Response to 2020 Grand Jury Report: Cyber-Attacks Threaten Santa Barbara County*

Ensuring critical cyber security tasks and activities are properly executed on a timely basis requires a designated individual to be accountable and responsible. Response to Finding 1 - AGREE

Most public entities within Santa Barbara County have an inadequate understanding of what communication and electronic systems they use and what data they maintain, and do not fully understand the risks, security issues and costs associated with the destruction of systems or loss of data. Response to Finding 2 – DISAGREE PARTIALLY WITH AN EXPLANATION – the City of Buellton can only agree with this statement as it pertains to its own understanding of its systems and the risks and other issues associated with them. The City of Buellton has no knowledge of other public entities within Santa Barbara County with regard to this issue.

Some public entities within Santa Barbara County do not have a written cyber security plan. Response to Finding 3 - AGREE

Nationally, cyber-attacks on governmental organizations have been successful for many years and are occurring with more frequency and sophistication. Response to Finding 4 - AGREE <b>Recommendation 4</b> That each public entity within Santa Barbara County take substantial steps to protect data from internal and external attacks or threats. Response to Recommendation 4 - REQUIRES FURTHER ANALYSIS - While the City of Buellton has taken steps to protect its data from threats (both internal and external), there is still a question as to whether those steps are adequate in light of modern cyber security threats. Completion of this analysis will occur upon the engagement of an Information Technology consultant, as discussed in responses to previous recommendations, with corrective measures (if necessary) undertaken upon identification.

Cyber-attackers use a number of methods to install malicious software on systems including access through backdoors, staff or employee carelessness, and known bugs in software. Response to Finding 5 - AGREE

If data is lost or compromised for any reason, including cyber-attack, mechanical failure or error, the most cost effective and expedient way to recover is to have current data backups and a plan to reinstall it. Response to Finding 6 - AGREE

Some public entities within Santa Barbara County do not have any, or adequate, cyber insurance. Response to Finding 7 - AGREE

A cost-effective method to address cyber risks and concerns is to form an information sharing and learning consortium. Response to Finding 8 - AGREE <b>Recommendation 8</b> That each public entity within Santa Barbara County that is unable to allocate adequate funds for cyber security develop a cybersecurity working group to establish best practices and share costs for education, expertise, and insurance. Buellton Response to Grand Jury Report June 8, 2020 Response to Recommendation 8 – REQUIRES FURTHER ANALYSIS – The City of Buellton expects to be able to allocate adequate funding for cyber security considerations within its Information Technology management program. However, the participation in such a working group with other agencies may, nevertheless, be beneficial. Moving forward, the City will investigate the benefits of participating with other jurisdictions or agencies in such a working group to enhance cyber security within the County. The City of Buellton hopes that you have found these responses both sufficient and useful. Should additional information be required, please feel free to contact me directly. Respectfully Submitted, Scott Wolfe, AICP Cc: The Honorable Judge Michael J. Carrozzo 1100 Anacapa Street Santa Barbara, CA 93101