AgdaPkt 2020-12-21 Amended Joint SA PFA

Browse Search

6.D. - Page 10 of 33 that only limited training is provided for new employees with little or no recurring training provided for current employees.2 Ransomware and other malware attacks are a test to an organization's backup and restoration procedures.3 The Grand Jury found that none of the survey responders has actually performed a full restore as a test of their backup process. However, without adequate testing, backups do not provide sufficient protection. Rigorous preparation for an attack is essential if fast and full recovery is desired and the payment of a ransom is to be avoided. There are several significant steps that local public entities should take to improve their defenses, their ability to detect incursions, and their responses to Ransomware attacks. These steps include: • Using firewalls to protect internal environments from breaches; • Using malware detection software to monitor incoming emails and network activity; • Ensuring that users are educated and tested to learn what to watch for and avoid, especially in emails; • Developing and fully testing a thorough backup and restore strategy to enable a complete recovery from an attack; • Putting in place internal controls such as subnets, which require departmental authorization to access other department's data or programs. In addition, cloud hosting should be considered for email and certain applications to reduce the success of Malware and Ransomware attacks on information systems infrastructure. While all attacks are malicious in terms of time and potential data loss, in the case of Ransomware (or worse, Ransomware 2.0 that also infects backup data) the financial cost of paying the ransom in order to remove the infection and restore a data system can be significant. Alternatively, if the decision is to not pay the ransom but to attempt to recover from the infection manually, the direct and indirect costs could be considerably more. This report is directed to the governing bodies of government entities in San Mateo County urging them to have their IT staff confidentially and urgently assess their respective Ransomware protection strategies and training and then move with all deliberate speed to address any shortcomings in their Cybersecurity programs. GLOSSARY CLOUD COMPUTING Cloud computing is the delivery of on -demand computing services -- from applications to storage and processing power -- typically over the internet and on a pay-as-you-go basis. Rather than owning their own computing infrastructure or data centers, companies can rent access to 2 Grand Jury interviews 3 Epicor Corporation, Protecting Yourself From Ransomware, January 2020 2019-2020 San Mateo County Civil Grand Jury 2 131