing an employee to download a file or click a link. For example, an email might claim to be from IT support needing the user to run a supposed update or security tool. Employees can also visit compromised or malicious websites that may trick them into providing their login credentials on fake login pages. 

Cybercriminals often use these credentials to access networks and systems, where they deploy ransomware manually. They can also gain access to email accounts or other systems, spreading ransomware within the municipality by sending infected emails from a trusted source. 

Train employees to recognize phishing emails and understand the risks associated with opening attachments or clicking links from unknown sources. You can also use advanced email filtering solutions to detect and block phishing emails before they reach users’ inboxes. 

🔎 Related: The Importance of Municipal Employee Security Awareness Training

A comprehensive disaster recovery plan is essential for ensuring that your municipality can quickly and effectively respond to and recover from unexpected disruptions. Your plan should identify potential threats (natural disasters, cyberattacks, hardware failures, human errors) and assess the potential impact of different disaster scenarios on critical business functions and processes.