Redland City is among the almost 40 per cent of Queensland councils who according to their peak body have experienced recent cyber security incidents.

This has got worse during COVID-19, which saw councils preoccupied with the pandemic while also experiencing a migration of staff from the office to WFH, says Redland’s CIO and group manager corporate services Glynn Henderson.

According to Mr Henderson, at the last count Redland, which covers six residential islands spread along the southern coast of Moreton Bay between Brisbane and the Gold Coast and has a more than $100 million spend on goods and services, was getting up to 50,000 scam emails a week.

“Over the past 18 months we’ve had at least a tenfold increase in attacks,” he told Government News.

“Within our agency at least there’s been a lot more phishing and spearphishing, and a lot of that payload has been ransomware-related, including cryptolocking.”

This wasn’t helped by the tripling of council’s remote workforce during COVID-19.

“Certainly there’s been a lot more attacks since then so I think that has a part to play,” he said.

Fortunately, Mr Henderson says Council’s decision to adopt a new strategic IT initiative has, among other things, helped prevent any losses and provide an insurance policy against ransomware.

“We’ve been very lucky, with some of our technology selections, that we haven’t had to pay ransomware,” he says.

“I was probably one of those CEOs two years ago that said I’d never ever pay. I wouldn’t say that now, however I’m doing whatever I can not to be put into that position.”

Boarding the digital train

Redland isn’t alone in jumping on the digital train.

According to LGAQ’s Digital Productivity Report 2020, 95  per cent of the state’s councils see digital transformation, including data analytics and cloud computing, as a priority, and 75 per cent have deployed technologies supporting digital services.

“The 2019 report demonstrates an overall increase in the digital maturity of councils across Queensland,” the report says.

This hasn’t been without risks, it adds, with 39 per cent of respondents saying they were aware of a cyber security incident occurring in their council in 2019 including hacker attacks, spyware and malware, date breaches, scam emails and attempts to fraudulently alter banking details.

Mr Henderson says there were several key principles in considering council’s digital journey.

They included the need for data integrity, automatic backup, user-friendliness, analytics, and cloud migration, including the ability to move between cloud providers.

Redland procured its digital services from cloud company Rubrik, one of a number of vendors offering a similar products tailored for the government sector, about a year ago, and Mr Henderson says the results are now in.

He says council’s been able to save in the vicinity of $100,000 in data management overheads and more than $117,000 in insurance premiums.

“We’ve seen a huge reduction in insurance premiums,” he says.

“Insurers are coming in greater force with their security officers and cyber specialists and asking what are doing, are you collecting analytics, and if you are, what are those analytics saying.”

Data as an asset

The data is also easy to interrogate and provide access to, which means council can be more proactive about data sharing in response to external requests.

“You might have some questions about protection and disposal of information, you might want to look at some of your data and ask questions from an open data perspective or from an economic development perspective,” he says.

“It’s important for the customer to be able to interpret the data outside the transactional system.

“To me that was a really exciting strategic direction.”

Data integrity is also helping to drive transparency, Mr Henderson says, because it makes it easy to track steps along the decision making processes

Councils need to view data as an asset, Mr Henderson says.

“It’s not the technology, it’s not the files, it’s not the computers or the software or the applications, it’s the data. That’s our asset.

“By using our data effectively we can improve internal efficiency, deliver strategic benefits and drive greater economic, community, and environmental value.”