AgdaPkt 2020-12-21 Amended Joint SA PFA

Browse Search

6.D. - Page 18 of 33 Message rules can be very powerful to alert users of potential threats or to be careful about what they might click on and endanger their system. Some of the vendors listed in Appendix B also can "report" a suspected phishing attempt to an IT administrator. The Grand Jury's review revealed that some of the Information Technology Services departments for local public entities have installed message rules on their email servers to notify users of external emails.44 This is a "best practice" which all local governmental agencies should consider. Phishing emails are easy to create, as they do not take a high level of skill to provide the illusion of legitimacy by mimicking web -site brands or using logos from Google images. They can also easily spoof (fake) an email address to look like a trusted source.45 It can often be very difficult to catch these risky emails, as the spoofed emails are cleverly disguised. A YouTube video created by Cisco Systems illustrates the sophisticated approach a phishing email may take — "Anatomy of an Attack7.46 It shows an attacker constructing a realistic identity deception email and can be viewed at litlps: After you watch this video please note, had an email filter caught this message and flagged it as external and warned about clicking on links, the deception may have been caught. What Does Excellent Cyber Defense Look Like? Survey Question47: "What defenses do you currently employ to block malware? Please be specific. (Firewall brand/model, Software filters/spam blocker, etc.) " Five survey responders did not divulge the infrastructure of their environment. 17 responders provided abbreviated details indicating they do have Cybersecurity protections in place. The remaining 15 responses were explicit about their organizations' hardware and software defense strategies. Below is a survey response that illustrates a well -protected environment using some of the best practices of Cybersecurity: "At the first layer, we use a PAN 220 Firewall with all subscriptions enabled, (URL Filtering, AntivirusNulnerability, Wildfire, etc.), block all international countries both in and outbound. Once traffic is passed for email, it passes through a Barracuda spam filter, filtering and scanning phishing and virus emails, checks with External Reputation servers for known virus and spamming servers, then passes to an on -premise exchange server. The exchange servers have another layer installed, Symantec Antivirus, giving a third layer of scanning. All servers and workstations have the latest version of the antivirus installed controlled by a centralized server. Window patches are applied on a monthly basis to all servers and workstations, and servers are retired once Microsoft ends support for an operating system." 48 The survey respondent's best practices: • Filtering incoming email for viruses, malware, and phishing attempts; • Utilizing protection software from multiple vendors; Utilizing multiple layers of defense; 44 Grand Jury interviews 45 Ibid 46 Cisco Systems, Ransomware - Anatomy of an Attack, litlps://www.voutLibe.com/watcli?v--4_iZR562GW7TI 47 Appendix A - Question #6 48 Grand Jury Survey response 2019-2020 San Mateo County Civil Grand Jury 10 139