Response to Grand Jury Report Form "cyberattacks: a Growing Threat to Marin Government"*

R4

Starting in fiscal year 2020-2021, the county board of supervisors and the city and town councils should request their managers report, at least annually, regarding their cybersecurity profile and any measures being taken to improve it. This recommendation will be implemented in the future. The City of Larkspur is in the process of implementing a 5-Year Technology Master Plan and will report progress in implementing the plan (including cybersecurity measures) as part of the mid-year FY 2020-21 budget review. This report will be presented in January or February of 2021.

R5

Starting in fiscal year 2020–2021, the county, cities, and towns should convene periodic discussions, at least annually, in a public forum such as a board or council meeting, regarding the importance of good cybersecurity practices for our government, residents, and other organizations. This recommendation will be implemented in the future. Starting in October 2020, the County of Marin will host an NCSAM event that is open to members of the public to facilitate a discussion on cybersecurity. As a member of the recently formed Marin Information Security Collaboration (MISC), Larkspur will help promote this event to our residents and organizations.

R6

The county and each city and town should adopt a policy to report to federal law enforcement any cybersecurity intrusion that results in financial fraud or unauthorized disclosure of information and make that intrusion public. This recommendation will be implemented in the future. The City of Larkspur has not had any recent cybersecurity breaches, financial fraud, or unauthorized disclosure of information that have required the reporting to federal law enforcement. If the City were to become victim to any of the above attacks staff would work closely with all law enforcement personnel, including federal law enforcement, as required to properly respond to the threat. The County of Marin has access to existing security policy templates that have been developed in collaboration with the California Counties Information Services Director's Association (CCISDA) Information Security Council (ISC). These templates will be shared with the members of the recently formed Marin Information Security Collaboration (MISC) and will be considered for updates to the City's own security policies.

R7

of the date of this report, cities and towns should implement the first four practices described in the Best Practices section of this report, regarding mandatory user training, email flagging and filtering, password management, and backup. These recommendations have been implemented: Daily backup, email flagging and filtering. These recommendations have been partially implemented and require further analysis: Employee training and password management. Employees receive examples of recent phishing attempts and fraudulent emails on a regular basis. Best practices regarding sending sensitive information has been discussed at staff meetings and all hands meetings. Password management, including two-factor authentication, is used for some programs. As of July 2020, the City of Larkspur has engaged a new managed IT provider. The City of Larkspur will discuss additional staff training and formalized password management practices with its IT services provider of this report. This may require further analysis or be implemented immediately once discussed.

R8

In fiscal year 2020–2021, cities and towns should complete an analysis of the feasibility of implementing the remainder of the practices described in the Best Practices section of this report. These recommendations have been implemented: Automated malware detection and removal, firewalls, and monitoring systems. These recommendations have been partially implemented and require further analysis: Use of expert resources and hardware and patching. These recommendations require further analysis: Management of mobile devices, documentation, vulnerability assessments. Staff will need to further study recommendations requiring further analysis to determine if resources can be allocated to complete these tasks in Fiscal Year 2020-21. As of July 2020, the City of Larkspur has engaged a new managed IT provider. The City will discuss these tasks with the provider for feasibility.

R9

In fiscal year 2020–2021, cities and towns should, through the Marin Managers Association, complete an analysis of the feasibility of contracting with a cybersecurity expert to be available to cities and towns on a shared basis, in order to raise the overall level of cybersecurity in Marin's cities and towns. This recommendation will be implemented in the future. The Larkspur City Manager will work with the Marin Managers Association to add the consideration of hiring a cybersecurity firm to the list of potential shared services that is currently in development. i i . . . . . . . . . . . . . . . . . . . . - . - . 17.19 2020 JUL 22 P 2: 00 CONVERUS OFFICE i .