AgdaPkt 2020-12-21 Amended Joint SA PFA

Browse Search

6.D. - Page 9 of 33 IT 1.4 Ransomware: It Is Not Enough To Think You Are Protected ISSUE City and county government computer systems are at risk of Ransomware attacks. Are adequate measures being taken by local government agencies to mitigate the risks and provide recovery options? SUMMARY Ransomware has already hit many governmental Information Technology (IT) systems in San Mateo County. In December 2019 the Grand Jury sent an online survey to all 68 public entities in San Mateo County,' received 37 survey responses (a 54% response rate), and interviewed several responders including one IT Manager (who had refused to respond to the survey for fear of being successfully attacked once again), for a total of 38 responses via survey and interview. More than 25% (10 of 38) of the public entities responding to the Grand Jury reported that they have been a victim of one or more Ransomware attacks. More concerning is the certainty that there will be more attempts to violate the integrity of our local governments' electronic infrastructure. This report is intended to present "best practices" in developing a Cybersecurity strategy, then implementing and testing that plan. It addresses actions that can be taken (and have been taken, in some cases) in order to guard against Ransomware attacks, recover from an attack and the additional measures that can be taken to reduce the possibility of an attack. However, it is not an expose with details of potential system weaknesses, in light of the need for Cybersecurity strategies and practices to be highly confidential. As such, this report walks the line between providing an informed discussion of potential concerns without providing a road map of how to breach public government IT systems. The single largest exposure every organization has to cyber -thieves is phishing, the illegal practice of sending legitimate -looking emails to an organization's employees. These emails may contain malware or links that, when clicked, infect the computer with a virus that can spread to the entire information systems network. Although many email software programs include some level of protection against Ransomware attacks, such protections require customization and activation, and it is not clear that local public entity IT departments are undertaking these necessary customization and activation steps. In addition, training for new employees and recurring training for existing employees is critical to dramatically reducing the probability of a Ransomware infection. In some agencies, it appears ' See Appendix F: Public Entities in San Mateo County (Cities, County, School Districts, Special Districts) 2019-2020 San Mateo County Civil Grand Jury 130