Res19 15781 - Laserfiche WebLink

Browse Search

Concept of Operations For a small-scale cyber attack event with minimal impact to City operations, preparation and response for activities will fall under the scope of the Redwood City Information Technology Department or other staff normally responsible for managing technological resources. These responders will act independently within their normal operating procedures to address any issues that may arise during the course of the cyber attack event. For a large-scale cyber attack with major, public impacts to city operations or infrastructure, the EOC will be activated as appropriate, and the EOP will guide activities. In such instances, the EOC will provide primary direction and control during the event. If the scale of the impacts of a cyber attack event overwhelms the capacity of the City, or if there is a mass cyber attack event that targets Redwood City and the surrounding communities simultaneously, the City will then coordinate response efforts with adjacent cities and communities through the San Mateo County Operational Area. Tasks Redwood City will be responsible for the overall direction and control of emergency response activities within City limits or involving City infrastructure or computer systems. See the Concept of Operations section in the Basic Plan for general information. Step1: Identify the Threat ❑ It is necessary to assess the scale and nature of a cyber attack event so as to properly mobilize an appropriate response. ❑ A Cyber attack event may be in progress if the City cannot access its systems, water and transportation equipment is malfunctioning, or city employees cannot use or access digital resources or databases. Step 2: Isolate and Address the Cyber Attack ❑ Restrict physical access to the areas with the affected systems to necessary personnel only so as to preserve fingerprints for later identification of potential event perpetrators (assuming attack is physically delivered to a system or computer). ❑ Determine if affected computers or networks need to be turned off or deactivated. ❑ Photograph the conditions of the affected computers or equipment. Quarantine affected computers or equipment by disconnecting them from networks and avoid accessing files from them as they could potentially spread viruses and amplify the cyber attack event's impact. Step 3: Mobilization of Resources and Public Response ❑ Secure any assets that may subject to physical tampering. Assailants may use lapses in automated security to enter restricted or off-limits areas around pieces of critical infrastructure such as pumping stations or wastewater treatment facilities. Dispatch law enforcement as may be appropriate to secure these areas.