December 14, 2022
Honorable Michael D. Coughlan, Presiding Judge
Superior Court of California, San Joaquin County
180 E. Weber Ave, Suite 1306J
Stockton, California 95202
Dear Judge Coughlan,
The City of Ripon welcomes the opportunity to respond to the 2021-2022 San Joaquin Grand Jury Case #0321 Report (the “Report”) regarding Cybersecurity. The City of Ripon always welcomes independent review of its information technology systems, and thanks the Grand Jury for its efforts.
The City of Ripon has reviewed the Report and implemented many of its recommendations. The City of Ripon would also like to take the opportunity to address the Report’s specific findings and recommendations.
By way of background, the City of Ripon’s IT Department experienced a significant amount of turnover over the last couple of years. Prior to the beginning of the information gathering stage by the Grand Jury, the City’s only full-time Information Technology Technician that had been in this position for 15 years had resigned. During the information gathering stage, the City had just filled the full-time Information Technology Technician position, but unfortunately this individual resigned shortly after the completion of the information gathering stage because of a lack of the technical skill level and experience to function in this position.
Since the completion of the Grand Jury investigation and as part of the Fiscal Year 2022-23 budget, the City has created a second full-time Information Technology Technician position so there would be overlap in the understanding of department operations in the event an individual resigns in the future.
The City is confident that these measures will address the areas of concern outlined in the Report.
Grand Jury Findings and City Responses:
In responding to the Grand Jury’s Findings, we note each finding and the City of Ripon’s response follows.
F6.1 It is unclear in the City of Ripon’s Organizational Chart where responsibilities for IT and IT security lie, creating confusion over who is responsible to act in a disruptive event.
The City of Ripon respectfully disagrees with this finding for the reasons set forth below.
The IT Department is organized into Information Technology Technician level I and II, with the tier II technician reporting directly to the Lieutenant of the Ripon Police Department. The Police Department’s organizational chart (see attached) depicts the relationship between the two IT positions and the Lieutenant. In a disruptive event it is clear that the technicians within the IT Department, as well as all identified vendors and contractors, respond to, preserve and reinstate functions at the City of Ripon, under the supervision of the Lieutenant.
At this time, both Information Technology Technician positions are filled and both employees have been fully briefed as to the organizational structure.
F6.2 The City of Ripon has a rudimentary network diagram outlining the City’s router and firewall relationship with networks used, but the diagram lacks detail, leaving uncertainty about data security.
The City of Ripon respectfully disagrees with the finding. The City of Ripon has contracted with Waypoint Network Solutions for the last 15 years to assist in creating very detailed diagrams of network structure including documentation on router and firewall settings. Both of the City’s Information Technology Technicians understand these diagrams and work with Waypoint Network Solutions as updates are periodically needed when improvements are made to increase the security of the City’s network.
F6.3 Although the City of Ripon met expectations in the areas of data confidentiality and security, lack of IT staff and leadership leaves these areas vulnerable to cyberattack.
The City of Ripon has addressed this Finding as to staffing following the information-gathering phase of the Report. The City of Ripon has created a second full time position as part of the Fiscal Year 2022-23 budget. The City has filled both full-time positions since the completion of the information-gathering phase.
The City of Ripon respectfully disagrees with the finding regarding lack of leadership. The IT team leader reports directly to the Lieutenant of the Ripon Police Department for status updates and administrative decisions.
F6.4 The City of Ripon Lacks a Business Continuity Plan, rendering the City relatively unprepared to restore essential services in a disruptive event.
The City of Ripon has addressed this finding following the information-gathering phase of this Report. The City of Ripon has drafted a formal plan for business continuity as part of the City’s Network Security Plan (see attached) that was approved by the City Council on December 13, 2022.
F6.5 The City of Ripon does not have a Disaster Preparedness Plan, leaving the City at risk for significant delay and cost to restore IT systems in the event of a disaster.
The City of Ripon has addressed this finding following the information-gathering phase of this Report. Many of the disaster response measures were already in place prior to the informationgathering phase. To avoid the confusion of utilizing multiple plans in the event of a ransomware attack, the City of Ripon has drafted the elements of the disaster preparedness plan as part of the City’s Network Security Plan.
F6.6 The City of Ripon does not have a formal policy or procedure to address ransomware attacks. This absence of policy could cause confusion, delay and greater loss of security in the event of an attack.
The City of Ripon has addressed this finding following the information-gathering phase of this Report. Many of the measures to address a ransomware attack were already in place prior to the information-gathering phase. To avoid the confusion of utilizing multiple plans in the event of a ransomware attack, the City of Ripon has incorporated the elements of the ransomware attack response as part of the Network Security Plan.
Grand Jury Recommendations and City Responses:
In responding to the Grand Jury’s recommendations, we note each recommendation and the City of Ripon’s response follows.
R6.1 By January 1, 2023, the Ripon City Council develop and make public an updated City Organizational Chart showing details of the City’s IT functions, including all IT positions.
The City of Ripon has updated its organizational chart to show the changes made to our current staff positions (see attached).
R6.2 By January 1, 2023, the Ripon City Council develop and adopt a detail Network Diagram to decrease system vulnerabilities.
The City of Ripon already has developed and adopted highly detailed networks diagrams that are kept confidential and secure internally. The City of Ripon recognizes the importance of maintaining network documentation and will continually maintain its network documentation consistent with the Grand Jury’s recommendation.
R6.3 By January 1, 2023, the Ripon City Council obtain a third-party security review of the City’s IT department assets, positions, and policies and an evaluation of data confidentiality, security systems and protocols.
The City of Ripon has obtained the third-party firm “Resolute Guard” to perform an independent review of the City’s IT department assets, which has been completed. The City of Ripon’s IT department has incorporated the recommendations of this third-party review into the operations of the IT department, consistent with the Grand Jury’s findings.
R6.4 By January 1, 2023, the Ripon City Council develop, adopt and implement a formal Business Continuity Plan.
The City of Ripon has conducted an internal review of its network and developed the elements of the business continuity plan as part of the City’s Network Security Plan that is accessible to the IT department and relevant Response Team Members. This plan was adopted by the City Council on December 13, 2022 and will be continually reviewed and updated to stay current and effective with evolving technologies.
R6.5 By January 1, 2023, the Ripon City Council develop, adopt and implement a formal Disaster Preparedness Plan.
The City of Ripon has conducted an internal review of its network and incorporated the elements of the Disaster Preparedness Plan as part of the City’s Network Security Plan previously described.
R6.6 By January 1, 2023, the Ripon City Council develop, adopt and implement a formal internal policy and procedure for response to a ransomware attack.
The City of Ripon has conducted an internal review of its network and incorporated the elements of responding to a ransomware attack as part of the City’s Network Security Plan previously described.
The City of Ripon would like to once again thank the Grand Jury for its effort in their review of the City’s security posture. The City of Ripon agrees that it is vital that all local municipalities implement sufficient safeguards to protect their information systems and continue to supply vital resources to their constituents.
Please contact Kevin Werner, City Administrator at (209) 599-2108 or [email protected] if there is anything further that you require.
Michael Restuccia, Mayor