Author Information: The Motorola Solutions Cybersecurity Team

As cybercrime against public safety agencies continues to rise, it is more important than ever not only to take steps to defend your agency but also to understand how threat actors are operating. Earlier this year, the Public Safety Threat Alliance (PSTA) published a report on the most common threats impacting public safety, top tradecraft used against public safety networks, and the most beneficial defensive measures agencies can take. This blog shares important highlights from the report. 

Cyber Threat Landscape Overview 

Cyber attacks against public safety are on the rise with a 64 percent increase last year, with the following countries and regions being significantly impacted: 

Public safety compromises are at an all-time high. Extortion and Data theft attacks are frequently far-reaching and often disrupt mission-critical systems such as computer-aided dispatch (CAD), with examples of dispatchers forced to operate using pen and pencil as the result of attacks in the last year. The ever-growing threat of cyber attacks against public safety continues to show the importance of strengthening your organization’s cybersecurity program. A key way to prepare for these threats is to understand how threat actors operate, which tactics they prefer and how to avoid being vulnerable to those tactics. 

Tips & Tricks for Specific TTPs 

There are many tools you can use to strengthen your cybersecurity, including the MITRE ATT&CK Framework, which is a knowledge base that uses real-world observations to define the tactics, techniques and procedures (TTPs) that threat actors use along the attack chain. The MITRE framework identifies over 800 TTPs, but the PSTA threat intelligence team observed threat actors employing only 21 percent of these TTPs against public safety organizations over the past 12 months. The PSTA has defined the top TTPs used against public safety agencies and how defenders can identify and block them. 

Credential Abuse 

Credential abuse, or the use of valid accounts to gain access to networks, was the most common factor in public safety attacks this year. Threat actors use popular tools like Mimikatz to steal employee logins and access the network. Last year, 29 percent of threat actors used legitimate logins to access networks. 

Agencies can help to mitigate this risk by enforcing multi-factor authentication to prevent stolen logins from being used. Security teams should mandate regular password updates, ensuring they are changed from default settings. 

Command and Scripting Interpreter 

A popular attack method threat actors use is “living off the land,” which is when attackers exploit systems and applications that are already on the network. With this particular type of TTP, attackers will often use existing command shells — a directive to a computer program to perform a specific task — to execute commands that allow them to install malware onto the network. 

Application code signing allows security teams to digitally sign commands to ensure that the code has not been altered or corrupted. Implementing this on your network is one way that you can prevent unwanted code execution. Defenders can also restrict the command shell language in use at the organization. Any command shells that are not necessary to your daily operations should be disabled. 

Remote Desktop Protocol 

Remote Desktop Protocol (RDP) is a common way that threat actors gain access to systems and then move deeper into the environment, known as lateral movement. Lateral movement and credential abuse often go hand in hand. Threat actors will use stolen or purchased credentials to log into numerous network points through RDP if enabled. 

RDP is not always necessary for day-to-day operations, so an easy way to mitigate the risk is to disable it within the network. If RDP is needed, agencies should monitor for anomalous logons and connections that can indicate that an outside party is using RDP to access your network, such as, 

Public Facing Applications 

Because threat actors are opportunistic, they will look to exploit networks that are easily accessible. Exploiting vulnerabilities is a top method that threat actors use to gain initial access to a system. Legacy systems that haven’t been updated typically have more vulnerable public-facing applications and are the number one target for these types of attacks. Agencies should ensure that all external-facing systems are routinely patched. Risks can also be mitigated by ensuring that systems connected to the internet are not exploitable via RDP or VPNs. If these services are crucial, then make sure that all security features are enabled. 

Conclusion 

The last few years have seen an ongoing increase in cyber attacks against public safety. New threat actors are consistently entering the landscape and adding new challenges and threats for public safety agencies to watch out for. Extortion remains the number one threat to public safety, but with the introduction of new threat actors, agencies need to be aware of other TTPs that are being used. The upward trend in cybercrime is expanding more globally as well. The continued and ever-growing threat of cybercrime enforces the need for a strong cybersecurity program. 

About the Public Safety Threat Alliance 

The Public Safety Threat Alliance (PSTA) is an information sharing and analysis organization (ISAO) established by Motorola Solutions and is recognized by the Cybersecurity and Infrastructure Security Agency (CISA). The PSTA regularly publishes research, which is available to members. It also hosts regular webinars featuring our cybersecurity analysts and other experts. Joining the PSTA provides threat intelligence for member organizations at no cost.