Fredericton approves $100K in annual spending for cybersecurity upgrades

The City of Fredericton is boosting its cybersecurity system.

The city has agreed to pay $324,360 to local company Bulletproof Solutions to protect and improve the city's networks for the next three years.

Pricing for additional services including forensics, on-premise penetration testing and vulnerability assessments was redacted from the document that was made public for Monday night's city council meeting, when the agreement was approved.

"Cities are becoming big targets for cyber criminals," said Adam Bell, assistant director of finance, innovation and technology for the city.

Bell said there have been more attacks on municipalities over the past few months, and it's time for the city to upgrade its defences.

Some attacks have even hit close to home, including a breach in Saint John's parking fine servers that started in 2017.

"The damage can be very dangerous and very impactful," said Bell. "We've seen damages in other places range from hundreds of thousands of dollars to millions of dollars."

The cybersecurity company will be monitoring city networks for unusual activity. Staff will also receive training on how to spot cyber threats and look at protocols for dealing with cyber threats.

Employees are vulnerable

"The biggest weakness that we face is in our people," Bell said. "They're the most vulnerable to attack."

Every day, city employees receive new styles of emails trying to get them to give up their credentials or download malicious content, Bell said.

The criminals can then use those credentials to log into city systems, hold information ransom, or resell it.

Bell wouldn't say if there have been any recent cyber attacks on the city.

"All organizations are subject to criminal cyber security attacks.," he said. "The city is no exception."

"We face threats every day. The level and extent to which we suffer damage is generally something we wouldn't disclose."

Cyber criminals target cities by going after city employees. The online criminals try to obtain a staff member's credentials to log into city systems. Then criminals can hold information ransom, or resell financial information.

Some attacks can involve taking control over city services and hold them for ransom.

"There's financial loss, which can be extreme, there's loss of service to citizens, there's loss of personal information," said Bell.

"Then there's just a loss of confidence and a general disruption to civic life, especially when governments and cities are attacked and held ransom."

First-hand experience

Bell himself was recently targeted by a fraudulent email.

It appeared to be from a city councillor asking Bell to purchase some iTunes gift cards and email him the numbers.

"He was in a meeting with a constituent and wanted to reward him with a gift. … I started to follow up in person and the councillor said, 'No, that wasn't me.'"

The city recognized it had a gap in cybersecurity, said Bell, as well as an opportunity to help develop local expertise.

No tender was issued for this work. Bell said that's allowed under provincial law since the city is working with Bulletproof to experiment with new technologies and techniques, which could result in new products and services that will benefit other municipalities.