Case Study: Town of North Andover

• Increasing ransomware attacks throughout Massachusetts and the U.S.

• Costly, concerning ransomware attack at a neighboring town

• Risk of losing data and forfeiting taxpayer dollars to recover data

• Desire for a centralized ransomware solution to easily deploy to 900 town and school staff and 6,000 students

The Town of North Andover had managed to avoid a ransomware attack, but they knew it was only a matter of time. A neighboring town wasn't so lucky and bad actors took their municipal network down for a whole week–forcing the town to hand over taxpayer dollars to recover their data. Equally concerning, news of ransomware attacks were increasing throughout Massachusetts and the U.S. It was time to act.

John Hyland, the Director of Information Technology for North Andover, began exploring solutions to protect against a future ransomware attack. They had antivirus software and a good firewall, but he knew it wasn't enough.

The director was looking for a solution that didn't require loading software on every single device. With 900 Town and School staff and 6,000 students, that would be an arduous, time-consuming task. Instead, Hyland wanted a centralized solution that would offer the greatest protection and an easy implementation.

• Proof of concept with Ricoh's ransomware detection and containment solution using Bullwall Ransomware Containment

• Centralized, fast, remote configuration in just 20 minutes

• Set parameters for acceptable network activity and suspicious activity

• Two installations of our solution for the Town and the Schools

Around the same time the neighboring town had been hit with a ransomware attack, the Ricoh team connected with Hyland to discuss our detection and containment solution. He had only been working for the Town of North Andover for a couple of months, but was increasingly concerned that a ransomware attack could be imminent.

The director attended a Ricoh webinar on our solution, Ransomware Containment, which convinced him to go forward with a proof of concept. To make the proof of concept happen at the Town of North Andover, the director simply had to install a standard Windows server and add a few drives. From there, the BullWall team accessed the town's network remotely and had the ransomware detection and containment solution configured in just 20 minutes. The town ran our solution in test mode for about two months to demonstrate how it would work in North Andover's environment. Hyland particularly liked that our solution could help protect classroom data in Google Workplace (formerly G Suite), which houses all of the schools' information.

During the proof of concept, the director was also able to see any irregular activity on their network and set parameters for what was acceptable and what should be contained. For instance, some people were passing files with unusual extensions or doing partial downloads. Our solution flagged that activity and the director was able to use the information to spur conversations with end users to better understand the behavior.

Since Ransomware Containment wasn't included in the current year's budget, Hyland secured emergency funds from the town manager. Well aware of ransomware attacks in the surrounding area and the growing risk to North Andover, the town manager wholeheartedly approved the additional expense. North Andover then proceeded to full implementation, with two separate installations for the town and schools.

*RICOH is a trademark and service mark and a registered trademark or service mark of Ricoh Co. Ltd. Ransomware Containment is a name and mark of BullWall Limited and is used by permission.