St. Paul has declared a state of emergency over what appears to be a massive cyberattack. The city is working with the Minnesota National Guard, the FBI and two private cybersecurity firms to respond to the cyberattack, which is disrupting city services including payment systems, libraries, recreation centers and city hall.
For more on how cyberattacks like this one occur and the issues they can cause, Minnesota Now guest host Chris Farrell talks with Faisel Kaleem, director of cybersecurity and cyber operations programs at Metro State University.
Use the audio player above to listen to the full conversation.
Subscribe to the Minnesota Now podcast on Apple Podcasts, Spotify or wherever you get your podcasts.
We attempt to make transcripts for Minnesota Now available the next business day after a broadcast. When ready they will appear here.
[MUSIC PLAYING] CHRIS FARRELL: Well, as Kelly Bleyer just mentioned, our top story is the city of St. Paul is working to stop what appears to be a massive cyber attack. The city declared a state of emergency and is working with Minnesota National Guard, the FBI, and two private cybersecurity firms.
And the cyber attack is disrupting several city services, including payment systems, libraries, recreation centers, and city hall. So to go in depth into this story and to explain more about what cyber attacks like these look like and the issues they can cause is Professor Faisal Kaleem. He's Director of Cybersecurity and Cyber Operations Programs at Metro State University. So thanks for joining us, Professor.
FAISAL KALEEM: Good afternoon, Chris. Hope you are doing well.
CHRIS FARRELL: And I hope you're doing well too, and thank you. So some listeners just might be wondering-- and I would include myself among this-- what does a cyber attack against a city look like?
FAISAL KALEEM: So first of all, I mean, as we know, this is a very coordinated, deliberate cyber attack by a very, very sophisticated external actor. This was not a technical failure. So when it comes to attack against a city, it's a big deal.
And again, it's serious enough to require state and federal intervention. Not every attack triggers the National Guard and FBI, so that kind of tells you about the sophistication and severity of the attack.
CHRIS FARRELL: So it is a sophisticated attack, as you mentioned. Do we have any idea, or do you-- or do you know who the cyber attackers might be?
FAISAL KALEEM: No, I don't think so, because I think they are still keeping-- I don't know if they already found the information, but I'm pretty sure that they are going through some forensics, and I'm pretty sure that they will discover who the adversary is once the forensic is done.
CHRIS FARRELL: OK. So how easy is it to breach a city's information technology system?
FAISAL KALEEM: So I mean, given the resources, and especially when it comes to city of St. Paul-- and I know they are very, very well equipped and I know they have resources-- it should not be easy. But again, as we always say, this thing that the attackers have to just find one weak point to exploit the systems or to enter into the system as compared to the defenders who actually have to make sure that all vulnerabilities are covered. So I would say it was not an easy thing, but for whatever reason, they were able to successfully attack the city.
CHRIS FARRELL: So do we have any idea or information what the people behind the cyber attack, what they might want from the city?
FAISAL KALEEM: So I'm not sure if it's a ransomware attack. I hope it's not. But again, if it's going to be a ransomware attack, then definitely they would like to ask for some ransom.
But the good news is that when city detected all these activities on Friday, they took all the necessary measures, shut down the systems, and make sure that nothing bad happens. But I mean, again, we don't know right now if it's a ransomware attack or what kind of attack was it. We will get that information once the forensic is done.
CHRIS FARRELL: And so give us a sense-- I mean, with your background and your knowledge, what kind of information do you imagine or do you think is at risk in a situation like this?
FAISAL KALEEM: So absolutely. So obviously, they would definitely want to go after resident information, city employee information, their credentials. Because if the credentials are stolen, then that's going to cause severe problems, because those credentials could be reused to get into other systems, and so on.
And also, again, they are saying that the residential data was not involved. But again, if the resident data was involved, it might be some health information, some health records as well, and so on.
CHRIS FARRELL: So I want to get back into the details of this one, but I also want to ask you, I've gotten recently-- I don't know-- over the past 12 months, probably three data breaches. Your information has been compromised. One was a health company. I can't remember what the other two were.
Now we've got the city of St. Paul doing this. I mean, is our information safe? I mean, it seems like I'm getting these data breaches, and then they say, well, we'll put you on some sort of list where your information will be monitored.
FAISAL KALEEM: You know, I hate to say this thing, but you know, as we all know that there are several breaches. And most likely, all of us may be part of those breach. So that means that our information is already exposed somewhere, somehow.
So the only thing we could do at this time is to take some preventive measures and protective measures, like for example, we just need to make sure that we put a freeze on our credit reports. That's the number 1 thing that everybody should do. Put a freeze on their credit report so that nobody can use your credit report in a wrong way.
At the same time, make sure that you frequently check your credit reports as well. Make sure that there is nothing going on over there. And then changing the passwords and then utilizing those multi-factor authentication. A lot of us still don't use those multi-factor authentication, you know? They are still using the same password mechanism. So I would highly suggest that they should start using the multi-factor authentication.
CHRIS FARRELL: And the multi-factor, that's when you get a code on your cell phone, right?
FAISAL KALEEM: That is correct. It could be-- it could be various-- variety of multi-factor authentication. But one of the ways is to get a code on your cell phone, absolutely.
CHRIS FARRELL: So one of the things that surprised me was that the National Guard got involved. And I understand it, am I right, that Minnesota's one of just three states that has a full cyber protection team with the National Guard?
FAISAL KALEEM: Absolutely. Minnesota is one of those lucky states that actually have a full potential CPT, which stands for the Cyber Protection Team. And they are-- actually, one of our students also work in that CPT as well, one of the Metro State students is part of the CPT, which I'm very, very proud of.
They get activated whenever this kind of breach happens. And again, as I said, the severity of the attack can be demonstrated by this event. They have to activate the FBI, as well as the National Guard CPT.
CHRIS FARRELL: Yes. And does the National Guard have tools that, say, the city of St. Paul might not have in dealing with this kind of situation?
FAISAL KALEEM: That is correct. So National Guard CPT is very well equipped. They have all the necessary tools and resources that they can utilize to make sure that this attack is stopped, or basically nothing bad happened going forward.
CHRIS FARRELL: OK. So now as I understand it, the city initiated a full shutdown of their information systems. I think I know what that means, but what does that mean? And then how long does it take to get those systems back up and running?
FAISAL KALEEM: So obviously, the city had to disable all the system to contain the threat, because they just want to make sure that the attack does not go into those-- what we call a potential lateral movement or escalated risk. But that means from the resident perspective, we are talking about disabling services, disruption beyond city systems. Residents cannot access services. Small businesses rely on city systems are delayed.
And the most important thing is that when these kinds of attacks happen, the trust in the digital services is also shaken. And that's what we are trying to do. We are trying to bring back that trust that, hey, everything is good, you know? Nothing bad happened. And I'm pretty sure city of St. Paul is doing a great job bringing that trust back.
CHRIS FARRELL: So very quickly with the time we have left, tell us a little bit about your institute here with cybersecurity.
FAISAL KALEEM: Yeah. So I mean, again, this is exactly what we are trying to do at Metro State. We are the only school in Minnesota with the top cybersecurity program, with multiple national recognition, NSA Center of Academic Excellence in Cyber Defense and Cyber Operations, Intelligence Community Center for Academic Excellence by the Office of the Director of National Intelligence.
We have been also running something called a cybersecurity clinic. And that is basically one of the best things that happened to Metro State, where we train the student. And then these trained students go out and provide free risk assessment services to underserved clients like small cities, K-12 schools, municipalities, nonprofits, and so on.
And soon we are also going to be starting security operations center. And I definitely would urge the small cities, small businesses, nonprofits, K-12 schools to basically let us or let our students monitor their network. So if you think about the impact, what a beautiful way when we are providing low-cost or no-cost services to these underserved clients at the same time training our next generation of cybersecurity professionals.
CHRIS FARRELL: Well, that sounds like good news for you. But unfortunately, I think there's going to be a lot of business, which is bad news for us. So thank you very much for your time. I really appreciate it.
FAISAL KALEEM: Thank you very much, Chris, for having me on the show. Thank you.
CHRIS FARRELL: That was Faisal Kaleem, the Director of Cybersecurity and Cyber Operations Programs at Metro State University.