ITEM 5. 4
CITY MANAGER' S REPORT
SEPTEMBER 12, 2022 CITY COUNCIL REGULAR MEETING
ITEM: GRAND . 7URY REPORT RESPONSE
RECOMMENDATION: Accept Grand ury Report On Cybersecurity and Direct the City Attorney to Submit a Letter to the
Presiding ) udge of the San 7oaquin County Superior
Court Responding to the Findings and
Recommendations of the Grand 7ury Report.
SUMMARY
In the attached 2021/ 2022 San Joaquin County Grand Jury Report, The Grand Jury recommends the Lathrop City Council respond to the following findings and recommendations detailed below.
BACKGROUND
POSSIBLE RESPONSES TO GRAND JURY FINDINGS:
California Penal Code Section 933. 05 requires City Council issue a response in writing to the Presiding Judge of the San Joaquin County Superior Court indicating whether the Council:
Option 1. Agrees; or
Option 2. Disagrees wholly or partially with the findings of the Grand ) ury.
POSSIBLE RESPONSES TO GRAND 7URY RECOMMENDATIONS:
California Penal Code Section 933. 05 also requires City Council to respond to all recommendations contained in the Grand Jury report with one of the following:
Option 1. The recommendations have been implemented, with a summary regarding the implemented action.
Option 2. The recommendations have not yet been implemented, but will be implemented in the future, with a timeframe for implementation.
Option 3. The recommendations require further analysis, with an explanation and the scope and parameters of an analysis or study, and a timeframe for the matter to be prepared for discussion by the officer or head of the agency or department being investigated or reviewed, including the governing body of the public agency when applicable.
CITY MANAGER' S REPORT PAGE 2
SEPTEMBER 12, 2022 CITY COUNCIL REGULAR MEETING
GRAND JURY REPORT RESPONSE
Option 4. The recommendations will not be implemented because it is not warranted or is not reasonable, with an explanation therefor.
GRAND URY FINDINGS AND RECOMMENDATIONS WITH PROPOSED
RESPONSES:
Grand Jury Finding F3. 1: The City of Lathrop does not employ multi- factor authentication universally, leaving City systems more vulnerable to the activities of bad actors."
Grand Jury Recommendation R3. 1: By November 1, 2022, the Lathrop City Council, in conjunction with the City' s IT department, develop, adopt and implement a procedure for universal multi- factor authentication for access to City data."
Proposed Council Response: The City of Lathrop City Council agrees with Grand Jury Finding F3. 1 and Recommendation R3. 1 and multi- factor authentication security has been implemented and in effect since June of 2022.
Grand 7ury Finding F3. 2: The City of Lathrop provides an unsecured public Wi- Fi network. Misuse of this unsecured network could expose the City to liability risks." Grand Jury Recommendation R3. 2: By November 1, 2022, the Lathrop City Council, in conjunction with the City' s IT department, provide a secure public Wi- Fi network."
Proposed Council Response: The City of Lathrop City Council disagrees with Grand Jury Finding F3. 2 and Recommend R3. 2 because by definition, publicly available Wi- Fi is inherently unsecured", although this designation is a misnomer because it eludes to an idea that publicly available Wi- Fi can either be secured or unsecured, and that unsecured is less safe" or more ' risky" than secured. Neither are the case. An " unsecured network" only means that such Wi- Fi is publicly available for anyone to use. Wi- Fi networks, either secured or unsecured, cannot merge end- users between those networks. Secured and unsecured networks, and the end- users utilizing either, remain completely isolated from one another; it would be unfeasible for someone with access to only an unsecured Wi- Fi network to also have the ability to gain access to a separate, secured Wi- Fi network.
The commonly perpetuated idea of " risk" associated with the use of an unsecured Wi- Fi network incorrectly shapes such " risk" as something that happens upon an end- user regardless of their use of the unsecured Wi- Fi network, when in reality, risk can develop and potentially increases the more limited an end- user' s understanding of how their digital presence on the internet affects their vulnerability and security. End- users should be encouraged to utilize personal checks and balances to verify the Wi- Fi networks they choose to connect to are verifiable and reputable, that their presence on the internet is not made easily CITY MANAGER' S REPORT PAGE 3
SEPTEMBER 12, 2022 CITY COUNCIL REGULAR MEETING
GRAND JURY REPORT RESPONSE
available to be tracked by others, and that they are visiting legitimate websites, in order to further maintain security of their personal data and information.
Publicly available Wi- Fi is a critical asset to cities around the country. Publicly available Wi- Fi provides the public the opportunity to connect to critical and important information equitably and provides a consistent source of access to such information, promoting economic inclusion within the community. The City of Lathrop currently hosts an unsecured public Wi- Fi network entitled City of Lathrop Guest Cloud 1" and end- users who connect to this network to access the internet must agree to the terms and conditions of its use, and which the public is only able to remain connected to for time increments of thirty ( 30) minute, between 7am and 7pm, seven ( 7) days per week.
Grand 7ury Finding F3. 3: The City of Lathrop does not have an approved Business Continuity Plan, rendering the City relatively unprepared to restore essential services in a disruptive event."
Grand 7ury Recommendation R3. 3: By January 1, 2023, the Lathrop City Council, in conjunction with the City' s IT department, develop, adopt and implement a Business Continuity Plan."
Proposed Council Response: The City of Lathrop has an unwritten Business Continuity Plan but not a written one. The City of Lathrop City Council agrees with Grand ] ury Finding F3. 3 and Recommendation R3. 3 and documentation is anticipated to be complete by ) anuary of 2023.
Grand 7ury Finding F3. 4: The City of Lathrop does not have a formal internal policy or procedure to address ransomware attacks. This absence of policy could cause confusion, delay and greater loss of security in the event of such an attack." Grand 7ury Recommendation R3. 4: By November 1, 2022, the Lathrop City Council, in conjunction with the City' s IT department, develop, adopt and implement a formal internal policy and procedure for a ransomware attack." Proposed Council Response: The City of Lathrop has an unwritten, internal procedure to address ransomware attacks and, in addition to such, has hired a consultant whom will assist the City in development and implementation of a formal written policy for procedures to address ransomware attacks. The City of Lathrop City Council agrees with Grand ] ury Finding F3. 4 and Recommendation R3. 4 and anticipates documentation will be complete by January of 2023.
Grand Jury Finding F3. 5: " The City of Lathrop does not have an insurance policy covering financial losses from a cyberattack, possibly exposing City financial resources."
CITY MANAGER' S REPORT PAGE 4
SEPTEMBER 12, 2022 CITY COUNCIL REGULAR MEETING
GRAND JURY REPORT RESPONSE
Grand 7ury Recommendation R3. 5: " By January 1, 2023, the Lathrop City Council, in conjunction with the City' s IT department, obtain an insurance policy to mitigate fiscal impact resulting from cyberattack or other critical information system loss."
Proposed Council Response: The City of Lathrop City Council partially agrees with Grand Jury Finding 3. 5 and Recommendation 3. 5 and would like to further clarify that staff confirmed that the City of Lathrop does in fact have Cybersecurity insurance coverage, and is currently in discussions with Risk Management to enhance said coverage.
RECOMMENDATION:
Staff recommends City Council accept the Grand Jury Report and direct the City Attorney to submit responses to the Presiding Judge of the San Joaquin County Superior Court to the findings and the recommendations outlined in the Grand Jury Report.
FISCAL IMPACT:
None, except for staff time to prepare this report.
ATTACH M ENTS:
A. Grand Jury Final Report, Case No. 0321
B. Draft Letter to San Joaquin County Superior Court Presiding Judge in response to Grand Jury Final Report Case # 0321
CITY MANAGER' S REPORT PAGE 6
SEPTEMBER 12, 2022 CITY COUNCIL REGULAR MEETING
GRAND JURY REPORT RESPONSE
APPROVALS:
Z
andes Date
Chief Information Officer
o " 3/ — ZO -zZ
Salvador Navarrete Date
City Attorney
o •ZZ
Ste en J. Salvatore Date
City Manager
Attachment A
2021- 2022 San loaquin Coun#y Grand 1ury
dRw
San loaquin County and Its Seven Cities:
Cybersecurity: Local Defense Against a Global Threat
Case# 0321
Summary
We hear reports on a daiiy basis of cyberattacks occurring around the world. These attacks are becaming increasingly sophisticated, disruptive and expensive. Attacks on overnment agencies can disrupt essential services, crippling communities. Agencies smal! and large are equaily vulnerable. There is an ever- growing demand for stolen data in an underground market.
Comprornise of information has proven to be a serious threat on the cyber battleground, both domestically and internationally. Bad actars hack intelligence, rnedia and essential service systems.
Other disasters such as floods, fires, storms ar prolonged power outages can interrupt essential services if providers' informatian systems are not adequately secure. According to one expert witness interviewed by the 2021- 2422 Grand Jury," World War Ifl will be fought in cyberspace, not on the battlefield."
Grand Jury members are net technical experts but sought to understand the cybersecurity landscape and local governments' management of their cybersecurity risks and vu nerabilities. In this investigation of information security of San Jaaquin County and its seven cities, the 2d21- 2022 Grand Jury made a " point in time" assessment of each entity' s fnformation Systems Department ISD}, focusing primart y on cybersecurity. The Grand Jury considered nine elements of any ISQ and, through research of relevant literature and input from industry experts, established an expected standard for each of those elements. Tfie Grand Jury then evaluated each of the agencies with respect to those expectations.
The Grand Jury concluded that San Joaquin County( SJC) has mature and robust security policies and systems. The County' s security architecture provided a model in evaluating each city' s systems.
The Grand 1ury determined that Escalon, Lodi and Stockton met a ! ay person' s expectations for tybersecurity but were latking either a formal Business Continuity Plan( BCP or Disaster Preparedness Plan{ DPP. Lathrop, Manteca and' fracy were found to have adequate security systems in place but Eatk documented plans far both Business Cantinuity and Disaster Preparedness. Ripan was found to-need impravement in meeting severaf of the Grand 1ury' s expectations, with lack of personnei being their greatest chalienge.
The Grand Jury recommends that the County and affetted cities:
devetop, adopt and implement a Business Continuity Plan; develop, adopt and implement an IT Disaster Preparedness Plan; remedy speci c cybersecuriry risks found in this investigation; and the City of Ripon undergo a data system security review by an expert third party to assess the City' s lT systems and protocols.
1' he Grand Jury recognizes that cybersecur'rty is a dynamic process, a cantinually moving target which needs constant monitoring and updating.
Gtossary
Access: The ability and means to communicate with or otherwise interact with a system; to use system resources ta manage infarmation; to gain knawledge of the information the system contains; to cantral system campanents and functions.
Actor, bad actar, t6reat actor or attacker: An individual, group, organizatian or government that attempts ar executes an attack.
Attack: An intentiona) attempt to gain unauthorized access to sysEem services, resources ar information; an attempt to compromise system integrity.
Authentication: The pracess ofverifying the identity or other attributes af an entity( user, process or device}.
Authorization: A process of determining, 6y evaluating applicable access contral infarmation, whether a subject is allowed to have the specified types of access to a particular resource.
BCP: Business Continuity Plan. A document that sets forth procednres for the continued perfarmance of core capabilitics, critica! operatians and user services during any disruption or patential disruptian.
CCISDA: California County Information Services Directors Association. This is the official organization ofthe county IT directors and chief information afficers throughout the state of California. CCISDA represents a1158 California counties in the area of information technology in county government.
CIO: Chief lnformation Officer.
Computer Aided Dispatch Systems: Used by dispatchers, call- takcrs, and 91 t operators to prioritize and record incident catls, identify the status and Iocations of responders in the field and effectively dispatch respanders.
Co fidentiality: A property of informatian that is not disclased to users, processes or devices unless they have been authorized to access the informatian. i
Cyber event ar incident: An occurrence that actually or potentially results in adverse cansequences to an information system or the information that ihe system processes, stores or traasmits and that may reyuire a response action to mitigate the consequences. An occurrence that constitutes a violation or imminent threat of vialation t fsecurity goiicies, security pracedures or aeceptable use policies.
2 Cybersecurity: ' The activity, process, ability, capability or state whereby information and comrttunications systems and tf e information cantained therein are protected from and/ or defended against damage, unauthoriud use, modification or exploitation.
DPP: Disaster Preparedness Plar. A document that sets forth policies and procedures for restoration of information systems after a criticaE incident or event from ar y source. The plan addresses interim restoration of information operations in the short and medium term and ful! restoration of all capabilities in the longer term.
Data integrity: The property that data is complete, intact and trusted and has not been modifed or destroyed in an unauthorized or accidentai manner.
Data security policy: A rule or set af rules that govems the acceptable use of an organization' s information and services to a level of acceptable risk and the means for protecting the organization' s information assets.
Encryption: The process of converting data into a form that cannot be easily understood by unauthorized people or agents.
Firewall: A capability to limit nehvork traffic between networks and/ or information systems. A hardware! software device, or a software program, that limits network traffic according to a set of n.sles af what access is and is not allawed ar authorized.
Hacker: An unauthorized aser who attempts to or gains access to an information system.
ISD: Information Systems Department.
IT: Information Technology.
KnowB4: A proprietary security awareness training platform. KnowB is used by agencies for simulated phishing activities and other email compromise tests, as well as for other IT security training needs.
Malware: Software that compromises the operation of a system by performing an unauthorized function or process.
Mobile device management tool: A security software tool designed to help organizations secure, manage and monitor mobile devices such as smartphones and tablets.
Multi-factor authentication: An electronic authentication mechanism in which a user is granted access to an application anly after presenting twa or more pieees of evidence{ factors or keys only the autl entic user knaws or possesses}.
Multi-layer security access: Multi-layer security refers to a system that uses numerous components to shield the IT infrastructure. It is a defense mechanism that mitigates, delays or prevents threats.
Network or cyber iafrastrueture: The information and communication systems and services composed of all hardware and software that process, store and communicate information; any combination of aU these elements.
Next- generation systems: Security systems consisting of hoth firewall and intrusion prevention systems built in, rather than as add- ons, along with the features of basic firewalls.
Phishing: A digital form of social engineering to deceive individuals into providing sensitive information.
Phishing test: A security training exercise designed to test users' vulnerability and reinforce vigilance.
Presidential Executive Orcier 14028: " Improving thc Nation' s Cybersecurity"( issued May 12, z021} requires agencies to enhance their cybersecurity system integriry. 3 Raasomware: A type of malicious saftware designed to black access to a computer system until a sum ofmoney is paid.
Ransomware att ck response plan: A set of predetermined and documented procedures to detect and respond to a cyber incident involving demand for ransom for recovery and restoration of data or systems.
Records Managernent System: The management of records for an organizatian throughout the records' life cycle.
Redundancy: Additional or alternative systems, sub- systems, assets or processes that maintain a degree of overall functionality in case of Ioss or failure of another system, su- system, asseE or process. Typicatiy applied to pr wer supplies and data backup systems.
Vuinerability: A characteristic or specific weakness that renders an organization or asset( such as information or an information system) open to expIoitation by a given threat or susceptible ta a given hazard.
Wi-Fi network: A family of wireless netwark protocols used for local area networking of devices and internet access, allawing nearby digital devices to exchange data by radio waves.
Background
The 2008- 2009 San Jaaquin County Grand Jury reported on infarmation technology security, finding that severa! Cvunty departments and two of the seven cities in the county met expectations for Information Technology(! 1'} security, while some County departments and ve cities did not.
Recommendations were made and generally accepted in agency responses. In terms of technolagy, 2008- 2Q09 was at ieast a generation a a. Gavernment agencies use and store vast amounts of sensitive data on their residents and their employees, including personal identificatian data, financial data, health data and legal data. Additiona{ ly, these agencies provide services essential to our day-to-day fives, including public safety( police and fire), public works, health 5ervites, water services and comrnunity development. The Grand lury recognizes that we are lay people, hardfy experts, in tFte field of IT. It was the intent of the 2021-2022 Grand Jury to examine how tF e county and city governments with n San loaquin County are exercising due diligente to protect information, defend against future cyberattacks, maintain current disaster plans and provide ongoing training ta employees in these matters.
Reasan for Investigation
As stated in Presidential Executive Order 14028,"... the preventian, detection, assessment and remediation flf cyber incidents is a top priority and essential to national ecanornic security." 5an oaquin County has experiencecf ransomware and cybersecurity attacks firsthand. Schoo! disEricts, tnunicipalities and tounty agencies have been victimized in recent years. Given the rise in complexity of IT, the current sophistication of cybercrime, and the essential nature of government services provided, the 2021- 2022 Grand lury undertook an investigatio into the current state of secu ity and disaster preparedness of the IT systems of 5an loaquin County and the seven inca porated cities within the county.
4 Method of Investigation
The 2021- 2022 Grand Jury surveyed six San Joaquin County 1T department heads and the City Manager or City Administrator of each of the seven cities in the county; each responded to the survey. Subsequently, an agency IT department head or staff inember, an IT consultant or a city administrator was interviewed to clarify responses and to provide additional material when applicable. The Grand Jury also interviewed independent cybersecurity experts. The expert witnesses have collectively rrtore than 50 years' experience at diverse ievels of government ranging from county to state to national information systems and cybersecurity. IT executives from one school district were also interviewed. For this investigation, the Grand! ury interviewed 16 individuals and attended cybersecurity presentations.
The Grand Jury alsa reviewed numerous websites and newspaper and magazine articles relevant to this investigation. Additionally, the Grand Jury reviewed dacuments provided, including network diagrams, ransomware insurance policies and other items.
Materials Reviewed
2021- 2022 San Joaquin County Grand Jury surveys
B'sden, Joseph. Executive Order orr Improvrng the Natian' s Cybersecuriry. 12 May 2021.
Executive Ordec# 14028
California Joint Cyber Incident Response Guide. Califomia Office of Emergency Services Cyber Security Integration Center, 2 Aug. 2021
CyberAtockPreparedrress i Contra Costa County. Contra Costa County Civil Grand Jury, 2021. Report 2104
Digital Services and Innovation Strateg. San Joaquin County, 19 Nov. 2020 How to Develop a Ransomware Remediation Plan. Rubrik, 2021 Information Technolo Security. 20] 8- 2019 Santa Barbara County Grand Jury, 2019 Information Technology Security: Cities and San Joaquin Counry. 2008/2009 San Joaquin County Grand Jury, 2009. Report No. 03- 08
R nsomware Defensefor Dummies--2nd Edition. 2nd ed., Cisco Uinbrella, 2021 Websites Visited
Cybersecurity& Infrastructure Security Agency." CYBERSECURITY CISA." Cisa.gov, Cybersecurity and Infras#ructure Security Agency, 2019, www.cisa.gov/cybersecurity. Accessed 6 May 2022.
Federal Trade Commission, and Alvaro Puig." Cybersecurity Advice to Protect Your Connected Devices and Accounts." Sjgov. org, 24 Mar. 2022, www. sjgov. org/ department/ da/ consameralerts/ consumer- alerts/ 2022/ 03/ 24/ cybersecurity- advice- taproteet- your- connected- devices- andaccounts. Accessed 6 May 2022.
Kuykendall, By Kristal." Cybersecurity Experts Call for More Transparency and Immediate Resources for Schools -" The Journal, 17 Mar. 2022,
thejournal.com/Articies/2022/03/ 17/Cybersecurity-Experts-Call-For-More-Transparency-andImmediate- Resources- for- Schools.aspx?Page= 1. Accessed 6 May 2022. 5 Marcum Accounts Advisars. " What ts a SOC 2?" ' he SSAE 18 Reporting Standard- SQC 1 - SC1e 2- SOC 3 ( Formerly SSAE 16), 8 Jan. 2022, www. ssae 16. com faqi'what- is• a- soc- 2/.
Accessed 34 Apr. 2 22.
National Institute for Cybersecurity Careers ar d Studies. " Gybersecurity Glossary National Initiative for Cybersecurity Careers and Studies." Niccs. cisa.gov, niccs. cisa. govtaboutniccs/ cybersecurity- glossary. Accessed 6 May 2022.
Unisys. " Cyber Attacks-- What You Need to Know" Unisys, 2022, www. unisys. cam. Accessed 6 May 2022.
Discussions, F ndings anc! Recommendations
General Discussion
The Grand Jury recognizes cybersecurity is an extremely cornplicated topic. Specialized know(edge, experience and expertise are required for a t#eep understanding o#wttat is necessary far adequate policies, systems nd arthitecture. Lacking such specialized knowledge,#he Grand Jury researthed numerous sources, including recognlzed experts in this field to determine the following efements of any ISD and to define the foUowing expectations for adequate cybersecurity in taday' s environment.
Expectations
Organization: Each organization should have a detailed Organization Chart demonstrating the structure of its independent IT department. Cities lacking an independent IT department should have a chart showing where IT resides in their overali swcture.
Nehvork Diagram: Each organization should have a detailed netwark diagram indicating the relatianships between a1I IT architectural elements. Best- practice guidelines suggest that this diagram be confidential.
Data Confidentiatity: Each organizatian shauld have an organization- wide poticy determining data confidentiality and access corttrol. Policy for data access should be clearly defined and deskspecific or station- specific.
Data Security: Each organizatian shouid have next- generation systems and controls to ensure both physical and cyber security for a! I IT assets. Next- generation firewalls and endpoint management systems provide protection against ever-evolving means of cyberattack. Data shou ld be protected with daily or continuous backup and archival systems. Backups shvuld be pratected against corruption, external encryption andJor destructian. Agencies should require multi- factor authentication for access to network systems.
Business Conti»uity Plan ( BCP): Each organization should have a detailed, cunent, comprehensive pian for restoring services in the event of disruption from any source.
Disaster Preparec3ness Plan ( DPPj: Each organization should have a formal, detai( ed plan to prepare for various possible IT disruptions. This plan should be tested frequently and updated regularly.
Ransomware Poliey: Each organization shauld have an intemal ( con dential) doeumented policy for agency response to a ransomware attack.
6 Cyber Event Insurance: Each organization shou[ d have insurance coverage to help offset econamic losses from cyber events.
Ongoing Employee Training: Each organization should provide rigarous, frequent training and ongoing testing of al! employees as an integral part of its cybersecurity profile.
Survey Results:
The tabie belaw indicates whether an agency met( M), did not meet{ NN or was in the process of ineeting( IP) the nine defined expectations.
Or; N lwork Dau Daq 8LP DPP Rsnsomwin Cyb r TraMln
Clrrt Dis` ram GonfldendaMty Security poltey Inwranc
S1C M M M M M M NM M M
Escalon M M M M NM M M M M
lathrop M M M M NM M NM NM M
Lodi M M M M IP M M M M
Manteca M M M M M M 1P IP M
Ripon M M M M NM NM NM M M
Stockton M M M M M M NM M M
Trary M M ; M M IP IP NM M M
1. San Joaquin County--Discussion
In November 2020, San loaquin County released a three- year( 202Q- 2023) strategic plan for ensuring continuing security, efficacy, cost-effectiveness and best-servite autcomes to ali end- users of County services and systems. The plan dacurnent" San loaquin County Digi#al Services and Innovatian Strategy" established goals for County digital service systems. These gaals— Modernizing and Leveraging OurTechnotogy Enviranment— address objectives for a security postu re:
l. Acquire and implement cybersecurity technology to enable SJC ta develop indushy-leading capabilities to help mitigate and address cybersecurity risk.
2. Develop and mature security govemance and processes to meet or exceed industry standards, enhance security enforcement partnerships, and strengthen County practices.
3. Develop a robust security training program for the County workfarce, including enhanced training and development for the security workforce.
Excerpt from" San Joaquin Counry Digital Services and Innovation Strategy," November l9, 2420( page 6} San Joaquin County has met these objectives and continues to update and enhance these processes as the cybersecurity landscape continues to evolve.
7 San Joaguin County ISD oversees all County departments, making it one of the largest counry ISDs in Catifornia. San Joaquin Caunty ISD is an active participant in the CaGfornia County Information Systems Department Association( CCISDA). This association provides opportunities for counties to share information and experiences and offers guidance, such as standarc3s for best- practice policies.
Several large and specialized departments within the County have their wn IT departments and department cl iefs who report to thc County' s Chief Information Officer. Additionally, SJC has a dedicated Infocmatian Security Officer. All these IT executives form a eybersecurity gavernance cammittee which meets monthly, with subgroups meeting mare freyuently as needed.
County ISD and Human Resource Departments conduct Frequent and on- going employee training and testing using proprietary software. In addition to these County departments, several Indepencient Special Districts in SJC use County IT services through various memaranda afunderstanding.
The only element of the defined expectations nat met by SJC is having an internal documented policy for response to a ransamware attack.
San Joaquin County is a modef agency in the realm of information technology and maintenance of cybersecurity.
Fjndings
F1. 1 5an Jaaquin County does not have a farmal internal policy concerning payments or procedures in ransomware attacks. This absence of policy could cause confusion, delay and greater loss of security in the event of such an attack.
Fi. 2 San loaquin County has an exemplary profile regarding cybersecurity and shoufd serve as a madei for other government agencies within San loaquin County.
Recommenda# ions
Rl.i By Novernber 1, 2022, the San loaquin tounty Board of Supervisors, in canjunction with San loaqui County ISD, develop, adopt and implement a formal internal policy and procedure for response to a ransomware attack.
2. 0 City of Escalon—Discussion
The City of Escalon daes nat have an independent IT department but has a cantract agreement with Mid Valiey IT ta provide all IT services. In the City organization, IT functions report to the Finance and HR Directors. Each employee is given a level of access according to assigned responsibilities within their department. All employees receive information security training specific to their responsibilities as well as general security awareness Lraining. The IT cansultant emplays an aggressive multi-layered approach to mitiga#e security threats thraugh software and hardware pratection measures. Cr'rtica! or con dentia! data is stored in multiple cloud- based locatians and systems employing numeraus safeguards, including use af multi- factor authentication for access.
IT functions are protected with a standby generator and redundant backups in case of a system failure. The gene ator is# ested periodically for functionality. 8 The City of Escalon met all but one of the expectations for adequate tybersecurity. Escalon is by far the smallest city in San loaquin County, but by using a contracted IT service provider, Escalon is meeting its cybersecurity needs. The City of Escalon does not have a documented Business Continuity Plan.
indings
F2. 1 7he City of Escalon does not have a documented 8usiness Continuity Plan, leaving the City relatively unprepared to restore essential services in a disruptive event.
Recommendations
R2. i By January 1, 2Q23, the Escalon City Council, in conjunction with Mid Valley IT, develop, adopt and implement a Business Continuity Plan.
3.0 City of Lathrop—Discussion
The City af Lathrop met six of the expectations for the nine elements considered in this investigation. Lathrop' s IT organization includes a Director of Information Technology at#he cabinet leadership level, a policy strongly recommended by an tT expert fo maximum IT security. Including the Director of IT in frequent, regular meetings with other department heads all ws effective communlcation of IT security needs to all City departments.
Expectations for data confidentiality and data security were met. However, use of multi-factor authentication for system access was not universal at the time of this investigation, leaving Lathrop at higher risk of attack. lathrop provides an unsecured public Wi- Fi network, separate from the City' s secure business network and accessible to any user. Hackers or other bad actors could take advantage of the unsecured network, possibly resulting in compromise of log-in credentials from that network and possibly exposing the City to costly liability suits. Lathrop was in the process of developi g and approving a BCP and bPP plan at the time of this investigation. Similarly, the City was updating an internal policy for response to a ransomware attack. At the time of this investigation, Lathrop lacked insu ance against losses incurred in a cybersecurity incidenE.
Findings
F3. 1 The City f E. athrop does not employ multi-factor authentication universally, leaving City systems more vulnerabfe ta the activities of bad actors.
F3. 2 The City of I. athrop provides an unsecured public Wi- Fi network. Misuse of this unsecured network could expose the City to liability risks.
F3. 3 The City of Lathrop does not have an approved Business Continuity P1an, rendering the City relatively unprepared to restore essential services in a disruptive event. 9 F3.a The City of lathrop daes not have a farmal internal po#icy or procedure to address ransomware attacks. This absence of palicy could cause confusion, delay and greater loss af security in the event of such an attack.
F3. 5 The City of Lathrop daes not have an insurance policy covering financial losses from a cyberattack, possibly exposing City nancial resaurces.
Recomnnendatians
R3. 1 By November 1, 2022, the lathrop City Council, in conjunction with the City's IT department, develop, adopt and implement a procedure far universal multi- factor authentication for access to City data.
R3. 2 By November 1, 2022, the lathrop City Council in conjunction with the City' s IT department, provide a secure public Wi-Fi network.
R3. 3 By January 1, Z023, the Lathrop City Council, in conjunction with the City' s IT department, develop, adopt and impfement a Business Continuity Plan.
R3. 4 By November 1, 2022, the Lathrop City Council, in conjunction with the City' s IT department, develop, adopt and implement a formal internal policy and procedure for a ransomware attack.
R3. 5 By January 1, 2023, the Lathrop City Council, in conjunction with the City' s IT department, obtain an insurance policy to mitigate fiscal impact resu{ting from cyberattack ar other critical information system loss.
4. City of Lodi- Discussion
The City of ladi has a large IT division, respansible for all IT functions of the City. The division is responsible for the integrity of the City' s cyber infrastructure, maintenance and suppart of all hardware and saftware, and assuring secure access to a( I network resources. Lodi fell victim to a ransom attack in April 2019. That unfortunate event caused the City ta change its management of cybersecurity, significantly elevating the importance of vigilance by all City staff. Lodi has irnplernented a rabust cyber awareness training program for all City employees, incorpora#ing education in tactics used by bad actors bath inside and outside the City' s network. Monthly training s foNowed by testing in tapics covered. Citywide campa' rgns occur quarterly to test employee response to phishing and other email- based attacks. The IT division head reports directly to the Deputy City Manager and meets regularly with a11 City departmen# heads. The City of Lodi met ali expettations for cybersecurity except for having a completed, up-to- date Business Continuity Plan.
The City has contracted a business consulting firm to create a BCP, projected to be completed and implemented by the end af June 2022.
IA
Findings
F4. 1 The City of Lodi does not have an approved Business Continuity Plan, rendering the City relatively unprepared to restore essential services in a disruptive event.
F4. 2 The City of Lodi has implemented an excellent cyber awareness training program for all employees minimizing risk to damage fram cyberattack.
Recommendations
R4. 1 By January 1, 2023, the Lodi City Council, in conjunctio with the City' s IT division, develop, adopt and implement a Business Continuity Plan.
5.0 City of Man#eca—Discussion
The City of Manteca met seven of the nine expectations considered in this investigation. Manteca' s Informatian Technology department is independent in the City' s organization. The department director repo ts directly to the City Manager and meets weelcly with ather City department heads.
User level of access is determined by position, bacicground and other departmental factars. fmployees are trained on a regular basis. The training is mandatory for all employees. Hard d ives are encrypted, and a Mobile Device Management tool is used for tablets, laptops and phones.
Manteca' s ISD is currently updating its Information Technology Security Policy. This camprehensive policy has not been updated since 2 10. Manteca' s Department of Information Technology and Innovation is coilaborating with City administration and the City Attorney to update all policies relating to information technology security. Similarly, the City is in the process of bringing both hardware and software systems up to next-generation standards with new firewall, malware, user access, backup systems and applications in place. Employee training is executed through Know64, an industry-standard cybersecurity training program which includes phishing and other email comprom3se testing.
Regarding firewalls and swi#ches, roughly 6096 still operate off single rather than dual or redundant power supplies. Over the next five years, the tity is phasing eut older devfces as they reach end- oflife.
Findings
F5. 1 The City of Manteca has an Information Technolagy Security Policy which has not been updated since 2010, leaving the City relatively unprepared for a cyber event.
F5. 2 The City of Manteca lacks a policy and procedure for ransomware attacks. This absence of polity could cause confusion, delay, and greater loss of security in the even# of such an attack.
F5. 3 The City of Manteca has a significant number of security devites with single power supplies.
This lack of redundant power presents vulnerabiiity in major or pro onged power outages.
I1
Recommendations
R5. 1 By January 1, 2023, the Manteca City Council, in canjunction with the City' s ISD, develop, apprave and implement an updated I nformation Technology SecuritY PQ YR5. 2 By anuary 1, 2023, the Manteta City Council, in conjunction with the City' s ISO, develop, approve and impiement a confidential policy and procedure for response ta a ransomware attack.
RS. 3 By March 1, Z423, the Manteca City Council, in conjunction with the Gty' s ISR, devefop, approve and adopt an updated timeline to rep{ace singie- powe ed units with dual- powered or redundant-powered units in their network architecture.
6.4 City of Ripon—Discussion
7he City of Ripon has experienced turnaver and vacancies in the IT Department in the past year.
The Director of IT resigned in early 2021. Subsequently, anather tT Director was hired but resigned within three months.' The City has cantracted with a former IT employee as a temporary IT Director and is cu rently updating the job description for a permanent director of the IT funct ons.
The City' s arganization chart does not include an ! 1' department or department head. The anly iT positian shown is within the Police Department.
Data confidentiality is maintained through a three-tiered access structure. Management supervisors for each City department determfne who has access to appropriate information.
Sensitive data is held within a Computer Aided Dispatch Program or a Records Management System within the iT division ofthe Ripon Police Department. The sensitivity af data with ail vther City departments is determined by supervisors.
Findings
F5. 1 It is unclear in the City of Ripon' s Organization Chart where responsibiiities for IT and IT security lie, creating confusian over who is responsibfe to act in a disruptive event.
F6. 2 7fie City of Ripon has a rudimentary netwark diagram outlining the City' s router and firewall relationship with networks used, but the diagrarn lacks detaii, leaving unce tainty about data security.
F6. 3 Although the City of Ripon met expectations in the areas of data confidentiality and security, lack of iT staff and leadership leaves these areas vuinerable to cyberattack.
F6. 4 The City of Riport tacks a Business Cantinuity PEan, rendering the City relatively unprepared to restore essential servltes in a disruptive event.
F6. 5 The City of Ripon does nat have a Oisaster Preparedness Plan, leaving the City at risk for signifrcant delay and cost to restore IT systerns in the event of a disaster.
F6, 6 The City of Ripon tEaes not have a formal policy or procedure to address ansamware attacks. This absence of policy could cause canfusion, delay and greater loss of security in the event of an attack.
12 Recommendations
R6. 1 ByJanuary 1, 2023, the Ripon City Council develop and ma[ce public an updated City Organization chart showing details of the City' s { T functions, including all IT positions.
R6. 2 SyJanuary 1, 2023, the Ripon City Council develop and adopt a detailed Network Diagram to decrease security vulnerabilities.
R6. 3 By January I, 2023, the Ripon City Council obtain a third-party security review of the City' s IT department assets, positions, and policies and an evaluation of data confidentiality, security systems and protocols.
R6. 4 By lanuary 1, 2d23, the R€pon City Council develop, adopt and implement a formaf Business Continuity Plan.
Rfi. S By January 1, 2023, the Ripon City Counclf develop, adopt and implement a formal Disaster Preparedness Plan for IT functions.
R6. 6 By January 1, z423, the Ripon City Council develop, adopt and implement a formal internal policy and procedure for response ta a ransomware attack.
7. 0 City of Stockton—Discussion
The City of Stockton has a large IT department that oversees IT functions for all the City' s other departments. Data confidentiality and user access are determined departmentally, following uniform standards. tnformation is protected by many safeguards aiming not only to minimize risk of penetratian but also to detect any breach that might occu. Stockton has both a BCP and a DPP.
Stockton is ane of very few cities having license to use a cybersecurity tool integrating the City with the State of California' s OfFice of Emergency Services. Stockton' s IT Director meets weekly with other department heads, updating them on a!I matters related to cybersecurity.
Stockton met each of the cybersecurity expectations except for the presence of a documen#ed internal policy and pr cedure for respanse to a ransomware attack. However, the City does have a Cybersecurity Response Book detailing response procecEures for other cyber events. Employee security awareness training is required every six manths.
Findings
F7. 1 The City of Stockton does not have a formal internal policy concerning payments or procedures in ransomware attacks. This absence of policy could cause confusion, delay and greater loss of security in the event of an attack.
F7. 2 7he Ciry of Stackton has a large iT Department which places cybersecurity and disaster preparedness at a high priority, minimizing risk to the City' s information and service systems. 13 Recammendations
R7. 1 By November 1, 2Q22, the Stockton City Council, in conjunction with the City` s IT department, develop, adopt and implement a formal internal policy and procedure far response to a ransomwa e attack.
8.0 City of Tracy—Discussion
The City of Tracy met all expectations for cybersecurity or was in the process of ineeting them when surveyed. The City has an lnformation Technology Division, which is part af the Finance Department. This division supports all departments and functions of the City except water treatment. Data canfidentiality and security are guaranteed with industry-leading, next-generation firewails and network access cantrols. Data storage, backup and cybersecurity are manitared continuaNy. The ( T Manager meets every two weeks with all other City department heads to address IT issues, intluding cybersecurity.
Tracy does not require encryption of thumb drives used on City devices, a requirement that is considered a" best practice" by an expert witness.
7racy does not have either a formal Business Continuity Pian ar Disaster Preparedness Plan in place but is in the process af developing both. The BCP was scheduled to be complete in Aprii 2022.
Completion date for the DPP was not specified by the City.
F ndings
F8. 1 Lacking a requirerv ent for encryption af thumb drives used on City devices exposes the City of Tracy to potential data theft and contamination.
F8. 2 The City ofTracy lacks a compieted Business Continuity Plan, Tendering Tracy relatively unprepared to restore essential services in a disruptfve event.
F8. 3 The City of Tracy lacks a comp( eted Disaster Preparedness Pfan, leaving Tracy at risk for delay and cost to restore 1T systems in the event of a disaster.
Recommendations
R8. 1 By November 2, 20Z2, the Tracy City Council, in canjunctian with the IT division, develop, adopt and implement a policy requiring encryptio af thumb drives used on City devices.
R$. 2 By lanuary 1, 2023, the 7racy City Council, in conjunction with t e IT division, develop, adopt and implement a formal Business Continuity Plan.
R8. 3 By January 1, 2023, the Traty City Council provide the Grand 1ury with an updated formal Disaster Preparedness Plan.
I
Conclusion
San Joaquin County is well protected regarding cyhersecurity. The seven cities in the county vary with respect to Grand Jury expectations, most being well secured but( acking de ned p{ans for Business Continuity and IT Disaster Preparedness. Cybersecurity is an evolving concern and requires ongoing efforts by government entities to remain current and vigilant against risks ta their lnformatian Systems.
n this investigation the Grand Jury learned fram cybersecurity experts that# hree key elements lead ta maximum agency cybersecurity:
a dedicated informatian security position within each organization, a" seat at the tabie" with other agency department heads in regular meetings, and a rigorous employee educatian and training program in cybersecurity matters.
Disclaimers
Grand Jury reparts are based on dacumentary evidence and the testimony of swarn ar admonished witnesses, not on conjecture or opinion. However, the G and lury is precluded by law from disclasing suct evidence except upon the specific approva! of the Presiding Judge of the Superior Caurt, or another judge appointed by the Presiding ludge{ Penal Code Section 911. 924. 1( a} and 929}. Similarly, the Grand 1ury is precluded by law from disclasing the identity of witnesses except upon an orcfer of the court for narrowly defined purposes( Penal Code Sections 924. 2 and 429).
Respor se Requirements
California Penal Code Sections 933 and 933. 05 require that spetific responses ta all findings and recommendatians contained in this report be submitted to the Presiding Judge of the San loaquin County Superior Court within 90 days of receipt af the repart.
The San loaquin County Board of Supervisor5 and the City Councils of each city addressed shall respond to al1 findings anti recornmendations specific to their city.
Mail or hand deliver a hard capy of the respanse ta:
Honorable Michael D. Coughlan, Presiding ludge
San Joaquin County Superior Court
180 E Weber Ave, Suite 1306J
Stocktort, California 95202
Alsa, please email a copy of the response to Ms. Trisa Martinez, Staff Secretary tt the Grand 1ury, at Arandiury@sicourts. orR
t5
Attachment B
ty of L DRAFT
O ce ofthe CityAttorl2ey 390 Towne Centre Drive- Lathrop, CA 95330 Phone 209- 941- 7235 Fax 209- 941- 7233
www. ci.lathrop. ca. us
September 13, 2022
Honorable Michael D. Coughlan, Presiding Judge
San Joaquin County Superior Court
180 East Weber Avenue, Suite 1306J
Stockton, CA 95202
Re: Response to Grand Jury Final Report Case No. 0321 ( 2021/ 2022).
Report received by the City of Lathrop on June 15, 2022 Honorable Michael D. Coughlan,
Pursuant to Penal Code Section 933 and 933. 05, this letter is to inform you that on September 12, 2022 at a regularly scheduled City Council Meeting, the City Council of the City of Lathrop reviewed and approved the above referenced Grand Jury Final Report and directed me to write this letter of response on their behalf.
The 2021/ 2022 Grand Jury Final Report found that:
Grand Jury Finding F3. 1: " The City of Lathrop does not employ multifactor authentication universally, leaving City systems more vulnerable to the activities of bad actors."
Grand Jury Recommendation R3. 1: " By November 1, 2022, the Lathrop City Council, in conjunction with the City' s IT department, develop, adopt and implement a procedure for universal multi-factor authentication for access to City data."
City Council Response: The City of Lathrop City Council agrees with Grand Jury Finding F3. 1 and Recommendation R3. 1 and multi- factor authentication security has been implemented and in effect since June of 2022.
Grand Jury Finding F3. 2: " The City of Lathrop provides an unsecured public Wi- Fi network. Misuse of this unsecured network could expose the City to liability risks."
Grand Jury Recommendation R3. 2: " By November 1, 2022, the Lathrop City Council, in conjunction with the City' s IT department, provide a secure public Wi- Fi network."
City Council Response: The City of Lathrop disagrees with Grand Jury Finding F3. 2 and Recommendation R3. 2 because by definition, publicly available Wi- Fi is inherently " unsecured", although this designation is a misnomer because it eludes to an idea that publicly available Wi-Fi can either be secured or unsecured, and that unsecured is less " safe" or more " risky" than secured. Neither are the case. An " unsecured network" only means that such Wi-Fi is publicly available for anyone to use. Wi- Fi networks, either secured or unsecured, cannot merge end- users between those networks. Secured and unsecured networks, and the end-users utilizing either, remain completely isolated from one another; it would be unfeasible for someone with access to only an unsecured Wi-Fi network to also have the ability to gain access to a separate, secured Wi- Fi network.
The commonly perpetuated idea of" risk" associated with the use of an unsecured Wi- Fi network incorrectly shapes such " risk" as something that happens upon an end- user regardless of their use of the unsecured Wi- Fi network, when in reality, risk can develop and potentially increases the more limited an end- user' s understanding of how their digital presence on the internet affects their vulnerability and security. End- users should be encouraged to utilize personal checks and balances to verify the Wi- Fi networks they choose to connect to are verifiable and reputable, that their presence on the internet is not made easily available to be tracked by others, and that they are visiting legitimate websites, in order to further maintain security of their personal data and information.
Publicly available Wi- Fi is a critical asset to cities around the country. Publicly available Wi-Fi provides the public the opportunity to connect to critical and important information equitably and provides a consistent source of access to such information, promoting economic inclusion within the community. The City of Lathrop currently hosts an unsecured public Wi- Fi network entitled " City of Lathrop Guest Cloud 1" and end- users who connect to this network to access the internet must agree to the terms and conditions of its use, and which the public is only able to remain connected to for time increments of thirty ( 30) minute, between 7am and 7pm, seven( 7) days per week.
Grand Jury Finding F3• 3: " The City of Lathrop does not have an approved Business Continuity Plan, rendering the City relatively unprepared to restore essential services in a disruptive event."
Grand Jury Recommendation R3. 3: ` By January 1, 2023, the Lathrop City Council, in conjunction with the City' s IT department, develop, adopt and implement a Business Continuity Plan."
City Council Response: The City of Lathrop has an unwritten Business Continuity Plan but not a written one. The City of Lathrop City Council agrees
with Grand Jury Finding F3. 3 and Recommendation R3. 3 and documentation is anticipated to be complete by January of 2023.
Grand Jury Findin " The City of Lathrop does not have a formal internal policy or procedure to address ransomware attacks. This absence of policy could cause confusion, delay and greater loss of security in the event of such an attack."
Grand Jury Recommendation R3. 4: ` By November 1, 2022, the Lathrop City Council, in conjunction with the City' s IT department, develop, adopt and implement a formal internal policy and procedure for a ransomware attack." City Council Response: The City of Lathrop has an unwritten, internal procedure to address ransomware attacks and, in addition to such, has hired a consultant whom will assist the City in development and implementation of a formal written policy for procedures to address ransomware attacks. The City of Lathrop City Council agrees with Grand Jury Finding F3. 4 and Recommendation R3. 4 and anticipates documentation will be complete by January of 2023.
Grand Jury Finding F3• 5: " The City of Lathrop does not have an insurance policy covering financial losses from a cyberattack, possibly exposing City financial resources."
Grand Jury Recommendation R3. 5: " By January 1, 2023, the Lathrop City Council, in conjunction with the City' s IT department, obtain an insurance policy to mitigate fiscal impact resulting from cyberattack or other critical information system loss."
City Council Response: The City of Lathrop City Council partially agrees with Grand Jury Finding F3. 5 and Recommendation R3. 5 and would like to further clarify that staff confirmed that the City of Lathrop does in fact have cybersecurity insurance coverage, and is currently in discussions with Risk Management to enhance said coverage.
Respectfully submitted,
Salvador V. Navarrete
City Attorney
SVN/trb
Cc: Trisa Martinez at grandjurvC sjcourts. org