Survey Finds Local Government and Public Services Vulnerable to Ransomware and Unprepared for Data Recovery

At Arcserve, we frequently talk to IT leaders in the industries we serve as part of our never-ending quest to deliver best-in-class solutions to manage, protect, and recover all data workloads. 

As we looked into some of the industries covered in our most recent independent annual survey, some of the statistics related to government IT departments glaringly stood out.

Those numbers revealed that government IT departments frequently have weaknesses in their data resilience strategies that could make recovering from ransomware—and recovering their data—virtually impossible. 

Disaster Recovery and Business Continuity Plans Need More Focus

The survey found that more than one-third—36 percent—of government IT departments don’t have a documented disaster plan. And just 38 percent of government IT departments have a comprehensive business continuity plan that includes recovery, interim solutions, and communication. That means nearly two-thirds of these departments don’t have a comprehensive plan. 

Put those numbers together, and they spell trouble. A recent Axios headline underscores the problem: “Ransomware gangs zero in on under-resourced U.S. cities and towns.” Getting more specific, the Government Technology website recently featured another telling headline: “Dallas Officials Say Ransomware Recovery Could Take Months.”

If you’re responsible for data resilience and recovery for your government agency, help on this front is easily accessible. The Cybersecurity and Infrastructure Security Agency (CISA) offers a wide range of resources on its Disaster Recovery Consultation, Documentation, and Testing website. The National Initiative for Cybersecurity Careers and Studies (NICCS) also offers a business continuity and disaster recovery planning training course worth considering.

Regardless of how you get it done, ensuring your government entity doesn’t become a statistic starts with a solid disaster recovery and business continuity plan.

Backup Solutions and the Shared Responsibility Model

The survey found that 45 percent of government IT departments mistakenly believe that it is not their responsibility to recover their entity’s data and applications in public clouds. As we wrote in a recent post, cloud providers generally adhere to the shared responsibility model—you’ll find Microsoft Azure’s version here—which means you are ultimately responsible for protecting and recovering your data.

But the survey also found that nearly one in four government workers—24 percent—aren’t equipped with backup and recovery solutions. If you’re a member of this cohort, you need to make changes fast. While the Dallas example cited above may be extreme, the Arcserve survey found that 33 percent of government entities took more than a day to recover from severe data loss—despite 82 percent reporting that less than one day is an acceptable level of downtime for critical systems.

Even worse, only 34 percent of survey respondents said they are very confident in their IT team’s ability to recover all lost data in the event of a ransomware attack. No matter what size your government entity may be, the costs of a data disaster like a ransomware attack in terms of data loss and downtime far outweigh the costs of a solution that helps solve the problem.

"It's like opening yourself up to a one-two knock-out punch,” said Patrick Tourney, executive vice president of operations at Arcserve. “Gaps in protecting remote workers and cloud-based apps and data create an ideal hunting ground for bad actors and ransomware, while not having documented and tested recovery plans leave an organization more vulnerable and poorly equipped to recover data." 

Start With 3-2-1-1

These posts frequently refer to the 3-2-1-1 backup strategy because it works:

• Keep 3 copies of your data (one primary and two backups)
• Store 2 copies locally on two formats (network-attached storage, tape, or local drive, for example)
• Keep 1 copy offsite in the cloud or secure storage
• Keep one copy in immutable storage, a write-once-read-many-times format that can’t be altered

So if you aren’t already following this strategy, now is the time to get started.

Get Expert Guidance

Navigating your data resilience and ransomware protection options is much easier when you rely on Arcserve technology partners' expertise. Find an Arcserve partner here.

To learn more about Arcserve data resilience solutions, request a demo.