Santa Barbara County Grand Jury • 2020-2021 • Agency Response
Response to: CYBER-ATTACKS THREATEN SANTA BARBARA COUNTY

Cyber Attacks Threaten Santa Barbara County*

Published: June 18, 2020 5 pages
Ver PDF original

Findings and Recommendations 8 findings

F1
Ensuring critical cyber security tasks and activities are properly executed on a timely basis requires a designated individual to be accountable and responsible.
Related Recommendations (1)
R1
That each public entity within Santa Barbara County designate an individual to be accountable and responsible to oversee cyber security. Answer 1: Agree – Has been implementéd. The Information Technology Manager is responsible for the oversight of cyber security.
F2
Most public entities within Santa Barbara County have an inadequate understanding of what communication and electronic systems they use and what data they maintain, and do not fully understand the risks, security issues and costs associated with the destruction of systems or loss of data. CIVIC CENTER PLAZA, LOMPOC, CA 93436 FAX: 805-736-5347 PHONE: 805-736-1261 The Honorable Michael Carrozzo June 18, 2020
Related Recommendations (1)
R2
That each public entity within Santa Barbara County complete a full inventory of their data, electronic and communication systems and determine the related security risks. Answer 2: Agree – Will be implemented. Lompoc has a partial inventory and is working to complete it
F3
Some public entities within Santa Barbara County do not have a written cyber security plan.
Related Recommendations (1)
R3
That each public entity within Santa Barbara County establish a written cyber security plan. Answer 3: Agree – Will be implemented. Lompoc is developing a cyber-security plan. Initial draft to be completed
F4
Nationally, cyber-attacks on governmental organizations have been successful for many years and are occurring with more frequency and sophistication.
Related Recommendations (1)
R4
That each public entity within Santa Barbara County take substantial steps to protect data from internal and external attacks or threats. Answer 4: Agree - Has been implemented. Lompoc has implemented many security devices and software to protect data. Firewall with Sandblast. Sandblast Zero-Day Protection is an innovative solution that stops unknown malware, zero-day and targeted attacks from infiltrating networks. The Sandblast solution is based on new CPU-level exploit detection technology to identify threats earlier, before malware has an opportunity to deploy evasion code. Endpoint protection for each device connected to network. External devices must have full VPN client which meets safety criteria before connection to network authorized. The Honorable Michael Carrozzo June 18, 2020
F5
Cyber-attackers use a number of methods to install malicious software on systems including access through backdoors, staff or employee carelessness, and known bugs in software.
Related Recommendations (4)
R5a
That each public entity within Santa Barbara County install and maintain current antivirus software to detect malware and other threats. Answer 5a: Agree – Has been implemented. Current endpoint protection software contains up-to-date antivirus.
R5b
That each public entity within Santa Barbara County install and update all operating software regularly. Answer 5b: Agree - Will be partially implemented. Lompoc maintains a number of versions of Operating Systems and software. Legacy software prohibits upgrade of certain systems. All efforts are being made to replace legacy software and update Operating Systems.
R5c
That each public entity within Santa Barbara County periodically train employees and then test their cyber security awareness. Answer 5c: Agree - Has been implemented and requires further analysis. Regularly scheduled emails are sent to users refreshing awareness of cyber security and threats. No testing has been established at this time.
R5d
That each public entity within Santa Barbara County periodically ensure electronic system-related contractors have been trained for cyber security awareness. Answer 5d: Agree – Will be implemented. Lompoc does not have training for vendors at this time. We will establish guidelines and training for electronic system-related vendors by 2021.
F6
If data is lost or compromised for any reason, including cyber-attack, mechanical failure or error, the most cost effective and expedient way to recover is to have current data backups and a plan to reinstall it. The Honorable Michael Carrozzo June 18, 2020
Related Recommendations (2)
R6a
That each public entity within Santa Barbara County create and implement a full backup and recovery plan. Answer 6a: Agree – Will be implemented. Lompoc utilizes backups for all data related to production environment. Data recovery plan is being established.
R6b
That each public entity within Santa Barbara County regularly update and test their backup and recovery plan. Answer 6b: Agree – Will be implemented. The data recovery plan will include testing of backup and recovery plans.
F7
Some public entities within Santa Barbara County do not have any, or adequate, cyber insurance.
Related Recommendations (1)
R7
That each public entity within Santa Barbara County secure adequate cyber insurance. Answer 7: Agree – Will be implemented. Management Services Director/Finance Director and IT Manager are requesting quote for Cyber insurance from current insurer.
F8
A cost-effective method to address cyber risks and concerns is to form an information sharing and learning consortium.
Related Recommendations (1)
R8
That each public entity within Santa Barbara County that is unable to allocate adequate funds for cyber security develop a cybersecurity working group to establish best practices and share costs for education, expertise, and insurance. Answer 8: Agree - Requires further analysis. The Honorable Michael Carrozzo June 18, 2020 Sincerely, Jenelle Osborne, Mayor City of Lompoc

* This report's PDF did not contain easily extractable text and required Optical Character Recognition (OCR) for analysis. There may be minor errors in the extracted findings and recommendations due to OCR limitations with scanned documents.