AgdaPkt 2020-12-21 Amended Joint SA PFA

Browse Search

6.1). - Page 20 of 33 Conclusions Grand Jury survey results and in-depth interviews determined that some local government agencies have Cybersecurity strategies in place. For them, this report is asking those IT departments to re -challenge the sufficiency of their employee training, the regular (full) testing of their defense strategies and the adequacy/age of their Cybersecurity strategy including consideration of cloud hosting. For the rest, this is a good time to complete a review and see what additional measures can be taken to beef up their IT security using the information provided in this report as a guide. The biggest trap is believing that a malware attack, or in the worst case a Ransomware attack, is unlikely to happen to organizations and that the Cybersecurity strategies already in place are sufficient to successfully recover. As learned from the best practices example of the IT manager who thwarted two attacks successfully, a comprehensive Cybersecurity plan includes user prevention steps, spam and malware software, back-ups and full recovery testing. These suggestions as well as those from the professional literature on Cybersecurity include the following list of best practices: • Anti-Malware definitions need to be constantly updated to retain their effectiveness. • Software updates need to be kept current. • To identify external emails, message rules can be used to flag external emails and thereby decrease the probability that a user clicks on bad content. • To thwart phishing attempts, footers can be added to incoming emails to warn about opening attachments and clicking on links (see Appendix Q. • Security training, awareness and assessment need to be routine along with testing all employees to recognize, delete and report attempted attacks (See Appendix B). • Establishing a thorough and comprehensive backup process for all Servers using the 3-2- 1 rule and establishing a separate backup process for key users' critical folders (e.g., administration, accounting, human resources) to be able to restore/recover from a secure onsite and/or offsite backup. • Snapshots and/or image backups provide the most complete backup and the fastest recovery option. ■ Consider cloud -hosting of email and other applications to provide added security, backup & restore capabilities and filtering benefits to close the largest and easiest route for Ransomware to penetrate entity systems. FINDINGS F1. Ransomware is areal and growing threat to public entities including those in San Mateo County. F2. Across the country, local governments and schools represent 12% of all Ransomware attacks. F3. The direct and indirect costs of Ransomware can be significant. F4. Cybersecurity reviews and assessments, and an updated, well -executed Cybersecurity plan, are critical components of IT security strategy. 2019-2020 San Mateo County Civil Grand Jury 12 141