Cyber Threat Preparedness Phishing and Passwords and Ransomware, Oh My!

Santa Cruz County does not have a Cybersecurity Plan, and the absence of a current plan that defines security policies, procedures, and controls required to protect its networks and devices increases the risk of vulnerabilities.

Santa Cruz County does not have a sufficiently detailed Incident Response Plan, indicating they would not be prepared to respond rapidly and effectively in the event of a cyber incident.

Santa Cruz County participates in multiple information sharing groups at regional and state levels, although it has only minimal interaction with the cities across Santa Cruz County, degrading their ability to fully understand regional vulnerabilities.

The City of Santa Cruz seems to have an adequate IT Department structure; however, in late 2022, 40 percent of its positions remained vacant, leaving them inadequately staffed to mitigate and respond to cyber attacks.

Inadequate staffing and high attrition has led to overworked staff and raises the risk of cyber vulnerabilities across its networks.

The City does not have an individual dedicated as the lead for cyber security, which could lead to inadequate preparation for and response to a cyber attack.

The City of Santa Cruz does not have a Cybersecurity Policy, suggesting that preparations to mitigate a cyber attack are inadequate and not widely shared.

The City of Santa Cruz does not have an Incident Response Plan, and this absence indicates that the City will be challenged in responding to a cyber attack, especially a ransomware attack.

Santa Cruz participates in some information sharing organizations such as the California Municipal Information Services Association (MISAC), yet it has minimal collaboration within the county and the other cities, forfeiting opportunities to share best practices and understand threats.

After recently expanding its IT Department, the City of Watsonville has improved its IT functions although it does not yet allocate sufficient resources to cybersecurity.

The City does not have an individual whose primary responsibility is cybersecurity for the city networks, leaving cybersecurity oversight to the IT Director–along with a multitude of other IT responsibilities–and lowering the priority for cybersecurity measures.

Watsonville does not have a Cybersecurity Plan that defines security policies, procedures, and controls required to protect its networks and devices, a situation that increases the risks of vulnerabilities.

Watsonville does not have an Incident Response Plan that provides detailed information on how to respond to an attack, suggesting the City would not be able to respond rapidly and effectively to a cyber attack.

Watsonville participates in some regional information sharing forums, but it does not have the resources to expand its participation or tap into state-level information sharing, thus forfeiting valuable best practices and cyber threat information.

Although Scotts Valley’s managed service provider is very knowledgeable and capable of providing cybersecurity services, there is no single city official with cybersecurity oversight, potentially leading to a poor understanding of the threats and an inadequate response to a cyber attack.

Scotts Valley does not have a current Cybersecurity Plan that defines security policies, procedures, and controls required to protect its networks and devices, potentially increasing the risks of vulnerabilities.

Scotts Valley does not have a current Incident Response Plan, which could exacerbate the effects of a cyber incident such as increase the time a network is unavailable or raise the potential financial costs of a resolution.

Scotts Valley does not participate in any cybersecurity information sharing groups to enhance best practices, rather they depend on their contractor to stay informed, which makes the City last to know of critical cyber threats.

With one individual responsible for IT services, Capitola does not allocate sufficient resources to cybersecurity, a status that could lead to poor cyber knowledge and unnecessary vulnerabilities.

The City of Capitola does not have a Cybersecurity Plan to address cybersecurity measures city wide, suggesting the city is not adequately mitigating the potential impact of cyber incidents.

The City of Capitola does not have an Incident Response Plan, which could exacerbate the effects of a cyber incident such as increase the time a network is unavailable or raise the potential financial costs of a resolution.

Capitola does not participate in any cyber-focused information sharing groups, nor does it take advantage of state and federal resources designed to assist small cities with mitigating cyber attacks, thereby forfeiting opportunities to learn best practices and raise their cyber awareness.

The City of Capitola does not have a robust cybersecurity training program, nor does it conduct phishing tests or routinely remind employees to adhere to cybersecurity measures during potential periods of increased threats. Cyber Threat Preparedness published May 18, 2023 Page 14 of 24

Secure long-term funding for cybersecurity in the core budget. A proactive approach that prioritizes network defense, situational awareness, and education is a critical element of cybersecurity and well worth the commitment. Cybersecurity should be a budget item on a business level, not solely an IT budget allocation.

Hire and retain cyber talent. Small and medium-sized cities need to identify innovative methods for hiring and retaining the appropriate expertise to ensure secure networks and a vigilant security program. If funding limits the ability to hire a sufficient number of competent IT professionals, cities may want to consider a part-time CISO position, shared resources, or hiring an outside contractor.

Set up strong relationships with the private sector. Santa Cruz is well positioned to leverage private sector partnerships in the region that may offer additional resources and superb cyber expertise with minimal investments.

Build an exhaustive Incident Response Policy. Every entity should maintain a current Incident Response Policy that delineates established relationships, detailed scenario planning, step-by-step instructions for incident responses, defined public relations measures, and plans for business continuity. Such a plan is critical to delineate the processes that will allow cities to continue serving the public in the event of an attack. The plan should define how systems will be restored without disrupting the business continuity, steps for a thorough investigation of the nature of the breach, and an immediate investment in addressing the vulnerabilities. Cyber Threat Preparedness published May 18, 2023 Page 10 of 24

Improve training and culture. A company culture that encourages security and provides a broad range of cybersecurity training is the best approach to mitigating cyber threats, in both government and private entities.[73] [74]

Rely on cybersecurity best practices. At a minimum, entities should ensure the use of reputable automation and cybersecurity tools across all networks. The cybersecurity foundation should encompass firewalls, antivirus software, and strong endpoint and network security products that allow visibility into the network.[18] With proper cybersecurity measures in place, our county and cities could take advantage of the cybersecurity grant opportunities available from federal agencies such as DHS/CISA and the Federal Emergency Management Agency (FEMA). In the event of limited resources to prepare and apply for grants, the County and cities would be well served by hiring a consultant to write grant proposals. In the long run–or possibly in the short run–such expenditures would pay for themselves and much more.[43] [73] [79] Findings—Santa Cruz County F1. Santa Cruz County does not have a Cybersecurity Plan, and the absence of a current plan that defines security policies, procedures, and controls required to protect its networks and devices increases the risk of vulnerabilities. F2. Santa Cruz County does not have a sufficiently detailed Incident Response Plan, indicating they would not be prepared to respond rapidly and effectively in the event of a cyber incident. F3. Santa Cruz County participates in multiple information sharing groups at regional and state levels, although it has only minimal interaction with the cities across Santa Cruz County, degrading their ability to fully understand regional vulnerabilities.

C1. Santa Cruz County has built an excellent foundation for preparing for the possibility of cyber incidents. Its Information Services Department (ISD) has a very knowledgeable Director, is very well informed, and has taken steps to prioritize cybersecurity. The integration of ISD in all IT purchasing processes provides a sound check on the security of third-party software, and its cyber training appears well integrated for all county staff. C2. The City of Santa Cruz has instituted a cyber awareness program that is strongly enforced. Its IT Advisory Team and standard security questions provide a security perspective for all third-party software purchases, thus minimizing supply chain threats. Cyber Threat Preparedness published May 18, 2023 Page 15 of 24 C3. Watsonville has instituted commercial cyber security training for all employees and has recently begun to raise cyber risk awareness among city executives, highlighting that cyber security is a business problem for all departments and that promoting cyber education among government leaders is a critical element of effective cyber hygiene.