Municipal Cybersecurity: Keeping Town Services Running

A municipality is an unusually broad attack surface for its size. The same organisation runs water and wastewater treatment, transit, roads, recreation facilities, libraries, permits and licensing, property tax, payroll and emergency services — often on shared infrastructure, frequently with an IT team small enough to fit around one table.

Ransomware against municipalities has been persistent and effective, because the services are essential, the visibility is high, and the defences are typically thin.

The operational technology problem

This is the distinguishing feature. Water treatment, wastewater, traffic signals and building systems are industrial control systems, with the same constraints as any industrial estate: long service lives, limited patching, and vendors with remote access.

Water treatment deserves specific attention. Incidents involving remote access to water treatment controls have drawn regulatory and public attention internationally, and the consequence category is public health rather than data.

What to verify:

• Is the treatment control network reachable from the administrative network, directly or through a shared device?
• Who has remote access, including the integrator and the equipment vendor?
• Is that access brokered and logged, or a standing connection?
• Would you know if someone changed a setpoint?

See OT and ICS security.

Ransomware continuity for municipal services

Municipalities that have been hit describe the same pattern: the technical recovery is difficult and the service continuity is harder, because there is no manual fallback for systems nobody planned to lose.

Payroll is consistently the one nobody has considered, and it becomes urgent within days.

Records and privacy obligations

Municipalities are public bodies subject to provincial access and privacy legislation, which creates obligations that interact with security directly: adequate search for records, protection against unauthorised access and destruction, and retention schedules.

Ransomware is therefore also a privacy matter — unauthorised destruction is a breach in its own right. See FOIP compliance for Alberta public bodies and, for other provinces, multi-province privacy compliance.

A realistic programme for a small team

With two or three IT staff, the strategy has to be selective:

1. Separate OT from administration. The single highest-value project.
2. Immutable, tested backups of the systems that run essential services.
3. MFA everywhere it will go, starting with remote access and administrators.
4. Buy monitoring. A team of three cannot watch overnight, and municipalities are attacked overnight.
5. Exercise one scenario a year with the leadership team, not just IT.
6. Joint procurement with neighbouring municipalities or a provincial association, which materially improves what you can afford.

Point six is underused. Small municipalities buying monitoring individually pay far more than a group of them buying together, and associations frequently have frameworks in place already.

Council and leadership engagement

Municipal security decisions require council or senior leadership support, because the money is public and the trade-offs are political. Presentations that work share a shape:

• Lead with services, not systems. "If this happens, water treatment reverts to manual operation and permits stop for three weeks" lands where a discussion of endpoint detection does not.
• Use peer incidents. Other municipalities have been hit publicly, and the reporting is detailed enough to be instructive.
• Present choices with costs, not a single ask. See building a defensible security budget.
• Be specific about what you cannot currently do, such as detecting an intrusion overnight.

The exercise that changes minds

A tabletop with the chief administrative officer, the clerk, public works, finance and communications does more to move a municipal security programme than any assessment report. The questions it surfaces are the ones nobody has answered: who declares an emergency, who speaks to the media, whether staff get paid, and how long services can run manually.

Run it on a realistic scenario — ransomware across administrative systems, with water treatment unaffected but unverifiable — and document the decisions. See tabletop exercises.

Where to start

Establish whether your water treatment control network can be reached from the administrative network. If the answer is yes, or nobody is certain, that is the most important thing on your list and everything else waits.

GuardsArm works with Canadian municipalities on OT separation, monitoring and continuity. See Alberta municipalities or book a scoping call.