RAPID CITY, S.D. – Based only on the little information released by authorities so far, two cybersecurity experts said it is likely that a malicious foreign entity is behind the recent cyberattack that crippled communications and other computer-based systems in Pennington County government. Two federal agencies, meanwhile, have recently warned state and local governments across the U.S. that cyberattacks are increasingly likely, and that such attacks are likely to originate in Iran, China or Russia. On July 5, Pennington County announced that a “cybersecurity incident” had occurred and affected parts of the county’s computer network. The county shut down public access to government services for a day and has since embarked on a major multi-agency investigation. The county continues efforts to bring back communication and other computer-based systems. County officials said critical county services such as the sheriff’s office, courts, 911 dispatch and jails have remained operational since the incident. Several county functions such as computer-based communications, internet access and providing record keeping and registration services to the public were slowed or otherwise affected by the incident and response. “Unfortunately, there’s not a lot I can say because it’s an ongoing investigation,” Pennington County State’s Attorney’s Office spokeswoman Katy Urban told News Watch. “If anyone’s personal information has been compromised, we will contact them directly as required by state law.” Elements of the cyberattack point to an adversarial foreign government as the responsible party, said John Strand, owner of Black Hills Information Security, a Sturgis-based company that is an industry leader in cybersecurity. Strand told News Watch in an interview that cyberattacks on American government entities typically originate from one of two sources: international organized crime groups that seek money from victims or international adversaries that either seek intelligence on U.S. networks and systems or intend to disrupt daily life in America. Since county officials have not discussed any demands for ransom from the cyberattacker, it is more likely that a foreign adversary of the U.S. is behind the attack, possibly Iran, China or Russia, Strand said. The New York Times on July 30 quoted anonymous state and federal sources in an article indicating that Iran is the likely culprit of a major cybersecurity attack that sought to disrupt water systems in more than 30 communities across Minnesota in late July. The Times said federal officials were concerned the cyberattacks could be a new salvo by Iran in its ongoing war with the United States. A more aggressive cyberattack could not only disrupt critical services in the U.S. but could interfere with systems that keep people safe, Strand said. For example, a cyberattacker could contaminate or limit access to drinking water, send sewage to places it shouldn’t go, disrupt medical or prescription drug information or even affect safe operation of traffic lights, he said. “The biggest concern that I have is a cyberattack that leads directly to a loss of life or multiple people losing their lives,” Strand said. Both governments and private industry should expect more cyberattacks in the future, said Bryce Austin, a cybersecurity expert and the CEO of TCE Strategy, a Minnesota-based firm that provides cybersecurity protection. The “one-two punch” of cyberattacks in South Dakota and Minnesota within the same month is concerning but not overly surprising, he said. Several signs point to cyberattacks by Iran, which may be trying to make a statement as it continues to battle the U.S. in war, Austin said. “I think we’re cannon fodder in the Iran war,” he said. “It’s like they’re trying to send a message that they can attack us from halfway around the world.” Strand, who launched his family-run company in his basement near Deadwood in 2008, has grown the firm to 160 employees who conduct 950 security assessments annually across the world. He complimented Pennington County on how it has handled the security breach so far but said it would be a “tragic mistake” if the county doesn’t release a full accounting of the attack and its response at some point. “Just trying to hide it and bury it is almost always the wrong answer,” Strand said. “We better get used to it because this is the new normal.” Share via: Facebook Twitter LinkedIn More