AgdaPkt 2020-12-21 Amended Joint SA PFA

Browse Search

6.D. - Page 30 of 33 F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing. City response: We agree with the Jury's findings. F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks. City response: We agree with the Jury's findings. F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity's backup plan to recover lost information. City response: We agree with the Jury's findings. F8. Training of new employees, and the recurring training of existing is an important component of defense against Ransomware. City response: We agree with the Jury's findings. RECOMMENDATIONS AND CITY RESPONSES R1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically: City Response: The City requested a written response to this recommendation from its IT management team, in lieu of a separate report addressing these concerns, so that management could develop a response to the final three recommendations of the report. R1.1 System Security (Firewalls, Anti-malware/ Antivirus software, use of subnets, strong password policies, updating/patching regularly). City response: The recommendation has been implemented. Following is a summary of what has been implemented. The City of Redwood City utilizes several strategies for protecting against nefarious acts including but not limited to: • Industry recognized leaders' dedicated firewall appliances at all electronic entry points into the City. On each firewall all ports are blocked by default. Only known needed ports are opened; thus limiting the type of traffic coming into the City network infrastructure. • All servers and desktops run an industry leader endpoint protection software which is automatically updated. It provides key protections including: endpoint detection and response (EDR) which detects and investigates suspicious activity with AI -driven analysis; anti- ransomware from sources including browsers, multi -media, MS Office applications, and email; behavioral analysis (acting on many files in a short period) issuing warnings, stopping errant processes, and notifying IT of such activity; malicious macros and other forms of code detections and protections; and exploit prevention techniques which detect and stop common and known 151