Authored by the National Cybersecurity Center Cybersecurity Committee

Due to the increasing ransomware incidents across the nation such as the Colonial Pipeline Ransomware[i], the Whitehouse announced the formation of the Ransomware Taskforce on July 15, 2021.[ii]  With the announcement, the Department of Homeland (DHS) and the Department of Justice (DOJ) launched a website with the federal resources to assist organizations to reduce the risk of ransomware attacks.[iii] 

Despite the magnitude of cyber-attacks hitting all companies, it’s clear that SMBs are at particular risk.  In its recent Global State of Cybersecurity in Small and Medium-Sized Businesses report[iv], the Ponemon Institute found that two-thirds of small businesses had experienced a cyberattack in the last 12 months alone. In the U.S., that number increases to 76%, representing a spike of 20 percentage points from just three years prior.

Although government resources are available, many SMBs still do not know who to call particularly in the heat of a cyber event such as a ransomware attack.  Many times, SMBs will call the local law enforcement or the FBI.  However, when these resources are contacted, their focus is on investigation, not incident response and assistance.  While there are some “hot line” numbers, most of them are focused on information collection not incident response.  For example, the DHS/Cybersecurity and Infrastructure Agency (CISA) website includes a “Report an Incident” tab, which provides the ability for an organization to submit  an incident report and have incident information directed to the Internet Crime Complaint Center (IC3).  Under the “Contact Us” section, there is a telephone number published, “888-282-0870.”  This telephone number is several levels deep on the website.  As listed on this website, “DHS has a mission to protect the Nation’s cybersecurity and has organizations dedicated to collecting and reporting on cyber incidents, phishing, malware, and other vulnerabilities.”  While incident collection and reporting is helpful, it is not sufficient incident response.  As a result, SMBs that suffer cyberattack have limited ability to respond, and often remain vulnerable to follow on attack.