1. Purpose. This message contains important security tips for officials in Wisconsin local, county, and state government. Increased tensions with Iran may result in cyber or physical attacks against the U.S. Although there is no specific threat against Wisconsin infrastructure, Iran and its sympathizers have a history of both cyber and physical attacks against U.S. interests. In the past, Iran’s methods of cyberattacks have included spear phishing emails, unauthorized access to systems and malware that erases data. Following basic cyber security practices will help protect you from this and other potential threats.
2. Required Action. Ensure you and your organization are following these best practices:
A. E-Mail Safety. E-mail is the most common entry point for cyber-threats.
- Use caution opening emails from people you do not recognize, or emails with suspicious subject lines, links or attachments. Human nature is generally trusting so being skeptical may mean going against your first instinct.
- Avoid clicking on links or attachments that come from sources you do not recognize or are not expecting. If someone responds to your three-month-old email by sending a link or an attachment, call them before clicking.
- Check with your email provider to see if you can use Multi Factor Authentication (MFA) to protect your email account.
B. Passwords Use complex passwords (i.e. use a long phrase, instead of a word), and implement Multi Factor Authentication if possible. Do not reuse the same password in multiple places. Use a password manager. For instructional videos on these topics, please see the resources section of this memo.
C. Regular Backups. Backing up your computer is the best defense against ransomware. Backup or copy any data/documents onto a separate drive that is then disconnected from your computer and stored in a safe place. For Windows users, type “backup” in the bottom left corner of your screen’s search box or see the additional resources page for a collection of how-to resources. You may want to work with your IT provider for assistance.
D. Update Software & Restart Frequently. Software updates protect you from known vulnerabilities.
- Protect your computer by turning on automatic updates. Since some updates are not applied until your computer restarts, it is a good idea to shut your computer down when you are done using it for the day or restart it regularly. Leaving a running computer unattended for days or weeks hampers your ability to contain or notice an incident. Restarting your computer also protects it by clearing certain items such as typed usernames and passwords that remain in memory until a restart.
- Update any and all software that is on your computer. Outdated software such as internet browsers (even programs you don’t use) are entry points for attackers to compromise your system. A link to Microsoft’s guidance on updating software is on the following page.
3. Resources. For additional information on the actions above, you may wish to visit these links from Microsoft and the Global Cyber Alliance.
Microsoft’s instructions on how to enable automatic updates for your computer: https://support.microsoft.com/en-us/help/17154/windows-10-keep-your-pc-up-to-date
Wisconsin Elections Training video on password complexity: (requires login) https://electiontraining.wi.gov/mod/scorm/view.php?id=367
The Global Cyber Alliance’s toolkit for password complexity, password managers and Multi Factor Authentication: https://gcatoolkit.org/smallbusiness/beyond-simple-passwords/
The Global Cyber Alliance’s toolkit for how to back up your computer: https://gcatoolkit.org/smallbusiness/defend-against-ransomware/
4. Questions. If you have any questions, please contact the WEC Help Desk. Call 608-261-2028 or e-mail @email.