Santa Barbara County Grand Jury • 2020-2021 • Agency Response
Response to: CYBER-ATTACKS THREATEN SANTA BARBARA COUNTY

City of April 22, 2020 The Honorable Michael J. Carrozzo Presiding Judge City Co Un Cil Santa Barbara Superior Court*

Published: April 22, 2020 4 pages
Ver PDF original

Findings and Recommendations 8 findings

F1
Ensuring critical cyber security tasks and activities are properly executed on a timely basis requires a designated individual to be accountable and responsible. Response to Finding 1: The City of Goleta agrees with this finding.
Related Recommendations (1)
R1
That each public entity within Santa Barbara County designate an individual to be accountable and responsible to oversee cyber security.
F2
Most public entities within Santa Barbara County have an inadequate understanding of what communication and electronic systems they use and what data they maintain, and do not fully understand the risks, security issues and costs associated with the destruction of systems or loss of data. Response to Finding 2: The City of Goleta disagrees wholly with this finding
Related Recommendations (1)
R2
That each public entity within Santa Barbara County complete a full inventory of their data, electronic and communication systems and determine the related security risks.
F3
Some public entities within Santa Barbara County do not have a written cyber security plan. Response to Finding 3: The City of Goleta agrees with this finding.
Related Recommendations (1)
R3
That each public entity within Santa Barbara County establish a written cyber security plan.
F4
Nationally, cyber-attacks on governmental organizations have been successful for many years and are occurring with more frequency and sophistication. Response to Finding 4: The City of Goleta agrees with this finding.
Related Recommendations (1)
R4
That each public entity within Santa Barbara County take substantial steps to protect data from internal and external attacks or threats.
F5
Cyber-attackers use several methods to install malicious software on systems including access through backdoors, staff or employee carelessness, and known bugs in software. Response to Finding 5: The City of Goleta agrees with this finding.
Related Recommendations (4)
R5a
That each public entity within Santa Barbara County install and maintain current antivirus software to detect malware and other threats.
R5b
That each public entity within Santa Barbara County install and update all operating software regularly.
R5c
That each public entity within Santa Barbara County periodically train employees and then test their cyber security awareness.
R5d
That each public entity within Santa Barbara County periodically ensure electronic system-related contractors have been trained for cyber security awareness.
F6
If data is lost or compromised for any reason, including cyber-attack, mechanical failure or error, the most cost effective and expedient way to recover is to have current data backups and a plan to reinstall it. Response to Finding 6: The City of Goleta agrees with this finding,
Related Recommendations (2)
R6a
That each public entity within Santa Barbara County create and implement a full backup and recovery plan.
R6b
That each public entity within Santa Barbara County regularly update and test their backup and recovery plan.
F7
Some public entities within Santa Barbara County do not have any, or adequate, cyber insurance. Response to Finding 7: The City of Goleta agrees with this finding.
Related Recommendations (1)
R7
That each public entity within Santa Barbara County secure adequate cyber insurance.
F8
A cost-effective method to address cyber risks and concerns is to form an information sharing and learning consortium. Response to Finding 8: The City of Goleta agrees with this finding.
Related Recommendations (1)
R8
That each public entity within Santa Barbara County that is unable to allocate adequate funds for cyber security develop a cybersecurity working group to establish best practices and share costs for education, expertise, and insurance.

* This report's PDF did not contain easily extractable text and required Optical Character Recognition (OCR) for analysis. There may be minor errors in the extracted findings and recommendations due to OCR limitations with scanned documents.