Council braces for potential cyber attack

Faced with the ever-present - and growing - threat of someone hacking its computer database, Wanganui District Council is ramping up security.

The council audit and risk committee has been told of the impact of cyber crime by representatives of insurance brokerage AON New Zealand.

They learnt four New Zealand councils had already been hacked and the organisations' computer systems were locked until they paid a ransom.

Council deputy chief executive Julian Harkness told the Chronicle that staff had included IT (information technology) on a specific risk register.

"There are times when experts are called in to assess risk but risk is a moving feast and that's why it is a part of this council's culture for everyone to be aware of it," he said.

AON representative Sam Ketley told the committee cyber crime was the fastest-growing global risk and was already costing New Zealand business about $500 million a year.

"We know of four councils that have been hit," Mr Ketley said.

He said every council using IT was exposed to potential threat and said AON had clients whose data had been "locked" until a ransom was paid.

A Wanganui computer expert told the Chronicle the ransom was usually US$1000 ($1589) for the first 24 hours and then increased gradually until the ransom was paid.

For the council, the good news is it is insurable through a policy of cyber liability which covered things such as business interruption, IT support, extortion, penalties, public relations and any sort of forensic investigation that may be necessary.

Mr Harkness said the council systems had not been "hacked" but the potential threat required constant vigilance by the IT team and all staff.

While insurance was available "that was really the ambulance at the bottom of the cliff".

The council had a series of checks in place to guard against cyber crime, including complex passwords, secure web infrastructure, firewalls, filters and anti-scam programs.

"Our anti-virus systems are updated every 15 minutes," Mr Harkness said.

The district council also had alternative ways to access the internet and retained back up data off site if something untoward happened.

"We've got alternative power supplies, firstly via batteries and then switching to generators, so really our efforts to combat the potential of cyber crime is a mix of all of those things. But those trying to do harm will always be trying to hack into our system," he said.

Staff members were constantly reminded to take care with every email they received, Mr Harkness added.

"A key for us is staff always saying if something is not working properly."

The latest Lloyds City Risk Index 2015-25, which analyses the amount of gross domestic product at risk in 301 major cities worldwide, including Auckland and Wellington, ranks man-made disasters as posing the greatest threat of loss to economies.