STAFF REPORT TO THE CITY COUNCIL
DATE: Regular Meeting of May 23, 2023
TO: Mayor and Members of the City Council
SUBMITTED BY: Dante Hall, City Manager
SUBJECT: Informational Report on Domain Name Change and Updates on Cyber Hygiene and Website Review RECOMMENDED ACTION:
Receive a report on information technology updates and provide comments, if any.
EXECUTIVE SUMMARY:
Protecting the City’s technology and information is vital to the City and its ability to serve residents. However, local governments across the country are being increasingly targeted for cyber-attacks. It’s imperative that cybersecurity be made a priority. The purpose of this report is to provide information about the DOTGOV Act of 2019 to help guard against cyber-attacks, an update on how the City is improving its cyber hygiene, and an update on making our City website more user friendly.
BACKGROUND AND ANALYSIS:
Not so long ago, local government agencies operated with filing cabinets stuffed with paper documents, fax machines and paper calendars. Our timecards and records were kept by hand, and resident engagement only happened in-person or over the phone. Today, most interaction with the public has moved online. This change has made many aspects of modern life more efficient. But this digital revolution is happening quickly, often at a pace faster than many can keep up with. As a result, individuals and institutions alike have been left vulnerable to hackers and ransomware.
Domain Name Change - In 2020, S.2749 - DOTGOV Act of 2019 was passed to transfer the “.gov” internet domain program from the General Services Administration to the Cybersecurity and Infrastructure Security Agency (CISA) and provides support for expanding “.gov” usage among public entities. Only bona fide U.S.-based government organizations are authorized to obtain a “.gov” domain to show the public their online services are official.
The City’s current domain name is www.ci.hercules.ca.us. Staff seeks to change the main domain name to www.herculesca.gov. for the following reasons:
Better cybersecurity
Simpler search that makes it easier to find information and services online More adaptable to phones, tablets, laptops, and computers Integration with city social media accounts
To build on these improvements, staff have also reviewed the City’s current website presence and examined the City’s network cybersecurity landscape.
S.2749 directs CISA to make .gov domain name registration services, as well as supporting services, generally available to any federal, state, local, tribal, or territorial government entity, or other publicly controlled entity that complies with the requirements for registration developed by CISA. “.gov” is one of the six original top-level domains (TLD) in the internet’s domain name system (DNS). DNS is the internet service that translates the names humans prefer into the numbers computers need to route a user to a website or to send an email. Only bona fide U.S.-based government organizations are authorized to obtain a .gov domain, and governments use .gov to show the public their online services are official. “.gov” is used by each branch of the Federal Government and is considered critical infrastructure for cybersecurity.
The use of the City’s domain name, ci.hercules.ca.us, has dated back to over 25 years, when the standard for most cities was to use the ci.xxxx.ca.us naming convention:
Naming Convention for “ci.xxxx.ca.us” Domain Name
ci
Abbreviated for “city”
xxxx
Refers to a city’s name
ca
Abbreviated for “California”
us
Abbreviated for “United States”
In recent years, we’ve witnessed local municipalities shift from this standard to domain names that are easier for the public to remember. A survey of what our neighbors are currently using is outlined below:
.gov domain
sanpabloca.gov
alamedaca.gov
antiochca.gov
sf.gov
.org domain
walnut-creek.org
pleasanthillca.org
cityofconcord.org
el-cerrito.org
.net domain
cityofvallejo.net
still using ci.xxx.ca.us
ci.pinole.ca.us
ci.richmond.ca.us
ci.benicia.ca.us
Although it seems that there is no standard naming convention, the federal government, through the Cybersecurity and Infrastructure Security Agency (CISA), is committed to promoting .gov as a trusted space for government agencies. The new .gov domain also makes it more difficult for malicious actors and scammers to co-opt government websites. Using less secure domains such as .com or .org allows cybercriminals and malicious actors to impersonate government officials more easily in attempts to defraud the public. Guidelines set for city and county .gov domains must include the two-letter state abbreviation. Exceptions are made for unique or well-known cities that may not require a state reference, for example, sf.gov.
Most governments that want to transition to a new domain name have already established an online home – a website and/or email address – that has been maintained and published for years. Domain names show up not just online but printed on paper (letterhead, business cards, flyers, etc.), on vehicles, and on public signage. This change will impact all things that involve or touch the City website. Printed materials will start to reference the new herculesca.gov web address. This will include the website address you see in the footer of documents, agendas, minutes, envelopes, business cards, flyers, letterhead, fleet vehicle decals, etc. Existing City material with the www.ci.hercules.ca.us naming convention on hand will be used up and transitioned to the new address with future new orders and upon regular life-cycle replacements. We will continue to control the www.ci.hercules.ca.us address indefinitely and will redirect it to the new herculesca.gov address as needed.
City staff and City Councilmember email addresses will also eventually change to @herculesca.gov email addresses on printed material and our website. This will provide an overlap period and the opportunity for an orderly transition so that all contacts can be updated.
Cyber Hygiene – Following CISA’s recommendations, new password policies and multi-factor authentication were implemented and enforced in the 2nd quarter of 2022. The City then contracted with a digital advising firm to perform annual network penetration testing. The first network penetration test, completed at the end of 2022, identified some immediate exploitable issues which staff were able to remediate immediately. Recommendations with longer term fixes were remediated within the first quarter of 2023. Ongoing, the City will provide social engineering training to City staff to expand its virtual firewall. The first phase of the social engineering project is scheduled to begin in June 2023. To further improve network security, staff is also researching new software solutions that will aid in streamlining the application of software updates and security patches.
Website Review - A review of the City’s website, which was last redesigned in April 2018, was initiated with a usability survey and interviews with current users. Of the 40 responses received, 70% of users surveyed said that they did not have any trouble navigating our City website. When asked about features that could improve the user experience, participants suggested adding online reporting, up to date pool hours, and more pictures of Hercules. Interviews supported the survey results with comments that pictures of Hercules portraying current activities and major projects should be more prominently displayed. Additionally, suggestions to include more news articles on the home page would help to keep residents informed of current events.
An evaluation of Google analytics on the City’s website revealed that the top page views included the home page, aquatics, WebTrac (the City’s online recreation class registration portal), and the police log. The Recreation and Police department home pages were also frequently visited.
With the goal of a more user-centric website, staff is currently making improvements include the following:
Placing shortcut buttons to top visited pages on the home page.
Using the News/Updates section of the website to closely follow articles posted on social media, allowing for users to access multiple platforms and up-to-date information.
Conduct a thorough review of all departmental webpages to ensure pages are current.
Rotating photographs on the home page highlighting city projects, landmarks, programs, and services will be updated on a quarterly basis.
FISCAL IMPACT:
Although there is no cost to register a .gov domain name with CISA, they do not provide DNS hosting services. A DNS server will need to be built in the demilitarized zone of the City’s network to accommodate this service. Staff, with the assistance of the City’s networking consultants, estimates the server build, and the reconfiguration of network and email servers, to take no more than 10 hours, or $2,500. There is sufficient funding available to sustain this initiative. .