Grand Jury Report — East Palo Alto City Council, May 17, 2022

2019-2020 San Mateo County Civil Grand Jury 1
Ransomware:

SUMMARY
Ransomware has already hit many governmental Information Technology (IT) systems in San Mateo County. In December 2019 the Grand Jury sent an online survey to all 68 public entities in San Mateo County,1 received 37 survey responses (a 54% response rate), and interviewed several responders including one IT Manager (who had refused to respond to the survey for fear of being successfully attacked once again), for a total of 38 responses via survey and interview.

More than 25% (10 of 38) of the public entities responding to the Grand Jury reported that they have been a victim of one or more Ransomware attacks. More concerning is the certainty that there will be more attempts to violate the integrity of our local governments’ electronic infrastructure.

This report is intended to present “best practices” in developing a Cybersecurity strategy, then implementing and testing that plan. It addresses actions that can be taken (and have been taken, in some cases) in order to guard against Ransomware attacks, recover from an attack and the additional measures that can be taken to reduce the possibility of an attack. However, it is not an exposé with details of potential system weaknesses, in light of the need for Cybersecurity strategies and practices to be highly confidential. As such, this report walks the line between providing an informed discussion of potential concerns without providing a road map of how to breach public government IT systems.

The single largest exposure every organization has to cyber-thieves is phishing, the illegal practice of sending legitimate-looking emails to an organization’s employees. These emails may contain malware or links that, when clicked, infect the computer with a virus that can spread to the entire information systems network.

Although many email software programs include some level of protection against Ransomware attacks, such protections require customization and activation, and it is not clear that local public

1 See Appendix F: Public Entities in San Mateo County (Cities, County, School Districts, Special Districts) 2019-2020 San Mateo County Civil Grand Jury 2
entity IT departments are undertaking these necessary customization and activation steps. In addition, training for new employees and recurring training for existing employees is critical to dramatically reducing the probability of a Ransomware infection. In some agencies, it appears that only limited training is provided for new employees with little or no recurring training provided for current employees.2
Ransomware and other malware attacks are a test to an organization’s backup and restoration procedures.
3 The Grand Jury found that none of the survey responders has actually performed a full restore as a test of their backup process. However, without adequate testing, backups do not provide sufficient protection.

Rigorous preparation for an attack is essential if fast and full recovery is desired and the payment of a ransom is to be avoided. There are several significant steps that local public entities should take to improve their defenses, their ability to detect incursions, and their responses to Ransomware attacks. These steps include:
 Using firewalls to protect internal environments from breaches;  Using malware detection software to monitor incoming emails and network activity;  Ensuring that users are educated and tested to learn what to watch for and avoid, especially in emails;
 Developing and fully testing a thorough backup and restore strategy to enable a complete recovery from an attack;
 Putting in place internal controls such as subnets, which require departmental authorization to access other department’s data or programs.

In addition, cloud hosting should be considered for email and certain applications to reduce the success of Malware and Ransomware attacks on information systems infrastructure.

While all attacks are malicious in terms of time and potential data loss, in the case of Ransomware (or worse, Ransomware 2.0 that also infects backup data) the financial cost of paying the ransom in order to remove the infection and restore a data system can be significant.

Alternatively, if the decision is to not pay the ransom but to attempt to recover from the infection manually, the direct and indirect costs could be considerably more.

This report is directed to the governing bodies of government entities in San Mateo County urging them to have their IT staff confidentially and urgently assess their respective Ransomware protection strategies and training and then move with all deliberate speed to address any shortcomings in their Cybersecurity programs.

GLOSSARY

CLOUD COMPUTING
Cloud computing is the delivery of on-demand computing services -- from applications to storage and processing power -- typically over the internet and on a pay-as-you-go basis. Rather

2 Grand Jury interviews
3 Epicor Corporation, Protecting Yourself From Ransomware, January 2020 2019-2020 San Mateo County Civil Grand Jury 3
than owning their own computing infrastructure or data centers, companies can rent access to anything from applications to storage from a cloud service provider.4 Some examples of this are Yahoo Mail, services like Google Docs, and customer relationship management software.5

CYBERSECURITY
Cybersecurity refers to the body of technologies, processes, and practices designed to protect networks, devices, programs, and data from attack, damage, or unauthorized access.6 Cybersecurity is a combination of secure systems (hardware and software) built into technology as well as human intervention, monitoring, training, awareness, and recovery.

ENCRYPTION
The process of locking out the contents of a file and the renaming of the file such that it cannot be opened and used in the intended application (e.g. Microsoft Excel). Typically, a 128 Bit (or larger) encryption key (a long series of letters and numbers) is used first to encrypt then later to un-encrypt a file.

MALWARE
Short for “malicious software,” this software is designed specifically to damage or disrupt computer systems. Not all malware is Ransomware because some malware has no related attempt to extort money.

PHISHING
The illegal practice of sending email claiming to be from reputable companies to induce individuals to reveal personal information or click on website links or open attachments that then install malware.

RANSOMWARE
Ransomware can be simply described as an infection on a host machine that prevents access to data until a ransom is paid. The most common method of infection is to encrypt files making them totally unreadable by a user. The infection is usually delivered by a Trojan Horse (a term referring to the misleading of users of its true intent) installed when a user clicks on a malicious link or attachment in an email.

RANSOMWARE 2.0
This newer version of Ransomware no longer is just malware that encrypts data and asks for ransom, the attacker also threatens to release the data onto the internet and demands money in order not to do so. This newer Ransomware works in such a way that even backup copies of most important files will not be able to save an infected organization.7 By planting the malware but delaying its activation, Ransomware 2.0 can infect backups thus defeating their value.

4 https://www.zdnet.com/article/what-is-cloud-computing-everything-you-need-to-know-from-public-and-privatecloud-to-software-as-a/ 5 Pearson Education, Ubuntu Unleashed 2015 Edition: Covering 14.10 and 15.04, page 655 6 https://digitalguardian.com/blog/what-cyber-security
7 https://www.itproportal.com/news/welcome-to-the-era-of-ransomware-20/ 2019-2020 San Mateo County Civil Grand Jury 4

BACKGROUND
Ransomware is a real and serious threat to every entity: government organizations, corporations, and individuals. The more dependence an organization has on the software and data in its network(s), the more important the concern should be. Loss of access to mission-critical data, systems, and software can severely impact an organization in both the short and long term.

According to an October 2019 report by the National League of Cities, since 2013, Ransomware attacks have been reported by at least 170 county, city or state government entities across the United States.
8 The actual number is likely to be much higher because it represents only those attacks that have been reported. Many infections go unreported when ransoms are paid, 9 when
organizations are seeking to avoid embarrassment, or when the attacks were simply undetected or untraceable.10 This has been true even in San Mateo County where local public governing entities have had Ransomware attacks that were not publicly reported. 11 Not only do such data breaches embarrass and slow organizational productivity, they can be very expensive. For example, the MIT Technical Review (2019) asserts: “Ransomware may have cost the U.S. more than $7.5 billion in 2019… the victims were 113 governments and agencies, 764 health-care providers, and up to 1,233 individual schools affected by Ransomware attacks…most local governments do a poor job of practicing Cybersecurity.”12 The cost to the city of Atlanta to recover from its Ransomware breach was estimated at $17 million.13 Similarly, a recent Baltimore Ransomware breach is estimated to have cost over $18 million.14 In 2020, the UC San Francisco School of Medicine paid $1.14 million in ransom to recover its own data. 15 These are
large cities and entities and although the ransom amounts they paid may not represent the expenses a San Mateo County public organization could incur, they provide examples of the severity of the potential threat and the enormous costs.

Specifically, the costs of a Ransomware attack could include some or all of the following:16  Direct Costs:
o Paying the ransom to obtain an encryption key and hoping that it works;

8 National League of Cities report, Protecting Our Data: What Cities Should Know About Cybersecurity. Forward by Clarence Anthony, CEO and Executive Director.
9 https://healthitsecurity.com/news/as-ransomware-attacks-increase-dhs-alerts-to-Cybersecurity-insights 10 Sheehan, Patrick, Ohio Emergency Management Agency, Cascading Effects of Cyber Security on Ohio, September 19, 2012
11 Grand Jury survey responses
12 MIT Technology Review, Ransomware may have cost the US more than $7.5 billion in 2019, January 2, 2020 13 The Atlanta Journal- Constitution, Stephen Deere. Confidential Report: Atlanta’s cyber attack could cost taxpayers $17 million. August 2018.
14 Baltimore Sun, Ian Duncan, Baltimore estimated cost of ransomware attack at $18.2 million as government begins to restore email accounts. May 29, 2019.
15 San Jose Mercury News, David Wu, “UCSF pays $1.14 million ransom to recover data”, July 4, 2020 16 https://www.sentinelone.com/blog/what-is-the-true-cost-of-a-ransomware-attack-6-factors-to-consider/ 2019-2020 San Mateo County Civil Grand Jury 5
o Expenditures for outside IT professionals and new systems providers to plan and implement improved breach security based on new Ransomware strategies; o Paying for enrollments in credit reporting bureaus to stop or correct identity thefts (from the release of previously confidential or secure personal information) for client/customers.
o Replacing hardware and/or software.
 Indirect Costs:
o Operations efforts to restore systems and data;
o Organizational downtime as well as employee overtime; o Reputation loss including negative public relations and loss of confidence by the organizations’ constituents;
o Liabilities for legal costs, including defense of lawsuits for breach of private and confidential information and poor handling of personal data.

According to the Coveware Report,
17 the median ransom payment in the first quarter of 2020 was $44,021. This was an increase of roughly 10% over the last quarter of 2019. Public sector entities represented 12% of attacks, about half of which were school systems. The average days of downtime was 15 representing an alarming number of days of inability to service constituents.
18 This underlines an urgent need to understand and evaluate current local governments’ Cybersecurity strategies.

The discussion that follows is intended to encourage local public agencies and their IT staff to confidentially evaluate their respective Cybersecurity plans, software and prevention strategies.

Since data and systems security are essential to the operation of every public entity in the County, the discussion will not present a specific road map for potential Ransomware-prevention actions but rather establish a “best practice model” that will enhance understanding of the elements essential for an adequate protection plan.

DISCUSSION
In December 2019, the Grand Jury developed an online survey that was sent to all 68 public entities in San Mateo County.
19 Responses were received from 37 of the entities (a 54% response rate). Additionally, follow-up interviews were conducted with three local public IT Managers, one of whom had refused to complete the online survey for fear of disclosing confidential information that could lead to a successful malware or Ransomware attack. These interviewees were questioned regarding the adequacy of Cybersecurity planning and execution.

Following a general analysis of local government practices, this report concludes with a review of Cybersecurity best practices which local agencies should consider adopting.

Two Ransomware Attacks Derailed: Best Practices in Action

17 https://www.coveware.com/blog/q1-2020-ransomware-marketplace-report 18 https://www.msspalert.com/Cybersecurity-research/average-ransomware-payment-rises-again-research/ 19 Appendix F
2019-2020 San Mateo County Civil Grand Jury 6
In order to better understand how to successfully defeat a Ransomware attack, the Grand Jury interviewed an IT Manager of a private enterprise that was attacked twice by Ransomware and was able to fully restore the environment and re-establish workflow within just a few hours.

Given the usual secrecy involved in most malware incursions, the following description of this IT manager’s actual experience is instructive since it offers an example of “best practices” that can guide others anticipating or facing a Ransomware threat. 20 This organization suffered two serious breaches less than two months apart and successfully recovered both times. In the first breach, within 45 minutes of a user clicking on an email attachment, the Crypto virus had spread to 12 of the organization’s 23 servers. The IT Manager was alerted to the problem both by the user whose PC was locked with the Ransomware demand on his screen and an auto alert from the network scanning software that reported unusual activity.

The IT Manager’s first action was to rapidly shut down the entire server network. This of course stopped the spread of the virus, but also prevented users from performing their jobs. Fortunately, their backup strategy implementation worked well as they were able to fully recover within hours.

The major components of the protection strategy employed included:
 Separating the network into discrete departments or segments (creating subnets) which restricted individuals’ access to only servers containing their department’s software and network storage. This limited the spreading of the virus across various departments within the organization. The analogy is a modern ship with rooms and decks that can be completely closed off from each other in the event of a fire or explosion.  Taking snapshots (copies) of their Storage Area Network (SAN) twice a day.  Completing full nightly backups of their SQL databases and incremental backups of the databases at five-minute intervals.
 Performing server backups with a commercial external backup appliance and/or service.

See Appendix D for examples of companies in this market.21  Regularly testing the restore process to ensure the successful recovery of critical server hardware. Without testing, there is no assurance that the Cybersecurity plan will work.

Moreover, even if it works once, that is no assurance it will work again, without periodic re-testing.
 Conducting weekly backups of critical personnel’s full PC hard drives.  Use the “3-2-1 strategy”
22: do three backups into two different media including one offsite.

Having all of these Cybersecurity plan components was a good start but it took much more to affect a recovery. First a commercial Virus Removal Software Tool was used which did not work (in this case). Therefore, the IT team used the snapshot copies to replace corrupted data on

20 Grand Jury Interview
21 These services include onsite and offsite backup and recovery services which are usually located outside the immediate locale.
22 Management Wire, The 3-2-1 Backup Rule and Effective Cybersecurity Strategy, January 7, 2020. 2019-2020 San Mateo County Civil Grand Jury 7
infected server units followed by the application of the incremental backups of the database to complete the restore.

This detailed example represents a well thought out and highly prepared plan, executed with precision. The first breach resulted in 4½ hours of downtime as 12 servers were infected. The second breach resulted in 6 ½ hours of downtime to recover 19 affected servers. The IT team was able to recover the servers and their data both times, become fully operational within hours, and the organization did not pay any ransom demands.

Grand Jury Cybersecurity Survey and Follow-up Interviews Survey question:23 “Has your Organization had a Ransomware attack? Specifically, has there been an instance or multiple instances when an attack has locked up a computer or computers and presented a demand for ransom to unlock the infection?” Nine survey responders and one non-survey responder interviewee, a total of 10 of 38 (37 responders to the online survey and one non-survey responder) affirmed an attack had occurred or had possibly occurred in their organization, a 26% “hit” rate. The circumstances of their attacks were reviewed.
24 The non-survey interviewee was the IT manager from a public entity in the County who was unwilling to complete the survey because they did not want to reveal that their organization had been subject to “one or more” Ransomware attacks. Nor were they willing to disclose how successful the Ransomware attack(s) were for fear that they would open themselves up to more attacks.

Survey Question:
25 “Is your Information Systems Budget adequate to secure your network properly from malicious attack?”
Thirty-two of the 37 survey respondents, or 86%, answered Yes to this question. This high percentage of “Yes” responses either indicates a high level of confidence in their defense setup, a reluctance to complain about their IT budget, or as two of our follow-up interviewees revealed26, a lack of understanding of the complexity of a well-written, well-executed Cybersecurity Plan.27 Suggesting the latter, The National League of Cities conducted a similar survey of 165 city governments nationwide and asked the same question, (“Is your budget adequate enough to secure your network properly?”): 67% replied “No”. 28
Investigation Results Regarding Backup/Restore/Maintenance The Grand Jury survey and follow-up interviews revealed that, while many local agencies have backup plans,
29 only a portion of those same agencies had successfully recovered lost files from

23 Appendix A – Question #1
24 Grand Jury Interview
25 Appendix A – Question #2
26 Grand Jury Interviews
27 Federal Communications Commission, Cyber Security Planning Guide, October 2012. 28 National League of Cities report, Protecting Our Data: What Cities Should Know About Cybersecurity, page 8 29 Appendix A – Question #3
2019-2020 San Mateo County Civil Grand Jury 8
backups and none of the survey responders had ever done a full restore of a server. 30 When an
attack occurs with inadequate backup processes in place, there is no way to recover. Moreover, a proactive and well-thought-out business continuity plan is something that all system and data administrators must embrace.

What is a good backup strategy? Certain applications provide the ability within the applications themselves to set up different types of backups and schedule them to be performed automatically. A good example of this is SQL.
31 Using a SQL-based approach, both nightly full
database backups can be scheduled as well as intermittent transaction log backups (which capture activity during small time increments), so that a recovery could be completed with virtually no loss of data. These backups should then be stored according to the 3-2-1 backup rule32 whereby three copies or versions are taken, stored on two different media, one of which is offsite. Operating systems and third-party vendors offer a multitude of backup solutions for servers. Snapshots or image backups33 provide the most complete backup and the fastest restore option.
34 Raj Samani, Chief Technology Officer for Europe at Intel Security captures the importance of a complete backup strategy, “Most Ransomware attacks can be avoided through good cyber hygiene and effective, regular data backups that are continually tested to ensure they can be restored if needed.”
35 As this discussion shows, the technology to prevent and if necessary, correct, the impact of a malware attack is available. Local government agencies must be pro-active and vigilant in using such to protect their data and their businesses.

Investigation Results Regarding Employee Training
Education is the best defense. “Preventing infection is far easier than correcting the situation as most of the infections are acquired either from a socially engineered email (one that appears reputable or from a familiar source), or from visiting an infected website, so controlling risk on your side is the easiest method.”
36 Answers to Survey Question #5 provide strong evidence for the need for the governing boards to review with their IT managers their defenses against cyberthreats: “Do you provide training to employees regarding malware?” 12 responded with a non-qualified “Yes”. Nine responded “No” (24%) and 16 responded with a qualified “Yes” (42%) and described their training as

30 Appendix A – Question #4
31 Structured Query Language (SQL) is a programming language 32 Management Wire, The 3-2-1 Backup Rule and Effective Cybersecurity Strategy, January 7, 2020. 33 Image backup consists of block by block storing of the contents of a hard drive 34 https:\\www.ltnow.com/file-backup-vs-image-backup-which-is-best/ 35 Zerto, Raj Samani, Ransomware – Mitigating the Threat of Cyber Attacks, 2019 36 Epicor, Protecting Yourself from Ransomware, January 2020 2019-2020 San Mateo County Civil Grand Jury 9
needing improvements.
37 As one survey responder commented, “The answer is yes, but a lot more needs to be done.”
Cybersecurity training is a well-established industry – providing a focused set of classes and materials designed to reduce users’ clicks on harmful links and attachments. Security training, awareness, and assessment should be a routine part of the Cybersecurity strategy in government.

Deploying such a program covers the education, training and testing of employees to recognize, delete and report attempted attacks. Studies show these programs reduce but do not eliminate user error.

Government Technology magazine captured it best in their cover story entitled “In the quest to guard against cyberthreats, can we solve the people problem? The Weakest Link.”38 The article concluded that even with the best training programs and defenses, the human element may never be completely overcome.39 This is precisely why recurring training and user testing is encouraged by best practices.

Handling Incoming Emails – Phishing Defenses
In a worldwide survey of Managed IT Service Providers (MSP’s) in 2019, “67% of Ransomware attacks originated from a phishing or spam email…the easiest method of delivery and man does it pay off.”40 The greatest threats take advantage of users “within” the network, i.e., users who click on malicious links or open email attachments that contain viruses or make other mistakes that allow hackers to gain access to the entity’s system or network. Trend Micro estimates that the vast majority of all attacks occur when a user clicks on something they should not.41 There are different ways to help the user community recognize and protect against a phishing attack. Most network environments utilize spam filters to automatically filter incoming messages. Spam filters are used to detect unsolicited, unwanted, and virus-infested email and stop it from getting into email inboxes.42 “Additionally, malware detection software can also be highly successful in reducing the risk of Ransomware but the anti-malware definitions (a database of known infectious code) need to be constantly updated…which takes effort and time but represents the single most effective defensive strategy.”43 Message rules can be used to flag external emails and thereby decrease the probability that a user clicks on bad content. An administrator can set up message rules on a users’ client or the email server. An example of a message rule might be if the sending organization includes @smithco.com in the sender’s address, the message is automatically moved the incoming message into a personal folder called “Smith Company.” A better example would be a rule that

37 Grand Jury Survey responses
38 Government Technology Magazine, Adam Stone, The Weakest Link, Oct/Nov 2018 39 Ibid
40 VadeSecure – Predictive Email Defense, Ransomware Attacks: Why Email is still the #1 Delivery Method”, January 16, 2020
41 https://blog.trendmicro.com/online-phishing-how-to-stay-out-of-the-hackers-nets/ 42 https://www.mailchannels.com/what-is-spam-filtering/ 43 Epicor, Protecting Yourself from Ransomware”, January 2020 2019-2020 San Mateo County Civil Grand Jury 10
flags all external emails (not from the host’s domain) and warns about the threats of clicking on attachments or weblinks. An example of this visual potential threat message rule is displayed in Appendix C.

Message rules can be very powerful to alert users of potential threats or to be careful about what they might click on and endanger their system. Some of the vendors listed in Appendix B also can “report” a suspected phishing attempt to an IT administrator. The Grand Jury’s review revealed that some of the Information Technology Services departments for local public entities have installed message rules on their email servers to notify users of external emails.44 This is a “best practice” which all local governmental agencies should consider.

Phishing emails are easy to create, as they do not take a high level of skill to provide the illusion of legitimacy by mimicking web-site brands or using logos from Google images. They can also easily spoof (fake) an email address to look like a trusted source.45 It can often be very difficult to catch these risky emails, as the spoofed emails are cleverly disguised. A YouTube video created by Cisco Systems illustrates the sophisticated approach a phishing email may take – “Anatomy of an Attack”.46 It shows an attacker constructing a realistic identity deception email and can be viewed at https://www.youtube.com/watch?v=4gR562GW7TI After you watch this video please note, had an email filter caught this message and flagged it as external and warned about clicking on links, the deception may have been caught.

What Does Excellent Cyber Defense Look Like?
Survey Question47: “What defenses do you currently employ to block malware? Please be specific. (Firewall brand/model, Software filters/spam blocker, etc.)” Five survey responders did not divulge the infrastructure of their environment. 17 responders provided abbreviated details indicating they do have Cybersecurity protections in place. The remaining 15 responses were explicit about their organizations’ hardware and software defense strategies. Below is a survey response that illustrates a well-protected environment using some of the best practices of Cybersecurity:
“At the first layer, we use a PAN 220 Firewall with all subscriptions enabled, (URL Filtering, Antivirus/Vulnerability, Wildfire, etc.), block all international countries both in and outbound.

Once traffic is passed for email, it passes through a Barracuda spam filter, filtering and scanning phishing and virus emails, checks with External Reputation servers for known virus and spamming servers, then passes to an on-premise exchange server. The exchange servers have another layer installed, Symantec Antivirus, giving a third layer of scanning. All servers and workstations have the latest version of the antivirus installed controlled by a centralized server.

Window patches are applied on a monthly basis to all servers and workstations, and servers are retired once Microsoft ends support for an operating system.” 48

44 Grand Jury interviews
45 Ibid
46 Cisco Systems, Ransomware - Anatomy of an Attack, https://www.youtube.com/watch?v=4gR562GW7TI 47 Appendix A - Question #6
48 Grand Jury Survey response
2019-2020 San Mateo County Civil Grand Jury 11
The survey respondent’s best practices:
 Filtering incoming email for viruses, malware, and phishing attempts;  Utilizing protection software from multiple vendors;
 Utilizing multiple layers of defense;
 Keeping systems up-to date.

Breaches and attacks that manage to extract data (Ransomware 2.0) expose additional risks to sensitive information. Security professionals point out additional options for securing organizational data:49
 Use Subnets50 to section out servers with separate security permissions and limited access;
 Disable and block unused services, protocols and ports;  Perform Backup & Recovery (focus on full testing of recovery);  Strengthen the password policy (long, complex, with expiration dates);  Employ 2-factor authentication (password then keycode) for external user access.51  Install Anti-malware / Antivirus software on all machines and keep current (update at least monthly);
 Update at least monthly, patches for operating systems, firewalls, spam filters, malware, and other key applications;
 Perform monitoring and auditing of failed logins, password changes, resource usage, and services stopping.

Local public entities can get assistance from The Federal Communications Commission’s (FCC) Cyber Security Planning Guide that includes a customized Cyber Security Planning Tool to craft and execute a customizable Cybersecurity plan.52 As their introduction explains, “data security is crucial … customer and client information, payment information, personal files, bank account details … all of this information is often impossible to replace if lost and dangerous in the hands of criminals… losing (your data) to hackers or malware infection can have far graver consequences.”
53 Public entities should take advantage of this Guide in reviewing the current status of their own data system security.

When answering questions of respondents via email it was found that some already use cloud hosting for email.
54 During the interviews it was further uncovered that a school IT manager is considering additional cloud hosting of one or more of their applications. Cloud providers are able to provide layers of protection for a customer’s network and software, as well as creating a segregation between their network and their customers. A cloud provider will patch and

49 Government Technology Magazine, Adam Stone, The Weakest Link, Oct/Nov 2018 50 https://searchnetworking.techtarget.com/tutorial/Protocols-Lesson-6-IP-subnetting-The-basic-concepts 51 The County’s Office of the Assessor-County Clerk-Recorder and Elections has already instituted 2-factor authentication. 2018-2019 Grand Jury Report – Security of Election Announcements. 52 Federal Communications Commission, Cyber Security Planning Guide https://transition.fcc.gov/cyber/cyberplanner.pdf and FCC Cyber Security Planner (customizable) https://www.fcc.gov/cyberplanner
53 Ibid, page PDS-1
54 eMails received from public domain accounts
2019-2020 San Mateo County Civil Grand Jury 12
maintain current software versions, leverage security and malware and have a dedicated security team (24x7x365) that is responsible for staying on top of the security risks.55 Conclusions
Grand Jury survey results and in-depth interviews determined that some local government agencies have Cybersecurity strategies in place. For them, this report is asking those IT departments to re-challenge the sufficiency of their employee training, the regular (full) testing of their defense strategies and the adequacy/age of their Cybersecurity strategy including consideration of cloud hosting. For the rest, this is a good time to complete a review and see what additional measures can be taken to beef up their IT security using the information provided in this report as a guide. The biggest trap is believing that a malware attack, or in the worst case a Ransomware attack, is unlikely to happen to organizations and that the Cybersecurity strategies already in place are sufficient to successfully recover.

As learned from the best practices example of the IT manager who thwarted two attacks successfully, a comprehensive Cybersecurity plan includes user prevention steps, spam and malware software, back-ups and full recovery testing. These suggestions as well as those from the professional literature on Cybersecurity include the following list of best practices:
 Anti-Malware definitions need to be constantly updated to retain their effectiveness.  Software updates need to be kept current.
 To identify external emails, message rules can be used to flag external emails and thereby decrease the probability that a user clicks on bad content.  To thwart phishing attempts, footers can be added to incoming emails to warn about opening attachments and clicking on links (see Appendix C).  Security training, awareness and assessment need to be routine along with testing all employees to recognize, delete and report attempted attacks (See Appendix B).  Establishing a thorough and comprehensive backup process for all Servers using the 3-2- 1 rule and establishing a separate backup process for key users’ critical folders (e.g., administration, accounting, human resources) to be able to restore/recover from a secure onsite and/or offsite backup.
 Snapshots and/or image backups provide the most complete backup and the fastest recovery option.
 Consider cloud-hosting of email and other applications to provide added security, backup & restore capabilities and filtering benefits to close the largest and easiest route for Ransomware to penetrate entity systems.

FINDINGS
F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

55 Government Technology Magazine, Adam Stone, The Weakest Link, Oct/Nov 2018 2019-2020 San Mateo County Civil Grand Jury 13
F3. The direct and indirect costs of Ransomware can be significant.

F4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

RECOMMENDATIONS
The Grand Jury recommends that each governing body undertake its own confidential effort to protect against Ransomware attacks. Specifically:

R1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) R2. These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

R3. Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of 2019-2020 San Mateo County Civil Grand Jury 14
Homeland Security56 and/or a cyber hygiene assessment from the County Controller’s Office.57
R4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

METHODOLOGY
Documents
 Attack incident reports were requested from IT Departments who experienced attack(s).

No incident reports were received.

Site Tours
 No site tours were performed as a part of this report.

Interviews
Reports issued by the Civil Grand Jury do not identify individuals interviewed. Penal Code Section 929 requires that reports of the Grand Jury not contain the name of any person or facts leading to the identity of any person who provides information to the Civil Grand Jury.
 Three Information Systems Managers of three different public entity IT organizations.  Two non-public professional IT Managers. Both of these Managers’ IT infrastructure environments had been infected with Ransomware attacks. One paid the ransom and the other did not.
 A professional Ransomware expert who often consults with companies who have been attacked or desire assistance preventing attacks. He also teaches classes on preparing for and preventing Ransomware attacks.
 Numerous security industry professionals at the RSA Conference held at Moscone Center in San Francisco between February 24th and 28th 2020.

BIBLIOGRAPHY
Anslinger, Joe. “File Backup vs. Image Backup – Which is Best?” Lieberman Technology. June 11, 2013. https://www.ltnow.com/file-backup-vs-image-backup-which-is-best/ Cisco Systems. Ransomware - Anatomy of an Attack.
https://www.youtube.com/watch?v=4gR562GW7TI

56 https://www.us-cert.gov/resources/assessments
57 2018-2019 San Mateo Grand Jury Report – Security of Election Announcements 2019-2020 San Mateo County Civil Grand Jury 15
Coveware, “Ransomware Payments Increase In Evolving Distribution of Enterprise Ransomware Variants.” April 29, 2020. https://www.coveware.com/blog/q1-2020-ransomwaremarketplace-report Davis, Jessica. “As Ransomware Attacks Increase, DHS Alerts to Cybersecurity Insights.” Health IT Security, September 9, 2019. https://healthitsecurity.com/news/as-ransomwareattacks-increase-dhs-alerts-to-cybersecurity-insights Deere, Stephen. “Confidential Report: Atlanta’s Cyber Attack Could Cost Taxpayers $17 Million.” The Atlanta Journal- Constitution. August 2018.

Department of Homeland Security (DHS): Cybersecurity and Infrastructure Security Agency (CISA). “Assessments: Cyber Resilience Review (CRR)” https://www.uscert.gov/resources/assessments Duncan, Ian. “Baltimore Estimated Cost of Ransomware Attack at $18.2 Million as Government Begins to Restore Email Accounts.” Baltimore Sun, May 29, 2019.

Epicor Corporation. Protecting Yourself From Ransomware. January 2020.

Fadilpasic, Sead. “Welcome to the era of Ransomware 2.0” ITProPortal. February 12, 2020. https://www.itproportal.com/news/welcome-to-the-era-of-ransomware-20/ Federal Communications Commission. Cyber Security Planning Guide. https://www.fcc.gov/cyber/cyberplanner.pdf
Gutman, Yotam. “What is the True Cost of a Ransomware Attack.” SentinelOne. January 8, 2020. https://www.sentinelone.com/blog/what-is-the-true-cost-of-a-ransomware-attack-6-factorsto-consider/ Iloh, Raphael. ”The 3-2-1 Backup Rule and Effective Cybersecurity Strategy.” Management Wire. January 7, 2020. https://www.managementwire.com/the-3-2-1-backup-rule-and-effectivecybersecurity-strategy/ Jendre, Adrien.” Ransomware Attacks: Why Email Is Still the #1 Delivery Method.” Vade Security. January 16, 2020. https://www.vadesecure.com/en/ransomware-attacks-why-email-isstill-the-1-delivery-method/ Kass, DH. “Average Ransomware Payment Rises Again: Research.” MSSP Alert. April 30, 2020. https://www.msspalert.com/cybersecurity-research/average-ransomware-payment-risesagain-research/ Kraft Technology Group. “When Was The Last Time You Tested Your Business Backups?” https://www.kraftgrp.com/when-was-the-last-time-you-tested-your-business-backups/ 2019-2020 San Mateo County Civil Grand Jury 16
MailChannels. “What is Spam Filtering?” https://www.mailchannels.com/what-is-spamfiltering/ MIT Technology Review, “Ransomware May Have Cost the US More Than $7.5Billion in 2019.” January 2, 2020. https://www.technologyreview.com/2020/01/02/131035/ransomwaremay-have-cost-the-us-more-than-75-billion-in-2019/ National League of Cities Report. “Protecting Our Data: What Cities Should Know About Cybersecurity.” Forward by Clarence Anthony, CEO and Executive Director.

Pearson Education. Ubuntu Unleashed. 2015 Edition. Page 655.

Ranger, Steve. “What is cloud computing? Everything you need to know about the cloud explained.” ZD Net, December 13, 2018. https://www.zdnet.com/article/what-is-cloudcomputing-everything-you-need-to-know-from-public-and-private-cloud-to-software-as-a/ Samani, Raj. “Ransomware – Mitigating the Threat of Cyber Security Attacks.” Zerto. 2019. https://www.zerto.com/wp-content/uploads/2019/09/ransomware-mitigating-the-threat-of-cybersecurity-attacks.pdf San Mateo Grand Jury Report. Security of Election Announcements. 2018-2019.

Search Networking, “Protocols, Lesson 6: IP subnetting - The basic concepts.” October 2004. https://searchnetworking.techtarget.com/tutorial/Protocols-Lesson-6-IP-subnetting-The-basicconcepts Sheehan, Patrick. “Cascading Effects of Cyber Security on Ohio.” Ohio Emergency Management Agency. September 19, 2012.

Stone, Adam. The Weakest Link. Government Technology Magazine, October/November 2018.

Trend Micro. “Online Phishing: How To Stay Out Of The Hackers’ Nets” November 20, 2019. https://blog.trendmicro.com/online-phishing-how-to-stay-out-of-the-hackers-nets/ Wu, David. “UCSF pays $1.14 Million Ransom to Recover Data.” San Jose Mercury News. July 4, 2020.
2019-2020 San Mateo County Civil Grand Jury 17
APPENDIX A – SURVEY QUESTIONS

1. Has your Organization had a Ransomware attack? Specifically, has there been an instance or multiple instances when an attack has locked up a computer or computers and presented a demand for ransom to unlock the infection?
If you answered Yes or Possibly to Question 1, please provide a detailed description of the attack. What actions were taken once the attack was realized?

2. Is your Information Systems Budget adequate to secure your network properly from malicious attack?

3. Please provide an explanation of your Systems Backup processes? How often are backups run, where do you store the Backups?

4. Have you ever had to Restore from Backups? Please describe in detail why you did the Restore and describe the process used.

5. Do you provide training to employees regarding Malware?

6. What defenses do you currently employ to block malware? Please be specific. (Firewall brand/model, Software filters/spam blocker, etc.)
APPENDIX B – EMPLOYEE TRAINING OPTIONS
Phishing is the primary method of entry in cyber-attacks worldwide. Over the past few years, some security industry companies have come up with excellent testing, training, monitoring, measuring and reporting solution to help with employee training. The primary goal of an employee training program is to change user’s behavior when viewing emails that might contain threats.

The typical components of these solutions include:
 Customized phishing attacks designed to test employees in spotting attack attempts  Provide users a simple to use reporting tool to flag suspected attacks  An incidence response platform for controlling the spread of an attack  Reporting dashboards tracking user click-throughs
 Employee training programs
Here are some website links for the companies offering training solutions. www.knowbe4.com
www.lucysecurity.com
www.metacompliance.com
www.mediapro.com
www.cofense.com
www.elevatesecurity.com
www.securitymentor.com
2019-2020 San Mateo County Civil Grand Jury 18
www.habitu8.io
APPENDIX C – EMAIL MESSAGE RULE - EXTERNAL
APPENDIX D – BACKUP & RECOVERY APPLIANCES & SERVICES
There are a large number of companies that provide Backup and Recovery solutions. Solutions Review has prepared a buyer’s guide for the leading vendors. Click on the following link or copy and paste this URL into a browser to get your own copy of this guide. https://solutionsreview.com/backup-disaster-recovery/get-a-free-backup-and-disaster-recoverybuyers-guide/ Specifically, some of the vendors in this report do not provide appliances, only virtual server support. Here is a partial list of appliance and solution vendors:
www.unitrends.com
www.barracuda.com
www.carbonite.com
www.commvault.com
www.dellemc.com
www.axcient.com
www.cohesity.com
www.datto.com
www.infrascale.com
APPENDIX E – PHISHING DEFENSE VENDORS
Some companies that provide solutions that improve email defenses are:
https://www.opswat.com/products/metadefender/email-gateway-security https://www.agari.com/products/phishing-defense/
https://www.inky.com/anti-phishing-software
https://www.mimecast.com/products/email-security-with-targeted-threat-protection/ 2019-2020 San Mateo County Civil Grand Jury 19
APPENDIX F: PUBLIC ENTITIES IN SAN MATEO COUNTY (68)
City/Town Governments (20)
Town of Atherton
City of Belmont
City of Brisbane
City of Burlingame
City of Colma
City of Daly City
City of East Palo Alto
City of Foster City
City of Half Moon Bay
City of Hillsborough
City of Menlo Park
City of Millbrae
City of Pacifica
Town of Portola Valley
City of Redwood City
City of San Bruno
City of San Carlos
City of San Mateo
City of South San Francisco
Town of Woodside
County Government (1)
County of San Mateo, Information Services Department
School Districts (25)
Bayshore Elementary School District
Belmont Redwood Shores School District
Brisbane School District
Burlingame School District
Cabrillo Unified School District
Hillsborough City School District
Jefferson Elementary School District
Jefferson Union High School District
La Honda Pescadero School District
Las Lomitas Elementary School District
Menlo Park City School District
Millbrae School District
Pacifica School District
Portola Valley School District
Ravenswood City School District
Redwood City School District
San Bruno Park School District
San Carlos School District
2019-2020 San Mateo County Civil Grand Jury 20
San Mateo Foster City School District
San Mateo Union High School District
Sequoia Union High School District
San Mateo County Community College School District
San Mateo County Office of Education
South San Francsico Unified School District
Woodside School District
Independent Special Districts (22)
Bayshore Sanitary District
Broadmoor Police Protection District
Coastside County Water District
Coastside Fire Protection District
Colma Fire Protection District
East Palo Alto Sanitary District
Granada Community Services District
Highlands Recreation District
Ladera Recreation District
Menlo Park Fire Protection District
Mid Peninsula Regional Open Space District
Mid-Peninsula Water District
Montara Water and Sanitary District
North Coast County Water District
Peninsula Health Care District
San Mateo County Harbor District
San Mateo County Mosquito and Vector Control District
San Mateo County Resource Conservation District
Sequoia Healthcare
West Bay Sanitary District
Westborough Water District
Woodside Fire Protection District
Not Included: County-governed special districts and subsidiary special districts governed by their respective city councils.

Issued: October 7, 2020
155 Bovet Road, Suite 650, ⚫ San Mateo, CA 94402 ⚫ ph 650 349 3000 ⚫ fx 650 349 8395 ⚫ www.bawsca.org 17624043.3
June 23, 2021
The Hon. Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center, 8th Floor
Redwood City, CA 94063-1655
Subject: Bay Area Water Supply & Conservation Agency Response to Grand Jury Report Entitled “Ransomware: It Is Not Enough To Think You Are Protected”
Dear Honorable Chou:

The Bay Area Water Supply & Conservation Agency (Agency) received the 2019-2020 Grand Jury report entitled “Ransomware: It Is Not Enough To Think You Are Protected.” In response, the Agency’s Board of Directors requested an internal IT report regarding the Agency's cybersecurity practices, which it received at the May 20, 2021 regular Board meeting. In addition, this letter responds to all of the findings and recommendations in the Grand Jury report.

Responses to Findings:

1. Ransomware is a real and growing threat to public entities, including those in San Mateo County.

The Agency agrees with this Finding.

2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

The Agency does not have first-hand knowledge to agree or disagree with this statistic. The Agency nonetheless accepts the Grand Jury's finding.

3. The direct and indirect costs of Ransomware can be significant.

The Agency agrees with this Finding.

4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

The Agency agrees with this Finding.

5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

The Agency agrees with this Finding.

6. The identification of the phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

The Agency agrees with this Finding.

Hon. Danny Y. Chou
June 23, 2021

Page 2 ends

17624043.3

7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part of an entity’s backup plan to recover lost information.

The Agency agrees with this Finding.

8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

The Agency agrees with this Finding.

Responses to Recommendations:

1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:
a. System Security (Firewalls, Anti-malware/ Antivirus software, use of subnets, strong password policies, updating/patching regularly)
b. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?)
c. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content)
The recommendation has been implemented.

2. These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

The recommendation has been implemented. The Agency's Board of Directors received a confidential report on May 20, 2021.

Based on the internal report, the Agency has not decided to request further guidance at this time. However, the Agency accepts this recommendation and will request outside guidance if appropriate based on future circumstances.

4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC's Cybersecurity Planning Guide and consider customizing it using FCC's Create Custom Cybersecurity Planning Guide tool.

The Agency will implement this recommendation and will consult the FCC Cybersecurity Planning Guide in future updates to its Cybersecurity Plan.

Hon. Danny Y. Chou
June 23, 2021

Page 3 ends

17624043.3
The Agency appreciates the effort that the Grand Jury put into the important cybersecurity issue and the opportunity to respond to the Grand Jury report. Please let us know if the Agency can provide additional information.

Very truly yours,
Nicole Sandkulla
CEO/General Manager
cc: BAWSCA Board of Directors

December 16, 2020
Via Email ([email protected])
Re: Response to the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough To Think You Are Protected.”
Dear Judge Chou:

The Bayshore Elementary School District (the “District”) has received and reviewed the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough To Think You Are Protected.” We appreciate the Grand Jury’s interest in this matter. Having reviewed and considered the Grand Jury’s Findings and Recommendations, the District responds below pursuant to section 933.05 of the California Penal Code.

Please be advised that the District presented the Grand Jury Report to its Board of Trustees, and the District’s Board approved these responses, on Tuesday, December 15, 2020.

Findings:

1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

The District agrees with this Finding.

2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

The District lacks information to fully agree or disagree with this Finding given that it did not conduct the research related to this Report. The District, however, accepts the Grand Jury’s Finding for the purposes of this Response.

3. The direct and indirect costs of Ransomware can be significant.

The District agrees with this Finding.

4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

Engage. Educate. Empower.

Mrs. Maya Baker, Principal
The Honorable Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center; 2
nd Floor
Redwood City, CA 94063-1655
The District agrees with this Finding.

5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

The District agrees with this Finding.

6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

The District agrees with this Finding.

7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

The District agrees with this Finding.

Recommendations:

1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:
a. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)
b. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?) c. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) The District implemented this Recommendation on December 9, 2020 by directing the District’s IT Department to prepare a confidential report [A1]which addresses the three concerns specifically identified above.

The District intends to implement this Recommendation, provided that the District may require an extension of time (not to exceed six months) beyond June 30, 2021 depending on the scope, complexity, and feasibility of any recommended actions and/or enhancements.

The District will implement [A2] this Recommendation if warranted and appropriate based on the results of the District’s confidential internal report.

4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

The District will implement [A3] this Recommendation if warranted and appropriate based on the results of the District’s confidential internal report.

Please do not hesitate to contact me if you have questions or require additional information.

Sincerely,
Audra Pittman, Ph.D.

Superintendent
Bayshore Elementary School District

November 9, 2020
Via Email ([email protected])
Re: Response to the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough To Think You Are Protected.”
Dear Judge Chou:

The Belmont-Redwood Shores School District (the “District”) has received and reviewed the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough To Think You Are Protected.” We appreciate the Grand Jury’s interest in this matter. Having reviewed and considered the Grand Jury’s Findings and Recommendations, the District responds below pursuant to section 933.05 of the California Penal Code.

Please be advised that the District presented the Grand Jury Report to its Board of Trustees, and the District’s Board approved these responses, on November 9, 2020.

Findings:

1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

The District agrees with this Finding.

2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

3. The direct and indirect costs of Ransomware can be significant.

The District agrees with this Finding.

The Honorable Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center; 2
nd Floor
Redwood City, CA 94063-1655

4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

The District agrees with this Finding.

5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

The District agrees with this Finding.

6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

The District agrees with this Finding.

7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part of an entity’s backup plan to recover lost information.

8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

The District agrees with this Finding.

Recommendations:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) The District implemented this Recommendation on October 23, 2020 by directing the District’s IT Department to prepare a confidential report [A1] which addresses the three concerns specifically identified above.

The District will implement [A2] this Recommendation if warranted and appropriate based on the results of the District’s confidential internal report.

4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

The District will implement [A3] this Recommendation if warranted and appropriate based on the results of the District’s confidential internal report.

Please do not hesitate to contact me if you have questions or require additional information.

Sincerely,
Dan Deguara
Superintendent

EMILY BEACH, MAYOR
ANN O’BRIEN KEIGHRAN, VICE MAYOR

RICARDO ORTIZ

MICHAEL BROWNRIGG

DONNA COLSON
TEL: (650) 558-7200
FAX: (650) 566-9282
www.burlingame.org
The City of Burlingame
CITY HALL -- 501 PRIMROSE ROAD
BURLINGAME, CALIFORNIA 94010-3997
December 7, 2020
Honorable Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center, 2nd Floor
Redwood City, CA 94063-1655
Subject: City of Burlingame’s response to 2019-2020 Civil Grand Jury Report entitled "Cybersecurity – It Is Not Enough To Think you Are Protected”
Dear Judge Chou:

After reviewing the 2019-2020 Grand Jury report entitled “Cybersecurity – It Is Not Enough To Think you Are Protected,” the following are the City of Burlingame’s responses to the Grand Jury’s findings:

F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

Response: The City of Burlingame agrees with this finding.

F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

Response: The City of Burlingame agrees with this finding, although no effort was made to substantiate the actual statistic.

F3. The direct and indirect costs of Ransomware can be significant.

Response: The City of Burlingame agrees with this finding.

F4. Cybersecurity reviews and assessments, and an updated well-executed Cybersecurity plan, are critical components of IT security strategy.

Response: The City of Burlingame agrees with this finding.

F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

Response: The City of Burlingame agrees with this finding.

DocuSign Envelope ID: 71BD8228-8379-4D8A-A7BB-2693216E219F The Honorable Danny Y. Chou
December 7, 2020

Page 2 ends

 Register online with the City of Burlingame to receive regular City updates at www.Burlingame.org  F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

Response: The City of Burlingame agrees with this finding.

F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

Response: The City of Burlingame agrees with this finding.

F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

Response: The City of Burlingame agrees with this finding.

The following are the City of Burlingame’s responses to the Grand Jury’s recommendations:

Response: The City of Burlingame requested a written response to this recommendation from its IT management team, in lieu of a separate report addressing these concerns, so that management could develop a response to the final three recommendations of the report.

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)
The City of Burlingame utilizes several strategies to protect against nefarious acts including but not limited to:
 Industry recognized leaders’ dedicated firewall appliances at all electronic entry points into the City. On each firewall, all ports are blocked by default. Only known needed ports are opened, thus limiting the type of traffic coming into the City network infrastructure.
 All servers and desktops run an industry leader endpoint protection software, which is automatically updated.

It provides key protections including: endpoint detection and response (EDR), which detects and investigates suspicious activity with AI-driven analysis; anti-ransomware from sources including browsers, multi-media, MS Office applications, and email; behavioral analysis (acting on many files in a short period) issuing warnings, stopping errant processes, and notifying IT of such activity; malicious macros and other forms of code detections and protections; and exploit prevention techniques, which detect and stop common and known key vulnerabilities including zero-day attacks. The software communicates with the manufacturer’s cloud site, which continuously updates the local software with the latest protections.  VLANs, or virtual segmented networks, are used strategically throughout the organization to limit end-point access to servers and networks in which access is needed.  Password policies are considered very strong and include required changing periodically, as well as not allowing the re-use of recent passwords. Required changing has been suspended during the pandemic due to having to VPN into the City’s network, adding a layer of complexity as well as the reality of passwords expiring for users who don’t VPN in and only access cloud services such as email, with no user friendly method of notifying users or them having an easy, intuitive way to change their password.

DocuSign Envelope ID: 71BD8228-8379-4D8A-A7BB-2693216E219F The Honorable Danny Y. Chou
December 7, 2020

Page 3 ends

 Register online with the City of Burlingame to receive regular City updates at www.Burlingame.org   All servers are patched as appropriate, generally after a short while once a patch has been released and tested by others as bug free.
 Two Factor Authentication is being researched and expected to be implemented City wide once the best solution for the City is determined.

2. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?) More than 12.5 TB of user data is backed up in multiple ways. Most importantly, a shadow copy is created twice daily on the server to allow for easy rollback of deleted or changed files. In addition, files are backed up to an onpremise dedicated appliance. The appliance replicates itself to the manufacturer’s cloud on a daily basis. In the event the on-premise device becomes infected with mal-ware, including ransomware, the device can be wiped clean and the data restored from the cloud’s backup. If the backup device itself fails, within three business days a new appliance will be shipped, which is pre-loaded with the City’s backed-up data. Data can also be recovered directly from the manufacturer’s cloud storage. Daily backups are preserved for 12 days, weekly backups are preserved for five weeks, monthly backups are saved for 12 months, and yearly revisions are kept for no less than two years. The process is continuously being tested in normal operations via requests from users asking IT to restore data from one of the previous day’s backups.

All databases in the City’s robust database infrastructure are included in all backup processes. As new databases are brought online, the using department is involved in determining the requirements of the backup. For example, is recovery to the previous night adequate, or is there a legitimate requirement to be able to restore the database to within the last hour, such as the City’s utility billing database in which hundreds of transactions occur daily? All database servers run a process (agent) that is part of the backup appliance solution. In addition, some databases also use the native database engine to back up a database, which is also included in the overall backup process.

The City runs in a robust, industry-best virtual environment. This not only allows the City to realize cost savings by having many virtual servers running on fewer physical servers, it also allows the City to maintain hot-standby servers in the Police Department data center.

It is the opinion of the City’s IT Manager that the testing of a system-wide recovery is not practical as it is a mix of different functions, services, and protections. In his opinion, it would be near, if not impossible, for any single incident, short of a major catastrophe such as an earthquake or fire in the City Hall data center, to bring down the entire infrastructure. Different functions/components are generally tested during the normal course of business as functions fail, servers are patched, or requested data is restored.

All network devices have their configurations backed up nightly in the event of an equipment failure or breach.

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) The City utilizes both cloud and an on-premise dedicated SPAM prevention appliance and software in which all email is first run though before being delivered to recipients. The appliance continuously communicates with the manufacturer’s secure site to update its protections to the latest known threats. In addition, the appliance wraps all links within an email with a path which, when clicked, first goes through the manufacturer’s secure cloud services to confirm (to the extent possible) that the link is legitimate and not a known hacking site.

DocuSign Envelope ID: 71BD8228-8379-4D8A-A7BB-2693216E219F The Honorable Danny Y. Chou
December 7, 2020

Page 4 ends

 Register online with the City of Burlingame to receive regular City updates at www.Burlingame.org  The City pre-pends the subject of certain emails with [suspect] when an email contains one of many known-to-betrouble phrases such as “gift cards.” Every external email pre-pends the body of the email with a warning that the email is from an external source and to use caution when responding or clicking on any links contained within.

With more staff working remotely, IT staff has increased its frequency of cautionary e-mails warning all users of common phishing schemes and malicious links. Staff intends to work with the HR Department on implementing a segment on cybersecurity within its new employee orientation program.

Additional City Security Strategies
As cloud services become more a part of the City’s infrastructure, City IT strives to connect cloud services to its internal Active Directory security model. This allows IT staff to disable users in a single, secure place, which in turn disables them on the connected cloud services.

City IT is investigating the implementation of multi-factor authentication. This effort has been ramped up given the current pandemic environment in which the majority of the workforce is located outside of a City facility. Whereas in the past security was focused on blocking external parties from the City’s network, the pandemic has turned that strategy into one which secures endpoints theoretically located anywhere in the world. Multi-factor authentication is one of the predominant methods of securing access from outside the City’s firewalls.

The City carries cyber security insurance in the event of a data breach, which provides the City with resources to assist in the cost of recovery, including notifications to those whose personal information was likely breached. The insurance carrier also has resources available to assist the City in implementing best practices to deter cybersecurity attacks.

R2. These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

Response: The recommendation will not be implemented, as the City believes an analysis and discussion of its cybersecurity practices are continually underway. An in-depth written report at a particular point of time would not be useful to Council or management, as its efficacy would be recognized only by the technical staff that produced the report. In the wrong hands, such a report could be used to circumvent the cybersecurity protocols the City has in place and/or is considering. In addition, management does not believe a comprehensive cybersecurity report is the best use of the City’s IT resources. The pandemic has necessitated a largely technology-driven response, and IT staff is occupied with enabling users to safely access the IT resources needed to provide continued services to the public as efficiently as possible.

If the City Council or management request additional detail or have specific concerns regarding these protocols, these will be immediately addressed. The summaries developed in response to R1 are meant to convey that the City’s IT staff are aware of the risks mentioned in the Grand Jury’s report, as evidenced by the measures currently established to prevent cyberattacks and be able to recover promptly should they occur. Staff continuously examines best practices in cybersecurity, evaluating various tools available to protect access to data, software, and hardware systems, and their suitability for the City’s use.

R3. Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of Homeland Security and/or a cyber hygiene assessment from the County Controller's Office.

DocuSign Envelope ID: 71BD8228-8379-4D8A-A7BB-2693216E219F The Honorable Danny Y. Chou
December 7, 2020

Page 5 ends

 Register online with the City of Burlingame to receive regular City updates at www.Burlingame.org  Response: This recommendation will not be implemented because it is not warranted at this time. Although the City IT personnel recognize the value of a cybersecurity review from the U.S. Department of Homeland Security (DHS), staff feels the security measures currently in place represent affordable, usable, and practical best practices in cybersecurity.

As noted in response to R1, City staff is very much aware of the heightened risks of cyberattacks, and has implemented protocols to guard against them and facilitate recovery in the event they do occur. Through research, trade journals and websites, and participation in a state-wide coalition of municipal IT leadership, staff continuously monitors, maintains, and upgrades to the latest cybersecurity measures, software and hardware, and best practices. If at some point in the future IT resources become available, staff will reach out to DHS and/or the County Controller’s Office for their respective assessments.

R4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC's Cybersecurity Planning Guide and consider customizing it using FCC's Create Custom Cybersecurity Planning Guide tool (see footnote 52).

Response: This recommendation will not be implemented because it is not warranted at this time. The FCC’s Cybersecurity Planning Guide was reviewed and compared to solutions currently implemented in the City. In most cases, the recommendations were already enabled, or are planned to be in the near future. Recommended solutions within the Planning Guide not currently in place nor planned have been evaluated and deemed to be less suitable for use by the City, generally due to one or more of the following: IT assessment of the solution cost versus the risk it mitigates; alternative, yet equivalent, solutions already in place; and/or usability/complexity issues for City staff users.

The Burlingame City Council approved this response letter at its public meeting on December 7, 2020.

Sincerely,
Emily Beach
Mayor
DocuSign Envelope ID: 71BD8228-8379-4D8A-A7BB-2693216E219F

City of Foster City • 610 Foster City Boulevard, Foster City, CA 94404 P: (650) 286-3200 • F: (650) 577-0983 • E: [email protected]

OFFICE OF THE CITY COUNCIL
City of Foster City
January 5, 2021
Hon. Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center; 8th Floor
Redwood City, CA 94063-1655
Dear Judge Chou:

The City Council for the City of Foster City has had an opportunity to review the 2020 Grand Jury report entitled “Ransomware: It is Not Enough to Think You Are Protected.” After reviewing the report and allowing for public comment at its regular meeting on January 4, 2021, the City Council offers the following responses:

Responses to Findings
Finding F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

Response: The respondent agrees with the finding.

Finding F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

Response: The respondent agrees with the finding.

Finding F3. The direct and indirect costs of Ransomware can be significant.

Response: The respondent agrees with the finding.

Finding F4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

Response: The respondent agrees with the finding.

City of Foster City • 610 Foster City Boulevard, Foster City, CA 94404 P: (650) 286-3200 • F: (650) 577-0983 • E: [email protected] Finding F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

Response: The respondent agrees with the finding.

Finding F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

Response: The respondent agrees with the finding.

Finding F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

Response: The respondent agrees with the finding.

Finding F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

Response: The respondent agrees with the finding.

Response to Recommendations
R1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

Response: The recommendation will be implemented within the requested timeframe.

Response: The recommendation will be implemented.

City of Foster City • 610 Foster City Boulevard, Foster City, CA 94404 P: (650) 286-3200 • F: (650) 577-0983 • E: [email protected] R4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

Response: The recommendation will be implemented.

This response was approved by the Foster City City Council, via Minute Order, at its regular meeting on January 4, 2021.

Respectfully submitted,
Sanjay Gehani
Mayor, City of Foster City
cc: [email protected]

MINUTE ORDER
No. 1722

OFFICE OF THE CITY CLERK

FOSTER CITY, CALIFORNIA
Date: January 5, 2021
Attention: City Council/EMID Board
Peter Pirnejad, City/District Manager
Dante Hall, Assistant City Manager
Jean Savaree, City Attorney
City Council/EMID Board of Directors Meeting Date: January 4, 2021 Subject: Response to the San Mateo County Grand Jury Report “Ransomware: It Is Not Enough to Think You Are Protected”

Motion by Councilmember Froomin, seconded by Councilmember Hindi, and carried unanimously by roll call vote, 5-0-0, IT WAS ORDERED to approve a letter to the Honorable Danny Y. Chou, Judge of the Superior Court, in response to the San Mateo County Civil Grand Jury Report, dated October 7, 2020, entitled “Ransomware: It Is Not Enough to Think You Are Protected.”

CITY CLERK/DISTRICT SECRETARY
DocuSign Envelope ID: DAA86091-E99E-4EE3-8B12-9286DA043C3E

CITY OF HALF MOON BAY
501 Main Street
Half Moon Bay, CA 94019
December 1, 2020
Honorable Danny Y. Chou
Judge of the Superior Court
C/O Jenarda Dubois
Hall of Justice
400 County Center; 8th Floor
Redwood City, CA 94063-1655
Subject: October 7, 2020 Grand Jury Report: “Ransomware: It Is Not Enough To Think You Are Protected”
Dear Honorable Judge Chou:

The City Council of the City of Half Moon Bay, at its December 1, 2020 meeting, reviewed and approved the following responses to the San Mateo County Civil Grand Jury 2019-2020 Report entitled “Ransomware: It Is Not Enough To Think You Are Protected” Findings
The report includes eight (8) findings covering a wide range of technology issues. The City of Half Moon Bay (City) agrees with each of the eight (8) findings (F1 through F8).

Recommendations
R1: Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

3. Prevention (turning on email filtering, setting up a message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content)
Response: The recommendation has been completed. The City requested information from the IT department which provided information on the above recommendations. The City then confirmed, verified, and improved security in all three categories. The City has now met or exceeded the recommendations.

CITY OF HALF MOON BAY
501 Main Street
Half Moon Bay, CA 94019
R2: These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

Response: The recommendation has already been completed as part of an annual security review.

R3: Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of Homeland Security and/or a cyber hygiene assessment from the County Controller’s Office.

Response: The recommendation will not be implemented at this time, but we may choose to do so in the future. The City already has a 3rd party auditor that reviews security periodically.

R4: Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide Tool.

Response: The recommendation has not yet been implemented. The City will implement this recommendation within the next 6 months.

Thank you for your consideration of the foregoing.

Sincerely,
Adam Eisen
Mayor

CITY COUNCIL AGENDA

REGULAR MEETING

CITY OF HALF MOON BAY
TUESDAY, DECEMBER 1, 2020
REMOTE PARTICIPATION (SEE NEXT PAGE) Adam Eisen, Mayor
Robert Brownstone, Vice Mayor
Deborah Penrose, Councilmember
Harvey Rarback, Councilmember
Debbie Ruddock, Councilmember
7:00 PM
This agenda contains a brief description of each item to be considered. Those wishing to address the City Council on any matter not listed on the Agenda, but within the jurisdiction of the City Council to resolve, may come forward to the podium during the Public Forum portion of the Agenda and will have a maximum of three minutes to discuss their item.

Those wishing to speak on a Public Hearing matter will be called forward at the appropriate time during the Public Hearing consideration.

Please Note: Anyone wishing to present materials to the City Council, please submit seven copies to the City Clerk.

Copies of written documentation relating to each item of business on the Agenda are on file in the Office of the City Clerk at City Hall and the Half Moon Bay Library where they are available for public inspection. If requested, the agenda shall be available in appropriate alternative formats to persons with a disability, as required by Section 202 of the Americans with Disabilities Act of 1990 (42 U.S.C. Sec. 12132.) Information may be obtained by calling 650-726- 8271.

In compliance with the Americans with Disabilities Act, special assistance for participation in this meeting can be obtained by contacting the City Clerk’s Office at 650-726-8271. A 48-hour notification will enable the City to make reasonable accommodations to ensure accessibility to this meeting (28 CFR 35.102-35.104 ADA Title II). http://hmbcity.com/

SPECIAL REMOTE PROTOCOLS
In accordance with Governor Newsom’s Executive Order No-29-20, this will be a teleconference meeting without a physical location to help stop the spread of COVID-19. This meeting will be conducted entirely by remote participation, in compliance with the Governor's Executive Order N-29-20 allowing for deviation of teleconference rules required by the Ralph M. Brown Act.

This meeting will be conducted via Zoom Webinar. Members of the public are welcome to login into the webinar as Attendees. During any public comment portions, attendees may use the “raise your hand” feature and will be called upon and unmuted when it is their turn to speak. Written comments ([email protected]) submitted by 5:00 p.m. on meeting day will be added to the online agenda packet and emailed to the City Council. The meeting will also be streamed on Channel 27, on pacificcoast.tv, on Facebook in English at www.facebook.com/cityofhalfmoonbay and in Spanish at www.facebook.com/halfmoonbayrecreation. Please click to join the webinar: https://zoom.us/j/93627876187 or join by phone at 669-900-9128, using Webinar ID 936-2787-6187.

CALL TO ORDER / ROLL CALL

PUBLIC FORUM

PROCLAMATIONS AND PRESENTATIONS

COUNTY OF SAN MATEO - CONTACT TRACING PRESENTATION

MAYOR'S ANNOUNCEMENTS OF COMMUNITY ACTIVITIES AND COMMUNITY SERVICE

REPORT OUT FROM RECENT CLOSED SESSION MEETINGS

CITY MANAGER UPDATES TO COUNCIL
COVID-19 UPDATE

POPLAR PILOT PARKING PROJECT UPDATE

1. CONSENT CALENDAR

1.A WAIVE READING OF RESOLUTIONS AND ORDINANCES

1.B SAN MATEO COUNTY MOSQUITO AND VECTOR CONTROL DISTRICT BOARD OF

TRUSTEES APPOINTMENT
Staff Recommendation: By motion, reappoint Kati Martin as the City of Half Moon Bay’s representative to the San Mateo County Mosquito Abatement District Board of Trustees for a four-year term commencing on January 4, 2021.

STAFF REPORT

1.C APPROVE CITY’S RESPONSE TO THE OCTOBER 7, 2020 GRAND JURY REPORT ENTITLED “RANSOMWARE: IT IS NOT ENOUGH TO THINK YOU ARE PROTECTED” Staff Recommendation: By motion, authorize the Mayor to sign and submit a letter of response to the October 7, 2020 Grand Jury Report titled “Ransomware: It Is Not Enough To think You Are Protected” no later than January 5, 2020.

STAFF REPORT
ATTACHMENT 1
ATTACHMENT 2

1.D AB1600 REPORT ON DEVELOPMENT IMPACT FEES FOR FISCAL YEAR ENDED JUNE 30, 2020
Staff Recommendation: Accept the AB 1600 Report on Development Impact Fees for fiscal year ended June 30, 2020.

STAFF REPORT

1.E AGREEMENT WITH STEPFORD, INC. FOR INFORMATION TECHNOLOGY SERVICES Staff Recommendation: Adopt a resolution authorizing the City Manager to execute a revision to the three-year contract agreement with Stepford, Inc. for fiscal years 2019 through 2022. The revisions will cover the remaining two years of the agreement beginning July 1, 2020 and ending June 30, 2022 for the continuation of information technology services at a cost of $180,180 per year.

STAFF REPORT

RESOLUTION

1.F 2021 RESIDENTIAL DWELLING UNIT ALLOCATION PURSUANT TO HALF MOON BAY MUNICIPAL CODE CHAPTER 17.06 (MEASURE D)
Staff Recommendation: Adopt a resolution setting the 2021 Residential Dwelling Unit Allocation and Administration System pursuant to Half Moon Bay Municipal Code Chapter

17.06 for 66 residential dwelling units, 44 units for Downtown and 22 units outside of Downtown.

STAFF REPORT

RESOLUTION
ATTACHMENT 2

1.G FIRST AMENDMENT TO THE HALF MOON BAY HISTORY ASSOCIATION LEASE AGREEMENT FOR 503 JOHNSTON STREET
Staff Recommendation: Adopt a resolution authorizing the City Manager to execute a First Amendment to the Lease Agreement with the Half Moon Bay History Association by granting a one-year extension to begin construction of a new museum on the history property located at 503 Johnston Street.

STAFF REPORT

RESOLUTION
ATTACHMENT 2
ATTACHMENT 3
ATTACHMENT 4

2. ORDINANCES AND PUBLIC HEARINGS

3. RESOLUTIONS AND STAFF REPORTS

3.A PROPOSED ACQUISITION OF THE COASTSIDE INN BY THE COUNTY OF SAN MATEO FOR

USE AS AN EMERGENCY HOMELESS SHELTER
Staff Recommendation: Receive a report on the County’s proposed acquisition of the Coastside Inn, located at 230 Cabrillo Highway S, in Half Moon Bay, for use as emergency shelter for homeless residents on the Coastside during the COVID-19 pandemic, and future uses to be determined.

STAFF REPORT
ATTACHMENT 1

3.B UPDATE ON LOCAL RECOVERY EFFORTS FROM COVID-19 AND DEVELOPMENT OF

RECOMMENDATIONS TOWARD A MORE RESILIENT, VIBRANT, AND DIVERSIFIED

COASTSIDE ECONOMY
Staff Recommendation: Receive an update on efforts to assist local businesses and the Coastside community in recovery from COVID-19 and in developing recommendations toward a more resilient, vibrant, and diversified Coastside economy.

STAFF REPORT

3.C 880 STONE PINE ROAD ACQUISITION
Staff Recommendation: Adopt a resolution, in relation to the acquisition of 880 Stone Pine Road from the Peninsula Open Space Trust, for use as the City’s corporation yard, authorizing:

1. An additional deposit of $25,000 to POST, if the City chooses to exercise an extension of the escrow period;

2. The use of no more than $2,180,000 in Operating Reserves to close escrow on the acquisition;

3. Receipt of iBank financing proceeds for reimbursement of expenses related to the acquisition and potential improvements to the property; and

4. Authorizing the City Manager to take any required actions to complete the transaction, including accepting any non-substantive changes to the terms and conditions of the acquisition and financing.

STAFF REPORT

RESOLUTION

COMMISSION / COMMITTEE UPDATES

FOR FUTURE DISCUSSION / POSSIBLE AGENDA ITEMS

CITY COUNCIL REPORTS

ADJOURNMENT
City Council
City of Menlo Park 701 Laurel St., Menlo Park, CA 94025 tel 650-330-6600 www.menlopark.org December 8, 2020
via electronic mail
[email protected]
Honorable Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center, 8
th Floor
Redwood City, CA 94063-1655
RE: Civil Grand Jury Report: ““Ransomware: It is not enough to think that you are protected””
Dear Judge Chou:

The City Council of the City of Menlo Park (City) voted at its public meeting on December 8, 2020 to authorize this response to San Mateo County’s civil grand jury 2019-20 report ““Ransomware: It is not enough to think that you are protected”” released on October 7, 2020.

Responses to Findings
F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

City response: City of Menlo Park agrees that cybersecurity threats, including ransomware, are a growing threat to public agencies.

F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

City response: City of Menlo Park agrees with the finding that local governments are increasingly the target of cybersecurity threats.

F3. The direct and indirect costs of Ransomware can be significant.

City response: City of Menlo Park agrees that the direct and indirect costs of cybersecurity threats are significant.

F4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

DocuSign Envelope ID: 7348ACE7-C70B-43BD-A11A-E88BC232048B City response: City of Menlo Park agrees with the finding.

F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

City response: City of Menlo Park agrees with the finding.

F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

City response: City of Menlo Park agrees with the finding.

F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

City response: City of Menlo Park agrees with the finding.

F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

City response: City of Menlo Park agrees with the finding.

RECOMMENDATIONS
The Grand Jury recommends that each governing body undertake its own confidential effort to protect against Ransomware attacks. Specifically:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

DocuSign Envelope ID: 7348ACE7-C70B-43BD-A11A-E88BC232048B R2. These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

City response: Will be implemented by June 30, 2021.

R3. Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S.

Department of Homeland Security56 and/or a cyber hygiene assessment from the County Controller’s Office.

City response: Further analysis required pending results from R1.

R4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool.

City response: Further analysis required pending results from R1.

Sincerely,
Cecilia Taylor
Mayor
DocuSign Envelope ID: 7348ACE7-C70B-43BD-A11A-E88BC232048B

CITY OF PACIFICA
170 Santa Maria Avenue • Pacifica, California 94044-2506 www.cityofpacifica.org
MAYOR
Deirdre Martin

MAYOR PRO TEM
Sue Beckmeyer

COUNCIL
Sue Vaterlaus
Mary Bier
Mike O’Neill
Scenic Pacifica
Incorporated Nov. 22, 1957
December 14, 2020
Honorable Judge Chou:

Hall of Justice
400 County Center; 8th Floor
Redwood City, CA 94063-1655
Subject: Re: City of Pacifica’s response to the Grand Jury Report: “Ransomware: It Is Not Enough To Think You Are Protected”
Honorable Judge Chou:

Thank you for the opportunity to review and comment on the above referenced Grand Jury Report filed on October 7, 2020. Pursuant to Penal Code section 933 (c), the City of Pacifica’s response to both the Findings and Recommendations are provided below. The Pacifica City Council, including the Mayor, reviewed and approved the responses at a public meeting on December 14, 2020.

Response to Grand Jury Findings:

F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

Response to F1. The City agrees with the finding.

F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

Response to F2. The City agrees with the finding.

F3. The direct and indirect costs of Ransomware can be significant.

Response to F3. The City agrees with the finding.

F4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

Honorable Judge Chou: 2
Response to F4. The City agrees with the finding.

F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

Response to F5. The City agrees with the finding.

F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

Response to F6. The City agrees with the finding.

F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part of an entity’s backup plan to recover lost information.

Response to F7. The City agrees with the finding.

F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

Response to F8. The City agrees with the finding.

Response to Grand Jury Recommendations:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

2. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how is it being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) Response to R1. The recommendation has been implemented. The City Manager has requested the City’s IT division prepare a report addressing the concerns in the Grand Jury report.

Honorable Judge Chou: 3
Response to R2. The recommendation has not yet been implemented. The City’s IT Division is in the process of implementing the recommendation and is preparing this report, which is expected to be completed and provided to the governing body by April 2021 or earlier.

Response to R3. The recommendation has not yet been implemented, as the internal report has not been completed. The City’s IT Division will request guidance by means of a Cybersecurity review from the appropriate agency listed, based on the results of the internal report when complete.

R4. Given the results of their internal reports, government entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool.

Response to R4. The recommendation has not yet been implemented. Once the internal report is completed the City’s IT Division will evaluate utilizing the FCC’s Cybersecurity Planning Guide to assist in updating its Cybersecurity Plan.

Sincerely,

KEVIN WOODHOUSE
City Manager
cc: Pacifica City Council

County of San Mateo
Inter-Departmental Correspondence
Department: COUNTY MANAGER
File #: 20-962 Board Meeting Date: 12/8/2020
Special Notice / Hearing: None__
Vote Required: Majority
To: Honorable Board of Supervisors
From: Michael P. Callagy, County Manager
Subject: Board of Supervisors’ Response to the 2019-2020 Civil Grand Jury Report “Ransomware: It is Not Enough to Think You Are Protected” RECOMMENDATION:

Approve the Board of Supervisors’ response to the 2019-2020 Civil Grand Jury Report, “Ransomware: It is Not Enough to Think You Are Protected” BACKGROUND:

On October 7, 2020, the 2019-2020 San Mateo County Civil Grand Jury issued a report titled “Ransomware: It is Not Enough to Think You Are Protected.” The Board of Supervisors is required to submit comments on the findings and recommendations pertaining to the matters over which it has some decision-making authority within 90 days. The Board’s response to the report is due to the Honorable Danny Y. Chou no later than January 5, 2021.

DISCUSSION:

The Grand Jury made 8 findings and 4 recommendations in its report. The Board responses follow each finding and the 4 recommendations that the Grand Jury requested that the Board respond to within 90 days.

FINDINGS
Finding 1:

Ransomware is a real and growing threat to public entities including those in San Mateo County.

Response: The respondent agrees with the finding.

Finding 2:

Across the country, local governments and schools represent 12% of all Ransomware attacks.

Response: The respondent agrees with the finding.

Page 1 of 3 ends

Finding 3:

The direct and indirect costs of Ransomware can be significant.

Response: The respondent agrees with the finding.

Finding 4:

Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan are critical components of IT security strategy.

Response: The respondent agrees with the finding.

Finding 5:

A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

Response: The respondent agrees with the finding.

Finding 6:

The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

Response: The respondent agrees with the finding.

Finding 7:

Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

Response: The respondent agrees with the finding.

Finding 8:

Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

Response: The respondent agrees with the finding.

RECOMMENDATIONS
Recommendation 1:

Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

Page 2 of 3 ends

backup?)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) Response: The respondent will implement the recommendation with the assistance of the County’s Information Services Department (ISD). The San Mateo County Sheriff’s Office and the San Mateo County Assessor-Clerk-Recorder-Elections (ACRE) also agree with the recommendation and will implement the recommendation through their respective internal IT service divisions.

Recommendation 2:

These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

Response: The recommendation has not yet been implemented by respondent but will be implemented in the future with a specific time frame for implementation and reporting.

Recommendation 3:

Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of Homeland Security and/or a cyber hygiene assessment from the County Controller’s Office.

Response: The respondent will implement the recommendation with the assistance of the County’s Information Services Department (ISD). The San Mateo County Sheriff’s Office and the San Mateo County Assessor-Clerk-Recorder-Elections (ACRE) also agree with the recommendation and will implement the recommendation through their respective internal IT service divisions, including obtaining guidance from the U.S.

Department of Homeland Security, as necessary.

Recommendation 4:

Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

FISCAL IMPACT:

There is no fiscal impact associated with the acceptance of this report.

Page 3 of 3 ends

JEFFERSON
Elementary School District
Governing Board
Shakeel All
Marie Brizuela
Clayton Koo
Manufou Liaiga-Anoa'i
Maybelle Mania
Superintendent
Bernardo Vidales
November 18, 2020
Via Email ferandiurvfS.sanmateocourt. ors)
The Honorable Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center; 2"d Floor
Redwood City, CA 94063-1655
Re: Response to the 2019-2020 Grand Jury Report entitled "Ransomware: It Is Not Enough To Think You Are Protected. "
Dear Judge Chou:

The Jefferson Elementary School District (the "District") has received and reviewed the 2019-2020 Grand Jury Report entitled "Ransomware: It Is Not Enough To Think You Are Protected. " We appreciate the Grand Jury's interest in this matter. Having reviewed and considered the Grand Jury's Findings and Recommendations, the District responds below pursuant to section 933.05 of the California Penal Code.

Please be advised that the District presented the Grand Jury Report to its Board of Trustees, and the District's Board approved these responses, on November 18, 2020 Findings:

1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

The District agrees with this Finding.

Martin Luther King Jr. Education Center
101 Lincoln Avenue . Daly City, CA 94015 650-991-1000 phone . 650-992-2265 fax . http://www.jsd. k12.ca.us 2of4
2 Across the country, local govemments and schools represent 12% of all Ransomware attacks.

3. The direct and indirect costs ofRansomware can be significant.

The District agrees with this Finding.

4. Cyberseciirily reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strateg)'.

The District agrees with this Finding.

5. A comprehensive Cyberseciirity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recoveiy testing.

The District agrees with this Finding.

6. The identification ofphishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

The District agrees with this Finding.

7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity 's backup plan to recover lost information.

8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

The District agrees with this Finding.
101 Lincoln Avenue . Daly City, CA 94015 . 650-991-1000 phone . 650-992-2265 fax . http://www.jsd. k12.ca.us 3of4
Recommenilations:
/. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:
/. System Security (Firewalls, Anti-malware/Antivirus software, use ofsilbnets, strong password policies, updating/patching regularly)

2. Backiip & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) The District implemented this Recommendation on November 5, 2020 by directing the District's IT Department to prepare a confidential report which addresses the three concerns specifically identified above.

The District will implement this Recommendation if warranted and appropriate based on the results of the District s confidential internal report.

4. Given the results of their internal reports, governmental entities may choose to ask their FT departments to review their own Cyhersecwily Plan with the detailed template provided by the FCC 's Cybersecurity Planning Guide and consider customizing it using FCC 's Create Custom Cybersecurity Planning Giiide tool (see footnote 52).

The District will implement this Recommendation if warranted and appropriate based on the results of the District's confidential internal report.
101 Lincoln Avenue . Daly City, CA 94015 . 650-991-1000 phone . 650-992-2265 fax . http://www. jsd. k12. ca. us 4of4
Please do not hesitate to contact me if you have questions or require additional information.

Sincerely,,
BemarUo Vidales
Superintendent
Jefferson Elementary School District
101 Lincoln Avenue . Daly City, CA 94015 . 650-991-1000 phone . 650-992-2265 fax . http://www.jsd.k12.ca.us November 3, 2020
Via Email ([email protected])
The Honorable Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center; 2nd Floor
Redwood City, CA 94063-1655
Re: Response to the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough to Think You Are Protected.”
Dear Judge Chou:

The Jefferson Union High School District (the “District”) has received and reviewed the 2019- 2020 Grand Jury Report entitled “Ransomware: It Is Not Enough To Think You Are Protected.” We appreciate the Grand Jury’s interest in this matter. Having reviewed and considered the Grand Jury’s Findings and Recommendations, the District responds below pursuant to section 933.05 of the California Penal Code.

Please be advised that the District presented the Grand Jury Report to its Board of Trustees, and the District’s Board approved these responses, on November 2, 2020 Findings:

1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

The District agrees with this Finding.

2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

Jefferson Union High School District
ADMINISTRATIVE OFFICES – SERRAMONTE DEL REY
699 Serramonte Boulevard, Suite 100
Daly City, CA 94015-4132
650-550-7900  FAX 650-550-7888
Board of Trustees
Andrew Lie
Carla Ng-Garrett
Nick Occhipinti
Kalimah Y. Salahuddin
Rosie U. Tejada
Dr. Terry A. Deloria
Superintendent

3. The direct and indirect costs of Ransomware can be significant.

The District agrees with this Finding.

4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

The District agrees with this Finding.

5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

The District agrees with this Finding.

6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

The District agrees with this Finding.

7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

The District agrees with this Finding.

Recommendations:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content)
The District implemented this Recommendation on February 19, 2020 by directing the District’s IT Department to prepare a confidential report which addresses the three concerns specifically identified above with the exception of providing employee training on phishing. The District intends to implement this Recommendation by June 30, 2021.

The District will implement this Recommendation if warranted and appropriate based on the results of the District’s confidential internal report.

4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

The District will implement this Recommendation if warranted and appropriate based on the results of the District’s confidential internal report.

Please do not hesitate to contact me if you have questions or require additional information.

Sincerely,
Dr. Terry A. Deloria
Superintendent
Jefferson Union High School District

Ladera Recreation District
150 Andeta Way
Portola Valley, CA 94028

Response to Grand Jury Report re: Ransomware
December 14, 2020
Hon. Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center; 8th Floor
Redwood City, CA 94063-1655
Dear Judge Chou:

The Ladera Recreation District has had an opportunity to review the 2020 Grand Jury report entitled “Ransomware: It is Not Enough to Think You Are Protected.” The Board, after reviewing the report and allowing for public comment at its Ladera Recreation District meeting on December 23, 2020 offers the following responses:

Responses to Findings
Finding F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

Response: The District agrees with the finding.

Finding F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

Response: The District lacks the information to fully agree or disagree with this finding, but for purposes of this response, the District accepts the Grand Jury’s findings.

Finding F3. The direct and indirect costs of Ransomware can be significant.

Response: The District agrees with the finding.

Finding F4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

Response: The District agrees with the finding.

Finding F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

Response: The District agrees with the finding.

Finding F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

Response: The District agrees with the finding.

Finding F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part of an entity’s backup plan to recover lost information.

Response: The District agrees with the finding.

Finding F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

Response: The District agrees with the finding.

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

Response: The recommendation will be implemented within the requested timeframe.

Response: If necessary, the recommendation will be implemented within the requested timeframe.

R4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

Response: If necessary, the recommendation will be implemented within the requested timeframe.

Respectfully submitted,
Diane Gow
General Manager
Ladera Recreation District
Cc: [email protected]

District Office
1011 Altschul Avenue
Menlo Park, CA 94025
(650) 854-6311
Las Lomitas School
299 Alameda de las Pulgas
Atherton, CA 94027
(650) 854-5900
La Entrada School
2200 Sharon Road
Menlo Park, CA 94025
(650) 854-3962
December 15, 2020
The Honorable Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center; 2nd Floor
Redwood City, CA 94063-1655
Re: Response to the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough To Think You Are Protected.”
Dear Judge Chou:

The Las Lomitas Elementary School District (the “District”) has received and reviewed the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough To Think You Are Protected.” We appreciate the Grand Jury’s interest in this matter. Having reviewed and considered the Grand Jury’s Findings and Recommendations, the District responds below pursuant to section 933.05 of the California Penal Code.

As required, the District presented the Grand Jury Report to its Board of Trustees, and the District’s Board of Trustees approved these responses on December 14, 2020.

Findings:

F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

The District agrees with this Finding.

F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

F3. The direct and indirect costs of Ransomware can be significant.

The District agrees with this Finding.

F4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

The District agrees with this Finding.

F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

The District agrees with this Finding.

F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

The District agrees with this Finding.

F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

The District agrees with this Finding.

Recommendations:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) The District implemented this Recommendation on November 30, 2020 by directing the District’s IT Department to prepare a confidential report which addresses the three concerns specifically identified above.

R2. These confidential internal reports should be provided to the governing body by June 30, 2021.

This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

The District intends to implement this Recommendation. Depending on the scope, complexity, and feasibility of the recommended actions and/or enhancements required, the implementation schedule of some items (e.g. those which require user training) may extend into the 2021-2022 school year.

The District will implement this Recommendation to request further guidance if warranted and appropriate based on the results of the District’s confidential internal report.

R4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

The District will implement this Recommendation to use the FCC’s Cybersecurity Planning Guide if warranted and appropriate based on the results of the District’s confidential internal report.

Please do not hesitate to contact me if you have questions or require additional information.

Sincerely,
Dr. Beth Polito
Superintendent
Las Lomitas Elementary School District

March 24, 2021
Honorable Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center, 8th Floor
Redwood City, CA 94063-1655
Dear Judge Chou,
We are in receipt of the Civil Grand Jury report entitled, "Ransomware: It Is Not Enough To Think You Are Protected” (Report).

As a preliminary matter, the transmittal of the Grand Jury Report did not specify that the Midpeninsula Regional Open Space District (“District”) was required to provide a response, but it is pleased to do so, pursuant to a follow up letter from the Grand Jury Coordinator dated February 22, 2021. The District’s Board of Directors held a public meeting on March 24, 2021 and approved this response.

Also of note, the Report states that in 2019, all local agencies in San Mateo County were contacted via an online survey about ransomware. The District has no record of being contacted or receiving a survey on this topic. We respectfully request confirmation that you have our correct mailing address, as noted on this letterhead. Future mailings should be sent in C/O the General Manager. Email copies can also be sent to [email protected].

The District responds to the Grand Jury's recommendations as follows:

Findings
The District generally agrees with the Findings of the Grand Jury.

Recommendations
R1. Each of the governmental entities in San Mateo County with an IT department or IT function should make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

2. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is 2 being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) District Response: The District has implemented this recommendation by directing the District’s Information Systems and Technology Department to prepare a confidential report addressing concerns specifically identified in this recommendation. Moreover, the District has been aggressively implementing numerous cybersecurity measures, in particular over the last three years, given the rise of ransomware, phishing, and hacking attempts that have been known to unfortunately occur with other public agencies.

R2. These confidential internal reports should be provided to the governing body by June 30, 2021.

This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

Response: This recommendation will be implemented by June 30, 2021.

Response: The District appreciates the suggestion to request further guidance from these entities. The recommendation has not yet been implemented and will be considered after the confidential internal report is issued to the governing body.

R4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool.

Response: The District will implement this recommendation as appropriate. After providing a written report to the Board of Directors, the District’s Information Systems and Technology Department will make a recommendation to the General Manager whether the FCC’s Planning Guide tool, or a cyber security audit, best meets District needs.

Very truly yours,
Curt Riffle, Board President
Midpeninsula Regional Open Space District
Cc: Board of Directors, Midpeninsula Regional Open Space District Ana M. Ruiz, General Manager

1 _____________________________________________________________________________________ March 22, 2021
Via Email ([email protected])
The Honorable Danny Y. Chou
Judge of the Superior Court
c/0 Jenarda Dubois
Hall of Justice
400 County Center; 2nd Floor
Redwood City, California 94063-1655
RE: Response to the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough To Think You Are Protected.”
Dear Judge Chou,
The Montara Water and Sanitary District (MWSD) has received and reviewed the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough To Think You Are Protected.” We appreciate the Grand Jury’s interest in this matter. Having reviewed and Considered the Grand Jury’s Findings and Recommendations, the District responds below pursuant to section 933.05 of the California Penal Code.

MWSD presented the Grand Jury Report to its Board of Directors, and the District’s Board approved these responses, on March 18, 2021.

Montara Water & Sanitary District
Serving the Communities of Montara and Moss Beach
P.O. Box 370131 Tel: (650) 728-3545
8888 Cabrillo Highway Fax: (650) 728-8556
Montara, CA 94037-0131 E-mail: [email protected]
Visit Our Web Site: http://www.mwsd.montara.com
2 Findings

1. Ransomware is a real and growing threat to public entities including those in San Mateo County
MWSD agrees with this Finding

2. Across the country, local governments and schools represent 12% of all Ransomware attacks
MWSD lacks information to fully agree or disagree with this Finding however we recognize that local governments and schools are likely to be targeted by Ransomware attacks.

3. The direct and indirect costs of Ransomware can be significant MWSD agrees with this Finding

4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

MWSD agrees with this Finding

5. A comprehensive Cybersecurity plan should include at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing
MWSD agrees with this Finding

6. The identification of phishing attempts, including the use of spam filters, is an important component of protecting an IT system from Ransomware attacks.

MWSD agrees with this Finding

7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part of an entity’s backup plan to recover lost data.

MWSD agrees with this Finding in principle but recognizes that regular full hardware restoration may be impractical due to hardware, logistical and budget restraints.

Partial data only restores may be more appropriate.
3 8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware
MWSD agrees with this Finding
Recommendations

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

2. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are the backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a Backup?)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content)

MWSD has implemented these Recommendation by requesting a confidential report which addresses the three concerns specifically identified above. The report will be provided to the governing board by June 30, 2021.

3. Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of Homeland Security and/or a cyber hygiene assessment from the County Controller’s Office
MWSD will implement this Recommendation if warranted based on the district’s confidential internal report.
4 4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

MWSD will implement this Recommendation if warranted and appropriate based on the results of the District’s confidential internal report.

Please do not hesitate to contact me if you have questions or require additional information.

Sincerely,
Clemens Heldmaier
General Manager
Montara Water and Sanitary District

March 25, 2021
Mr. Neal Taniguchi
Court Executive Officer
San Mateo Superior Court
400 County Center
Redwood City, CA 94063
Peninsula
Health Care
District
RE: Grand Jury Report: "Ransomware: It Is Not Enough to Think You Are Protected." Response of Peninsula Health Care District
Dear Mr. Taniguchi:

The Board of Directors and staff of the Peninsula Health Care District (the "District) have been provided with a copy of the above-referenced report from the San Mateo County Civil Grand Jury. We appreciated the thorough research and recommendations in the report.

In general, the Board agrees with the findings and recommendations in the report. The specific responses are set forth below.

The District employs an outside consultant to advise on cybersecurity and ransomware protections. As requested by the report, we reviewed the status of the District's security and backup storage with the consultant. The District was found to have robust security measures in place due to the c_onsultant's annual review of the District's system and current knowledge of trends and technologies. He is consulted annually as part of the budget process and with the Board's approval of the budget, funding is made available to ensure the system remains "state-of-the-art". The consultant's assessment in response to the Grand Jury's "Ransomware" report found the District to be compliant with the Grand Jury's recommendations.

The District has also consulted with our bank to ensure maximum protections are in place against fraudulent check writing and hacking into wire transfer information. The bank recommended to install its "Positive Pay" system which tracks every check coming into the bank for processing against the list by date and check number provided by the District when issuing the check.

Against this background, the District responds to the findings and recommendations as follows:

District Office 1819 Trousdale Drive, Burlingame, CA 94010 Phone 650.697.6900 Fax 650.652.9374 www.peninsulahealthcaredistrict.org

SAN BRUNO MILLBRAE BURLINGAME SAN MATEO HILLSBOROUGH FOSTER CITY

BOARD OF DIRECTORS
Lawrence W. Cappel, Ph.D.

Chair
Helen C. Galligan R.N
Vice Chair
Frank J. Pagliaro, Esq.

Secretary
Dennis Zell, Esq.

Director
Rick Navarro, M.D
Director

EXECUTIVE STAFF
Cheryl A. Fama, MPA, BSN, R.N
Chief Executive Officer
Vickie Yee
Board Treasurer/
Chief Financial Officer

REDWOOD CITY SCHOOL DISTRICT
750 Bradford Street • Redwood City • CA 94063 (650) 423-2200 FAX: (650) 423-2204 Board of Education Superintendent
Janet Lawson, President John R. Baker, Ed.D
Alisa MacAvoy, Vice President
María Díaz-Slocum, Clerk
Cecilia I. Márquez
Dennis McBride
December 4, 2020
Via Email ([email protected])
The Honorable Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center; 2nd Floor
Redwood City, CA 94063-1655
Re: Response to the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough To Think You Are Protected.”
Dear Judge Chou:

The Redwood City School District (the “District”) has received and reviewed the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough To Think You Are Protected.” We appreciate the Grand Jury’s interest in this matter. Having reviewed and considered the Grand Jury’s Findings and Recommendations, the District responds below pursuant to section 933.05 of the California Penal Code.

Please be advised that the District presented the Grand Jury Report to its Board of Trustees, and the District’s Board approved these responses, on December 9, 2020.

Findings:

1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

The District agrees with this Finding.

2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

3. The direct and indirect costs of Ransomware can be significant.

The District agrees with this Finding.

4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

The District agrees with this Finding.

5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

The District agrees with this Finding.

6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

The District agrees with this Finding.

7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

The District agrees with this Finding.

Recommendations:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content)
The District implemented this Recommendation on June 1, 2020 by directing the District’s IT Department to prepare a confidential report which addresses the three concerns specifically identified above.

The District has implemented this Recommendation.

4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

The District implemented this Recommendation.

Please do not hesitate to contact me if you have questions or require additional information.

Sincerely,
John R. Baker, Ed.D.

Superintendent
Redwood City School District

December 21, 2020 Via Email to [email protected] The Honorable Danny Y. Chou
Judge
San Mateo County Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center, 2nd Floor
Redwood City, CA 94063-1655
RE: Response to the 2019-2020 Grand Jury Report entitled "Ransomware: It Is Not Enough To Think You Are Protected."
Dear Judge Chou:

The San Mateo County Community College District (“the District”) has received and reviewed the 2019-2020 Grand Jury Report entitled "Ransomware: It Is Not Enough To Think You Are Protected. " We appreciate the Grand Jury's interest in this matter. Having reviewed and considered the Grand Jury's Findings and Recommendations, the District responds below pursuant to section 933.05 of the California Penal Code.

Please be advised that the District presented the Grand Jury Report to its Board of Trustees, and the District's Board approved these responses on December 14, 2020.

In its report, the Grand Jury delivered eight findings and the District provides the following responses:

Finding 1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

District Response: The District agrees with this finding.

Finding 2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

District Response: The District lacks information to fully agree or disagree with this finding given that it did not conduct the research related to this Report. The District, however, accepts the Grand Jury's finding for the purposes of this Response.

Finding 3. The direct and indirect costs of Ransomware can be significant.

District Response: The District agrees with this finding.

SMCCCD Response to Grand Jury Ransomware Report, pg. 2
Finding 4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

District Response: The District agrees with this finding.

Finding 5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

District Response: The District agrees with this finding.

Finding 6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

District Response: The District agrees with this finding.

Finding 7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

Finding 8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

District Response: The District agrees with this finding.

Further, the Grand Jury has offered the following recommendations who which it has asked the District to respond:

Recommendation 1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) District Response: The Chancellor has directed the District’s Chief Technology Officer to prepare a confidential report which addresses the issues outlined above.

SMCCCD Response to Grand Jury Ransomware Report, pg. 3
Recommendation 2. These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely consideration for future enhancements to the existing cybersecurity plan.

District Response: The District intends to prepare and provide a confidential report to the District’s Board of Trustees by June 30, 2021.

Recommendation 3. Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of Homeland Security and/or a cyber hygiene assessment from the County Controller’s Office.

District Response: The District will implement this Recommendation if warranted and appropriate based on the results of the District s confidential internal report.

Recommendation 4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

District Response: The District will implement this Recommendation if warranted and appropriate based on the results of the District s confidential internal report.

The District appreciates the work of the Grand Jury and the opportunity to respond to the findings and recommendations of its report. Should the Grand Jury have any questions regarding the District’s responses, or need additional information, please let me know.

Sincerely,
Michael E. Claire
Chancellor
February 8, 2021
Honorable Danny Y. Chou
Judge of the Superior Court
C/O Jenarda Dubois
Hall of Justice
400 County Center, 8th Floor
Redwood City, CA 94063-1655
Subject: October 7, 2020 Grand Jury Report: “Ransomware: It Is Not Enough To Think You Are Protected”
Dear Honorable Judge Chou:

The San Mateo County Mosquito and Vector Control District Board of Trustees reviewed the following responses at its November 12, 2020. The District Board subsequently approved the following responses to the San Mateo County Civil Grand Jury 2019-2020 Report entitled “Ransomware: It is Not Enough To Think You Are Protected.” Findings:

F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

The District agrees with this Finding.

F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

The District accepts the Grand Jury’s Finding that appears to be based on 2020 first quarter data from the Coveware Report.

F3. The direct and indirect costs of Ransomware can be significant.

The District agrees with this Finding.

F4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

The District agrees with this Finding.

F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

The District agrees with this Finding.

F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

The District agrees with this Finding.

F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

The District agrees with this Finding.

F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

The District agrees with this Finding.

Recommendations:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content)
The District received this report from its IT staff on these three areas of concern to the Board of Trustees at its November 12, 2020 meeting.

The District’s IT staff have received this request and is working on completing the Recommended confidential internal report by June 30, 2021.

The District will consider requesting further guidance based on the internal reports.

R4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool.

The District’s IT staff will utilize the FCC Cybersecurity Planning Guide to review and update the District’s cybersecurity plan.

We appreciate the research and awareness brought forth by the Grand Jury. We thank the members of the Grand Jury for their work and contributions toward this important issue.

Sincerely,
Brian Weber
District Manager

SAN MATEO
COUNTY

OFFICE OF

EDUCATION
Excellence and Equity in Education
Nancy Magee • County Superintendent of Schools
December 2,2020
Via Email ([email protected])
The Honorable Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center; 2nd Floor
Redwood City, CA 94063-1655
Re: Response to the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough to Think You Are Protected.”
Dear Judge Chou:

The San Mateo County Office of Education (“the SMCOE”) has received and reviewed the 2019-2020 Grand Jury Report entitled “Ransomware: It Is Not Enough to Think You Are Protected.” We appreciate the Grand Jury’s interest in this matter. Having reviewed and considered the Grand Jury’s Findings and Recommendations, the SMCOE responds below pursuant to section 933.05 of the California Penal Code.

Findings:

1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

The SMCOE agrees with this Finding.

2. Across the country, local governments and schools represent 12% ofall Ransomware attacks.

The SMCOE lacks information to fully agree or disagree with this Finding given that it did not conduct the research related to this Report. The SMCOE, however, accepts the Grand Jury’s Finding for the purposes of this Response.

3. The direct and indirect costs ofRansomware can be significant.

The SMCOE agrees with this Finding.
!
101 Twin Dolphin Drive • Redwood City • CA • 94065-1064 • 650-802-5300 • www.smcoe.org The Honorable Danny Y. Chou 2
Response to the 2019-2020 Grand Jury Report
December 2,2020

4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components ofIT security strategy.

The SMCOE agrees with this Finding.

5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups andfull recovery testing.

The SMCOE agrees with this Finding.

6. The identification ofphishing attempts, including the use ofspamfilters, is an important component to protecting an ITsystemfrom Ransomware attacks.

The SMCOE agrees with this Finding.

7. Testing afull restore ofa server to ensure that backups are reliable should be undertaken regularly as part ofan entity’s backup plan to recover lost information.

8. Training ofnew employees, and the recurring training ofexisting employees, is an important component ofdefense against Ransomware.

The SMCOE agrees with this Finding.

Recommendations:

1. Each ofthe governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a reportfrom their IT organization that addresses the concerns identified in the report, specifically:
a. System Security (Firewalls, Anti-malware/Antivirus software, use ofsubnets, strong password policies, updating/patching regularly)
b. Backup & Recovery (In the event ofan attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fidly restore a Serverfrom a backup?)
The Honorable Danny Y. Chou 3
Response to the 2019-2020 Grand Jury Report
December 2,2020
c. Prevention (turning on emailfiltering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content)
The SMCOE implemented this Recommendation on October 7,2020, by directing the SMCOE IT Department to prepare a confidential report which addresses the three concerns specifically identified above.

2. These confidential internal reports should be provided to the governing body by June 30, 2021. This report should describe what actions have already been taken and which will be given timely considerationforfitlire enhancements to the existing cybersecurity plan.

The SMCOE intends to implement this Recommendation, provided that the SMCOE may require an extension of time (not to exceed six months) beyond June 30,2021, depending on the scope, complexity, and feasibility of any recommended actions and/or enhancements.

The SMCOE will implement this Recommendation if warranted and appropriate based on the results of our confidential internal report.

4. Given the results oftheir internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

The SMCOE will implement this Recommendation if warranted and appropriate based on the results of our confidential internal report.

Sincerely,
Nancy Magee
San Mateo County Superintendent of Schools
C: San Mateo County Board of Supervisors

December 22, 2020
Hon. Danny Y. Chou
Judge of the Superior Court
c/o Jenarda Dubois
Hall of Justice
400 County Center, 8th Floor
Redwood City, CA 94063-1655
Re: Response to Grand Jury Report: “Ransomware: It Is Not Enough To Think You Are Protected” Dear Honorable Danny Y. Chou,
At the November 19, 2020 RCD Regular Meeting of the Board of Directors, the Board approved Executive Director, Kellyx Nelson, to respond. Due to the small size of the San Mateo Resource Conservation District (RCD), many of the “Best Practices” as outlined in the report do not apply or have been implemented in a scaled down fashion more appropriate to the RCD situation. Please find the RCD’s responses to the Grand Jury Report below.

1. Office network is protected with a business class firewall with no external resources exposed to the internet. All computers and servers are setup to install updates automatically as they are released by Microsoft. Ancillary software such as Adobe Acrobat also updates automatically. On site computer patching is monitored at the server level. Network and email accounts share the same credentials, and all accounts require strong passwords. 2-Factor authentication for email is being implemented and should be complete by early 2021.

2. All RCD data is stored on the server. The server is backed up daily with an offsite backup solution. A second local backup is configured to allow rapid recovery of the server to new hardware should a catastrophic failure occur. A small amount of ancillary data is kept on the shared Geographic Information System mapping (GIS) workstation related to GIS projects. The GIS machine is backed up with an offsite backup solution. Workstations are not backed up and are considered expendable. RCD has a policy for users to never store important data on their laptops. All data is kept on the server network shares.

Subnetting does not apply to RCD. Backups are monitored but full server recovery is not tested due to limited hardware resources.

3. Basic Email Spam and Malware filtering is provided via Office 365 tools. More sophisticated filtering is available and is currently under consideration. The cost of the expanded filtering functionality is a limiting factor. Currently we have no planned structured employee training on avoiding security issues. Frequent casual guidance given on an individual basis.

Sincerely,
Kellyx Nelson, Executive Director
San Mateo Resource Conservation District

150 WATKINS AVENUE | ATHERTON, CALIFORNIA 94027 | PH: (650) 752-0500 EM: [email protected] www.ci.atherton.ca.us
December 18, 2020
Hon. Danny Y. Chou
Judge of Superior Court
C/o Jenarda Dubois
Hall of Justice
400 County Center; 8th Floor
Redwood City, CA 94063-1655
VIA EMAIL: [email protected]
SUBJECT: RESPONSE TO GRAND JURY REPORT: “Ransomware: It Is Not Enough To Think You Are Protected"
Honorable Judge Chou,
Attached please find the Town of Atherton’s response to the above Grand Jury Report. The response to both the findings and recommendations are listed below. Pursuant to California Penal Code Section 933.05, the response was considered by the City Council at a public meeting on December 16, 2020.

Should you have any questions concerning the response, please contact City Manager George Rodericks at (650) 752-0504 or [email protected].

Respectfully,

TOWN OF ATHERTON
Elizabeth Lewis
Mayor

TOWN OF ATHERTON

ADMINISTRATIVE OFFICES
150 WATKINS AVENUE
ATHERTON, CALIFORNIA 94027
(650) 752-0500
150 WATKINS AVENUE | ATHERTON, CALIFORNIA 94027 | PH: (650) 752-0500 EM: [email protected] www.ci.atherton.ca.us
Response to Grand Jury Report Findings and Recommendations Report Title: “Ransomware: It Is Not Enough To Think You Are Protected" Report Date: October 7, 2020
Response by: Town of Atherton
From: Elizabeth Lewis, Mayor
The Town of Atherton is responding to each Finding solely with respect to itself and not regarding any other City.

Response to Grand Jury Findings:

F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

Response: The Town of Atherton agrees with this finding F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

Response: The Town of Atherton agrees with this finding F3. The direct and indirect costs of Ransomware can be significant.

Response: The Town of Atherton agrees with this finding.

F4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

Response: The Town of Atherton agrees with this finding.

F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

Response: The Town of Atherton agrees with this finding.

F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

Response: The Town of Atherton agrees with this finding.

F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

Response: The Town of Atherton agrees with this finding.

F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

Response: The Town of Atherton agrees with this finding.

Response to Grand Jury Recommendations:

The Grand Jury recommends that each governing body undertake its own confidential effort to protect against Ransomware attacks. Specifically:
150 WATKINS AVENUE | ATHERTON, CALIFORNIA 94027 | PH: (650) 752-0500 EM: [email protected] www.ci.atherton.ca.us
R1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether inhouse, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically:

1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly)

3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content) Response: This recommendation has been implemented
The Town of Atherton City Manager’s Office made this request of the Town’s IT Department upon receipt of the Grand Jury Report. The IT Department will prepare a study session report for City Council which will, at a minimum, address the concerns listed in R1.1, R1.2, and R1.3.

Response: This recommendation will be implemented by the June deadline The Town of Atherton’s IT Department will prepare a comprehensive study session report for City Council, planned for Q1 calendar year 2021, that addresses the concerns identified in the report. This report will include actions taken and plans for future enhancements.

Response: This recommendation will be implemented on or before June 30, 2021 The Town of Atherton IT Department will make a request with the Department of Homeland Security, Cybersecurity & Infrastructure Security Agency, for cyber-hygiene services before June 30, 2021.

R4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

Response: This recommendation will be implemented on or before June 30, 2021 The Town of Atherton IT Department will utilize the Federal Communications Commission Cyber Security Planning Guide and the FCC Cyber Security Planner to review and update our cyber-security plans. This work will be completed on or before June 30, 2021.

Town of Portola Valley
Town Hall: 765 Portola Road, Portola Valley, CA 94028 Tel: (650) 851-1700 Fax: (650) 851-4677 December 9, 2020
Hon. Danny Chou
Judge of the Superior Court
c/o ChJenarda Dubois
Hall of Justice
400 County Center, 8th Floor
Redwood City, CA 94063
Dear Judge Chou,
Thank you for the opportunity to respond to the Grand Jury report entitled “Ransomware: It’s Not Enough To Think You Are Protected”.

Below are the Town’s responses to the report’s findings and recommendations.

Findings
F1. Ransomware is a real and growing threat to public entities including those in San Mateo County.

Response: The Town agrees with this finding.

F2. Across the country, local governments and schools represent 12% of all Ransomware attacks.

Response: The Town cannot independently confirm this finding, but does not disagree.

F3. The direct and indirect costs of Ransomware can be significant.

Response: The Town agrees with this finding.

F4. Cybersecurity reviews and assessments, and an updated, well-executed Cybersecurity plan, are critical components of IT security strategy.

Response: The Town agrees with this finding.

F5. A comprehensive Cybersecurity plan should include, at a minimum, information concerning prevention steps, spam and malware software, and backups and full recovery testing.

Response: The Town agrees with this finding.

F6. The identification of phishing attempts, including the use of spam filters, is an important component to protecting an IT system from Ransomware attacks.

Response: The Town agrees with this finding.

F7. Testing a full restore of a server to ensure that backups are reliable should be undertaken regularly as part an entity’s backup plan to recover lost information.

Response: The Town agrees with this finding.

F8. Training of new employees, and the recurring training of existing employees, is an important component of defense against Ransomware.

Response: The Town agrees with this finding.

Recommendations
R1. Each of the governmental entities in San Mateo County with an IT department or IT function (whether in-house, handled by another government unit or outsourced to a private enterprise) as listed in Appendix F, should by November 30, 2020, make a request for a report from their IT organization that addresses the concerns identified in the report, specifically: 1. System Security (Firewalls, Anti-malware/Antivirus software, use of subnets, strong password policies, updating/patching regularly) 2. Backup & Recovery (In the event of an attack, can you shut down your system quickly? What is being backed up, how it is being backed up, when are backups run, and where are the backups being stored? Have backups been tested? Can you fully restore a Server from a backup?) 3. Prevention (turning on email filtering, setting up message rules to warn users, providing employee training on phishing and providing a reporting system to flag suspect content)
Response: Recommendations 1 and 3 have been implemented fully over the last two years.

Recommendation 2 has been implemented by way of a 2015 server crash that utilized backup systems that have subsequently been improved.

Response: The recommendation has not been implemented at the Town Council level at this time, but the Council has been informed of multiple improvements to the Town’s IT infrastructure. A full report will be provided to the Council by June 30, 2021.

R3. Given the results of their internal reports, governmental entities may choose to request further guidance by means of a Cybersecurity review from the U.S. Department of Homeland Security56 and/or a cyber hygiene assessment from the County Controller’s Office.

Response: The recommendation has not been implemented, but the Town will request a cyber hygiene assessment from the County Controller’s Office by the end of the fiscal year R4. Given the results of their internal reports, governmental entities may choose to ask their IT departments to review their own Cybersecurity Plan with the detailed template provided by the

FCC’s Cybersecurity Planning Guide and consider customizing it using FCC’s Create Custom Cybersecurity Planning Guide tool (see footnote 52).

Response: The recommendation has not been implemented, but will be by June 30, 2021 which will be based on our annual auditor’s enhanced cybersecurity audit.

Thank you,
Mayor, Town of Portola Valley
cc: Members of the Town Council

East Palo Alto City CouncilMay 17, 2022

East Palo Alto City Council
May 17, 2022