CITY OF EAST PALO ALTO
Office of the City Council
May 19, 2022
Honorable Danny Y. Chou
Judge of the Superior Court
c/o Jenadra Dubois
Hall of Justice
400 County Center, 8th Floor
Redwood City, CA 94063-1655
RE: Civil Grand Jury Report: “Ransomware: It is not enough to think that you are protected” Dear Judge Chou:
The City Council of the City of East Palo Alto (City) voted at its public meeting on May 17, 2022, to authorize this response to San Mateo County’s civil grand jury 2019-20 report “Ransomware: It is not enough to think that you are protected,” released on October 7, 2020.
RESPONSES TO FINDINGS
F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.
City Response: City of East Palo Alto agrees that cybersecurity threats, including ransomware, are a growing threat to public agencies.
F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.
City response: City of East Palo Alto agrees with the finding that local governments are increasingly the target of cybersecurity threats.
F3. The direct and indirect costs of Ransomware can be significant.
City response: City of East Palo Alto agrees that the direct and indirect costs of cybersecurity threats are significant.
F4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.
City response: City of East Palo Alto agrees with the finding.
F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and fully recovery testing.
City response: City of East Palo Alto agrees with the finding.
F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.
City response: City of East Palo Alto agrees with the finding.
F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.
City response: City of East Palo Alto agrees with the finding.
F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.
City response: City of East Palo Alto agrees with the finding.
RESPONSES TO RECOMMENDATIONS
The Grand Jury recommends that each governing body undertake its own confidential effort to protect against Ransomware attacks, as follows:
R1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise), should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:
1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)
2. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?)
3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) City Response. Will be completed by December 31, 2022.
R2. These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.
City response: Will be implemented by December 31, 2022.
R3. Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of Homeland Security and/or a cyber hygiene assessment from the County Controller’s Office.
City response: Further analysis required pending results from R1.
R4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool.
City response: Further analysis required pending results from R1.
Sincerely,
Ruben Abrica
Mayor