Laserfiche WebLink
6.D. - Page 2 of 33 <br />The Grand Jury Report outlined several key areas of cyber risk as well as recommendations of best practice <br />measures to mitigate those risks. The Report provides eight findings and four recommendations. The <br />findings and recommendations are outlined in the response letter staff has prepared and attached to this <br />staff report. <br />ANALYSIS <br />Staff has reviewed the Grand Jury's findings and recommendations and has prepared a letter for the <br />Mayor's signature that responds to the Grand Jury Report. The response demonstrates the City is in <br />agreement with the findings and in compliance with the recommendations. <br />For each of the eight findings in the Grand Jury's report, the City is asked to indicate one of the following: <br />1. The respondent agrees with the finding. <br />2. The respondent disagrees wholly or partially with the finding, in which case the response shall <br />specify the portion of the finding that is disputed and shall include an explanation of the reasons <br />therefore. <br />Staff recommends the City agree with all eight findings included in the report. <br />F1. Ransomware is a real and growing threat to public entities including those in San Mateo County. <br />F2. Across the country, local governments and schools represent 12% of all Ransomware attacks. <br />F3. The direct and indirect costs of Ransomware can be significant. <br />F4. Cybersecurity reviews and assessments, and an updated, well -executed Cybersecurity plan, are <br />critical components of IT security strategy. <br />F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning <br />prevention steps, spam and malware software, and backups and full recovery testing. <br />F6. The identification of phishing attempts, including the use of spam filters, is an important <br />component to protecting an IT system from Ransomware attacks. <br />F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken <br />regularly as part an entity's backup plan to recover lost information. <br />F8. Training of new employees, and the recurring training of existing employees, is an important <br />component of defense against Ransomware. <br />Additionally, as to each of the four Grand Jury recommendations, the City is to respond using one of the <br />following actions: <br />1. The recommendation has been implemented, with a summary regarding the implemented action. <br />2. The recommendation has not yet been implemented, but will be implemented in the future, with <br />a time frame for implementation. <br />3. The recommendation requires further analysis, with an explanation and the scope and <br />parameters of an analysis or study, and a time frame for the matter to be prepared for discussion <br />by the officer or director of the agency or department being investigated or reviewed, including <br />the governing body of the public agency when applicable. This time frame shall not exceed six <br />months from the date of publication of the Grand Jury report. <br />Page 2 of 4 <br />City of Redwood City 1017 Middlefield Road, Redwood City, CA. 94063 Tel: 650-780-7000 www.redwoodcity.ore <br />123 <br />