Cyber Security and the Registry of Deeds

The Middlesex North Registry of Deeds created its last paper record book back in 2001. Today, we have more books that only exist virtually than we do books that exist in tangible form. Digitizing our records has made them much more accessible to our users while also reducing our costs. In recent years, however, increasingly sophisticated hacking attempts have become a substantial threat to digital records.

This past meeting, the Massachusetts Registers of Deeds Association convened a meeting about the threat that hacking poses to our records and our operations. In one presentation, a representative from the Hub Technical Services provided details about the threat environment. For example, five years ago, the preferred tactic of the bad guys was data exfiltration which means they penetrated your computer defenses, grabbed some of your data, and transported it electronically to a device on their control. That was complicated and resource intensive.

Today, the preferred tactic is to encrypt on-site. There, the bad guys insert an encryption program onto your computer and execute it. This encrypts all of your files which means you cannot open them even though they are still on your computer. The only way to get access to your data is to pay the ransom, obtain the decryption key from the bad guys, and use it to decrypt your files. Of course, that assumes they give you the key even after you pay the ransom.

So how does this malicious encryption program get on your computer? Usually it comes via email. Bad guys will disguise an email to look like something coming from someone you know, or at least to resemble something of interest to you. We live in a "click happy" culture, so the recipient of the will often open it and click a link in it. That launches the encryption program.

The Hub Tech representative said one in ten of these infiltration efforts is successful and that there are 316 new malware threats made every minute.

How to protect against these attacks? It's difficult. User education is very important (Don't click on unknown emails!). So is keeping security software up to date. But it's almost inevitable that an attack will succeed, so having good backups that can be quickly restored are key to preparedness.