AgdaPkt 2020-12-21 Amended Joint SA PFA

Browse Search

6.D. - Page 32 of 33 technology architecture is designed with redundancy and failover capabilities such that no single event short of a natural disaster could bring down the entire infrastructure at one time. The different functions/components are generally tested during the normal course of business as functions fail, servers patched, or requested data restored. Nevertheless, the City has planned for such a circumstance, and recovery processes are documented in the City's secure internal systems. All network devices have their configurations backed up nightly in the event of an equipment failure or breach. R1.3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) City response: The recommendation has been partially implemented. Following is a summary of what has been implemented and what is planned. The City utilizes both cloud and an on premise dedicated SPAM prevention appliance and software which all email is first run though before being delivered to recipients. The appliance continuously communicates with the manufacturer's secure site to update its protections to the latest known threats. In addition, the appliance wraps all links within an email with a path which, when clicked, first go through the manufacturer's secure cloud services to confirm as best as possible that the link is legitimate and not a known hacking site. The City prepends the subject of certain emails with [suspect] when an email contains one of many known to be trouble phrases such as "gift cards." Every external email prepends the body of the email with a warning the email is from an external source and to use caution when responding or clicking on any links contained within. The City is currently in the process of implementing employee required cyber security and awareness training and will have it implemented by March 2021. It will include best practices for handling Personal Identifying Information (PID) among other topics requiring vigilance. Additional City security strategies The City carries cyber security insurance in the event of a data breach which provides the City with resources to assist in the cost of recovery, including notifications to those whose personal information was likely breached. As cloud services become more a part of the City's infrastructure, City IT strives to connect cloud services to its internal Active Directory security model, often referred to as "Single Sign On." This allows IT staff to manage access to internal and hosted (cloud) applications from a single secure source. Some high risk data, such as credit card information, is never stored, in any format, on City equipment or premise. Credit card processing is always done through third party providers who must be Payment Card Industry (PCI) compliant. PCI standards and requirements are well documented and only vendors meeting PCI compliance are considered and used by the City. City IT staff is investigating the implementation of multi -factor authentication. This effort has been ramped up given the current pandemic environment in which the majority of the workforce is located outside of a City facility. Whereas in the past security was focused on keeping people out, the pandemic has turned that upside down in which now the strategy is to secure endpoints theoretically located 153