Gua May 26, 2020 The Honorable Judge Michael J. Carrozzo Presiding Judge, Santa Barbara Superior Court*

Ensuring critical cyber security tasks and activities are properly executed on a timely basis requires a designated individual to be accountable and responsible. Response: Agree. <b>Recommendation 1</b> That each public entity within Santa Barbara County designate an individual to be accountable and responsible to oversee cyber security. Response: Has been implemented. The City Administrator has been designated the primary individual to be accountable and responsible to oversee cyber security.

Most public entities within Santa Barbara County have an inadequate understanding of what communication and electronic systems they use and what data they maintain, and do not fully Administration Department: Tel (805) 356.3891 Fax (805) 343.5512 918 Obispo Street P.O. Box 908, Guadalupe CA 93434 understand the risks, security issues and costs associated with the destruction of systems or loss of data. Response: Agree. •

Some public entities within Santa Barbara County do not have a written cyber security plan. Response: Agree. •

Have strong firewalls, appropriate authorization and access controls, and effective antivirus software. Strong firewalls prevent unauthorized outside access to an organization's systems and data. If an attacker cannot get into the system, it is harder for them to disrupt operations or damage or steal data. Having an appropriate authorization and access control system helps, among other things, assure that employees and authorized contractors can access only the systems and data they require to properly execute their duties and helps prevent unauthorized activities, theft, corruption or destruction of data. Antivirus software helps prevent software viruses, worms, "Trojan Horses," spyware or malware from being downloaded to an organization's electronic systems, as well as increasing protection from phishing attacks. . Install and update software regularly. Using the correct software and keeping it updated frequently is a strong step to help prevent attacks. Software providers are continually updating and improving their products to not only make it more effective but to address flaws that are discovered that could be used to attack an organization's systems or data. Old and out-of-date software is much more vulnerable than current software. Software should not only be updated on internal equipment but also on all portable devices that have access to the organization's systems.

Maintain cyber security awareness and training for all employees. A system is only as strong as the people who are using it. While there are many ways to attack a system electronically, one of the easiest ways to get access to a system is to trick someone to open the door for you. This "social engineering" is cheap, effective and quicker than trying to break into a system through other means. Employees and contractors with access to the system should be made aware of the dangers of social engineering and phishing scams, and be trained how to prevent access through these means. This awareness and training should focus not only on electronic devices provided by the organization but also personal and portable electronic devices that have access to the organization's system via Wi-Fi, email or the internet.

Create a recovery plan. While planning and prevention is a vital component to strong cyber security, the reality is that things can go wrong, attackers can succeed, and things break. Therefore, it is very important that an organization have a detailed and documented recovery plan. This plan, among other things, should include periodic backups, and safe offsite storage of backup data and system software. DocuSign Envelope ID: 0E7E470B-AF89-4B1A-A428-6D26C4BA7D54 CYBER-ATTACKS THREATEN SANTA BARBARA COUNTY

Identify the nature of the organization's data and the electronic systems employed and understand the security risks. Organizations should understand what type of data they maintain and use in the execution of their mission and the electronic systems employed that do, or could, allow access to the data. How is the data handled and protected to prevent unauthorized use? Who has access to that data and under what circumstances? What are risks related to unauthorized access or, in the worst case, destruction of the organization's data?

Establish a written cyber security plan. A cyber security plan adds a layer of protection to an organization's important resources. Protecting important data and related systems is important, not only for the organization, but also its customers. Cybercrime is escalating and having a strong defense and recovery plan helps protect the organization's reputation. A well written plan should not only detail the preventative steps the organization needs to take to prevent an attack, but also provide a recovery plan in case the data is attacked, corrupted or otherwise compromised. Protect data from internal and external threats. Data can be attacked or compromised from many sources, whether intentional or by accident. Protecting an organization's data and systems from an external threat and intentional attack is not enough—they also must be protected from unauthorized internal access, accidental corruption or destruction. An organization's plan needs to identify and 14 Edward Gately, "ESET: MSPs Not Proactive Enough with Cybersecurity", ChannelFutures.com, February 7, 2020 https://www.channelfutures.com/channel-research/eset-msps-not-proactive-enough-with-cybersecurity. (Last visited 02/10/2020) DocuSign Envelope ID: 0E7E470B-AF89-4B1A-A428-6D26C4BA7D54 CYBER-ATTACKS THREATEN SANTA BARBARA COUNTY 0 Unpatched software is software that has not been updated to the latest version provided by the vendor. Similar to outdated software, it can be easier to attack. . System misconfiguration is when settings within a computer program are not configured properly and could allow unauthorized access or unintended consequences. ٠ Inside attack is an attack by someone with authorized access to a computer system or network that uses the access in ways not approved or granted by the organization. This can sometimes occur when a terminated employee's system access has not been revoked on a timely basis.

Physical attack involves gaining access to computer systems and networks through physical means. This includes unauthorized access to facilities and buildings but can also include accessing the systems and networks by using an unattended computer terminal. Every public entity within Santa Barbara County needs to be familiar with these dangers and threats and the steps that need to be taken to prevent them.