AgdaPkt 2020-12-21 Amended Joint SA PFA

Browse Search

6.D. - Page 19 of 33 • Keeping systems up -to date. Breaches and attacks that manage to extract data (Ransomware 2.0) expose additional risks to sensitive information. Security professionals point out additional options for securing organizational data:49 • Use Subnets50 to section out servers with separate security permissions and limited access; • Disable and block unused services, protocols and ports; • Perform Backup & Recovery (focus on full testing of recovery); • Strengthen the password policy (long, complex, with expiration dates); • Employ 2 -factor authentication (password then keycode) for external user access. 51 • Install Anti-malware / Antivirus software on all machines and keep current (update at least monthly); • Update at least monthly, patches for operating systems, firewalls, spam filters, malware, and other key applications; • Perform monitoring and auditing of failed logins, password changes, resource usage, and services stopping. Local public entities can get assistance from The Federal Communications Commission's (FCC) Cyber Security Planning Guide that includes a customized Cyber Security Planning Tool to craft and execute a customizable Cybersecurity plan.52 As their introduction explains, "data security is crucial ... customer and client information, payment information, personal files, bank account details ... all of this information is often impossible to replace if lost and dangerous in the hands of criminals... losing (your data) to hackers or malware infection can have far graver consequences. 1153 Public entities should take advantage of this Guide in reviewing the current status of their own data system security. When answering questions of respondents via email it was found that some already use cloud hosting for email.54 During the interviews it was further uncovered that a school IT manager is considering additional cloud hosting of one or more of their applications. Cloud providers are able to provide layers of protection for a customer's network and software, as well as creating a segregation between their network and their customers. A cloud provider will patch and maintain current software versions, leverage security and malware and have a dedicated security team (240065) that is responsible for staying on top of the security risks.55 49 Government Technology Magazine, Adam Stone, The Weakest Link, Oct/Nov 2018 50 his://searcfuietworking.techtarLet.com/ttitorial/Protocols-Lesson-6-IP-subnettin;-Tlie-basic-concepts 51 The County's Office of the Assessor -County Clerk -Recorder and Elections has already instituted 2 -factor authentication. 2018-2019 Grand Jury Report — Security of Election Announcements. 52 Federal Communications Commission, Cyber Security Planning Guide littps:/ltransition. fcc.,aovicvbericvberplanner.d f and FCC Cyber Security Planner (customizable) litips-Ywww. fcc.gov/cyberplaniier 53 Ibid, page PDS -1 54 eMails received from public domain accounts 55 Government Technology Magazine, Adam Stone, The Weakest Link, Oct/Nov 2018 2019-2020 San Mateo County Civil Grand Jury 11 140