HJ64: Ransomware attack preparedness; Virginia Information Technologies Agency (VITA) to study.

HOUSE JOINT RESOLUTION NO. 64

Offered January 8, 2020
Prefiled January 6, 2020
Requesting the Virginia Information Technologies Agency to study ransomware attack preparedness. Report.
Patron-- Reid

Committee Referral Pending

WHEREAS, ransomware is a malicious software code that incapacitates a computer system until a ransom fee is paid; and

WHEREAS, ransomware is disseminated through phishing emails with malicious attachments; and

WHEREAS, vulnerable state agencies and localities may be extorted for large sums of money before access to infected systems is restored; and

WHEREAS, ransomware can disrupt user access to sensitive or proprietary information; now, therefore, be it

RESOLVED by the House of Delegates, the Senate concurring, That the Virginia Information Technologies Agency be requested to study ransomware attack preparedness.

In conducting its study, the Virginia Information Technologies Agency shall (i) assess the Commonwealth's susceptibility to ransomware attacks at the state and local levels of government; (ii) develop guidelines and best practices to prevent ransomware attacks; (iii) evaluate current data encryption and backup strategies; (iv) evaluate the availability of tools to monitor unusual access requests, viruses, and network traffic; (v) develop guidance for state agencies and localities on responding in the event of a ransomware attack; (vi) develop a coordinated law-enforcement response strategy that utilizes forensic investigative techniques to identify the source of ransomware attacks; and (vii) provide recommendations on legislative or regulatory changes to better protect state and local government entities from ransomware.

All agencies of the Commonwealth shall provide assistance to the Virginia Information Technologies Agency for this study, upon request.

The Virginia Information Technologies Agency shall complete its meetings by November 30, 2020, and shall submit to the Governor and the General Assembly an executive summary and a report of its findings and recommendations for publication as a House or Senate document. The executive summary and report shall be submitted as provided in the procedures of the Division of Legislative Automated Systems for the processing of legislative documents and reports no later than the first day of the 2021 Regular Session of the General Assembly and shall be posted on the General Assembly's website.