The director of the North Dakota Information Technology Department says no cyber-attacks have been detected in state computer systems since one server belonging to Workforce Safety and Insurance had been hacked last June.
Mike Ressler told the Legislature’s Information Technology Committee – since that time, Governor Dalrymple convened a task force on cyber security. Ressler says the first job for the task force was to make agency heads aware of the dangers.
"That was easy to do, because I didn't find one department head that wasn't taking security very seriously," Ressler said. "And it really hasn't slowed down. Seems like every industry is still being affected by cyber-security attempts or hacks."
Ressler says the task force has also talked about its response to any breach. He says he was very happy with the response when the WSI computer was compromised.
"We've had a template in place for some time to deal with hacking," Ressler said. "We've only polished that up. So the good news is -- should something ever happen again, we will be very responsive."
Meanwhile, Ressler says a big issue his department is wrestling with is insurance against cyber attacks. He says such insurance is available, but it's expensive.
"Insurance companies who got involved with this early on may have underestimated what their liability could be," Ressler said. "There were inexpensive policies out there that covered a whole lot of stuff. As certain companies started exercising their liability policies, insurance companies came in and said, 'You know what -- this is a lot more exposure than we thought.' So premiums are going up, and restrictions are getting greater."
Ressler says he’s been looking into self-insurance. And he says they’re also looking into what other states are doing.
"The good news is, I think we're going to find out from the industry, other state governments and private companies how they're doing this," Ressler said. "And before we jump into it , we'll have a good analysis done."
Ressler says the task force is also surveying agencies to see what applications they’re using – how many have personal information or financial information on them – and how many could be accessed from the outside.
