AgdaPkt 2020-12-21 Amended Joint SA PFA

Browse Search

6.D. - Page 15 of 33 This detailed example represents a well thought out and highly prepared plan, executed with precision. The first breach resulted in 41/2 hours of downtime as 12 servers were infected. The second breach resulted in 6 1I2 hours of downtime to recover 19 affected servers. The IT team was able to recover the servers and their data both times, become fully operational within hours, and the organization did not pay any ransom demands. Grand Jury Cybersecurity Survey and Follow-up Interviews Survey question:23 "Has your Organization had a Ransomware attack? Specifically, has there been an instance or multiple instances when an attack has locked up a computer or computers and presented a demand for ransom to unlock the infection?" Nine survey responders and one non -survey responder interviewee, a total of 10 of 38 (37 responders to the online survey and one non -survey responder) affirmed an attack had occurred or had possibly occurred in their organization, a 26% "hit" rate. The circumstances of their attacks were reviewed.24 The non -survey interviewee was the IT manager from a public entity in the County who was unwilling to complete the survey because they did not want to reveal that their organization had been subject to "one or more" Ransomware attacks. Nor were they willing to disclose how successful the Ransomware attack(s) were for fear that they would open themselves up to more attacks. Survey Question:25 "Is your Information Systems Budget adequate to secure your network properly from malicious attack? " Thirty-two of the 37 survey respondents, or 86%, answered Yes to this question. This high percentage of "Yes" responses either indicates a high level of confidence in their defense setup, a reluctance to complain about their IT budget, or as two of our follow-up interviewees revealed26, a lack of understanding of the complexity of a well-written, well -executed Cybersecurity P1an.27 Suggesting the latter, The National League of Cities conducted a similar survey of 165 city governments nationwide and asked the same question, ("Is your budget adequate enough to secure your networkproperly?'): 67% replied "No". 28 Investigation Results Regarding Backup/Restore/Maintenance The Grand Jury survey and follow-up interviews revealed that, while many local agencies have backup plans,29 only a portion of those same agencies had successfully recovered lost files from backups and none of the survey responders had ever done a full restore of a server.30 When an 23 Appendix A — Question #1 24 Grand Jury Interview 25 Appendix A — Question #2 26 Grand Jury Interviews 27 Federal Communications Commission, Cyber Security Planning Guide, October 2012. 28 National League of Cities report, Protecting Our Data: What Cities Should Know About Cybersecurity, page 8 29 Appendix A — Question 93 30 Appendix A — Question #4 2019-2020 San Mateo County Civil Grand Jury 7 136