AgdaPkt 2020-12-21 Amended Joint SA PFA

Browse Search

6.D. - Page 13 of 33 o Paying for enrollments in credit reporting bureaus to stop or correct identity thefts (from the release of previously confidential or secure personal information) for client/customers. o Replacing hardware and/or software. • Indirect Costs: o Operations efforts to restore systems and data; o Organizational downtime as well as employee overtime; o Reputation loss including negative public relations and loss of confidence by the organizations' constituents; o Liabilities for legal costs, including defense of lawsuits for breach of private and confidential information and poor handling of personal data. According to the Coveware Report, 17 the median ransom payment in the first quarter of 2020 was $44,021. This was an increase of roughly 10% over the last quarter of 2019. Public sector entities represented 12% of attacks, about half of which were school systems. The average days of downtime was 15 representing an alarming number of days of inability to service constituents. 18 This underlines an urgent need to understand and evaluate current local governments' Cybersecurity strategies. The discussion that follows is intended to encourage local public agencies and their IT staff to confidentially evaluate their respective Cybersecurity plans, software and prevention strategies. Since data and systems security are essential to the operation of every public entity in the County, the discussion will not present a specific road map for potential Ransomware-prevention actions but rather establish a "best practice model" that will enhance understanding of the elements essential for an adequate protection plan. DISCUSSION In December 2019, the Grand Jury developed an online survey that was sent to all 68 public entities in San Mateo County. 19 Responses were received from 37 of the entities (a 54% response rate). Additionally, follow-up interviews were conducted with three local public IT Managers, one of whom had refused to complete the online survey for fear of disclosing confidential information that could lead to a successful malware or Ransomware attack. These interviewees were questioned regarding the adequacy of Cybersecurity planning and execution. Following a general analysis of local government practices, this report concludes with a review of Cybersecurity best practices which local agencies should consider adopting. Two Ransomware Attacks Derailed: Best Practices in Action In order to better understand how to successfully defeat a Ransomware attack, the Grand Jury interviewed an IT Manager of a private enterprise that was attacked twice by Ransomware and was able to fully restore the environment and re-establish workflow within just a few hours. 17 https://%%ww.coveware.com/blog/gi-2030-ransomware-marketplace-report 18 Ii tips://www.msspalert.com/Cybersecurity-research/average-ransomware-aaymeiit-rises-main-research/ 19 Appendix F 2019-2020 San Mateo County Civil Grand Jury 134