HomeMy WebLinkAboutAgenda Report - July 20, 2022 C-22CITY OF
Zo i
CALIFORNIA
AGENDA ITEM C
w
COUNCIL COMMUNICATION
AGENDA TITLE: Approve Response to the 2021-2022 Grand Jury Report Regarding Case No. 0321,
"San Joaquin County and Its Seven Cities: Cybersecurity: Local Defense Against a
Global Threat"
MEETING DATE: July 20, 2022
PREPARED BY: City Manager
RECOMMENDED ACTION: Approve response to 2021-2022 Grand Jury report regarding Case No.
0321, "San Joaquin County and its seven cities: Cybersecurity: Local
Defense against a Global Threat".
BACKGROUND INFORMATION: The Grand Jury issued the attached report on the 2021-2022 San
Joaquin County Grand Jury Case No. 0321, regarding Cybersecurity.
The Grand Jury found Lodi to be the most advanced of all agencies in
the County toward having a mature Cyber Security Plan. However, the Grand Jury did find that Lodi's has not
completed its Business Continuity Plan. As Council is aware, Lodi has begun work on its Continuity Plan and
projects completion in June of 2023.
Council is required by Penal Code section 933(c), to review and approve a response to Grand Jury
Reports. Accordingly, Staff recommends Council approve the response set forth below.
Finding F4.1: The City of Lodi does not have an approved Business Continuity Plan (BCP), rendering
the City relatively unprepared to restore essential services in a disruptive event.
City Response: Lodi agrees with this finding. However, Lodi has begun work on the BCP, and will
have one in place by the end of June of 2023.
Finding F4.2: The City of Lodi has implemented an excellent cyber awareness training program for all
employees minimizing risk to damage from cyberattack.
City Response: Lodi agrees with this finding.
Recommendation R5.1: By July 1, 2023, the Lodi City Council in conjunction with the City's 1. T. Division,
develop, adopt, and implement a Business Continuity Plan.
City Response: Lodi will adopt a Business Continuity Plan by the recommended date.
APPROVED: Steve $C h W a b a u e r
Stephen Schwabauer, City Manager
Approve Response to the 2021-2022 Grand Jury Report Regarding Case No. 0321, "San Joaquin County and Its Seven Cities-
Cybersecurity: Local Defense Against a Global Threat'
July 20, 2022
Page 2 of 2
FISCAL IMPACT: Not applicable.
FUNDING AVAILABLE: Not applicable.
Steve schwabauer
Stephen Schwabauer
City Manager
Janice D. Magdich
Janice D. Magdich
City Attorney
2021-2022 San Joaquin County Grand Jury
San Joaquin County and Its Seven Cities:
Cybersecurity: Local Defense Against a Global Threat
Case #0321
Summary
We hear reports on a daily basis of cyberattacks occurring around the world. These attacks are
becoming increasingly sophisticated, disruptive and expensive. Attacks on government agencies
can disrupt essential services, crippling communities. Agencies small and large are equally
vulnerable. There is an ever-growing demand for stolen data in an underground market.
Compromise of information has proven to be a serious threat on the cyber battleground, both
domestically and internationally. Bad actors hack intelligence, media and essential service systems.
Other disasters such as floods, fires, storms or prolonged power outages can interrupt essential
services if providers' information systems are not adequately secure. According to one expert
witness interviewed by the 2021-2022 Grand Jury, "World War III will be fought in cyberspace, not
on the battlefield."
Grand Jury members are not technical experts but sought to understand the cybersecurity
landscape and local governments' management of their cybersecurity risks and vulnerabilities. In
this investigation of information security of San Joaquin County and its seven cities, the 2021-2022
Grand Jury made a "point in time" assessment of each entity's Information Systems Department
(ISD), focusing primarily on cybersecurity. The Grand Jury considered nine elements of any ISD and,
through research of relevant literature and input from industry experts, established an expected
standard for each of those elements. The Grand Jury then evaluated each of the agencies with
respect to those expectations.
The Grand Jury concluded that San Joaquin County (SJC) has mature and robust security policies
and systems. The County's security architecture provided a model in evaluating each city's systems.
The Grand Jury determined that Escalon, Lodi and Stockton met a lay person's expectations for
cybersecurity but were lacking either a formal Business Continuity Plan (BCP) or Disaster
Preparedness Plan (DPP). Lathrop, Manteca and Tracy were found to have adequate security
systems in place but lack documented plans for both Business Continuity and Disaster
Preparedness. Ripon was found to -need improvement in meeting several of the Grand Jury's
expectations, with lack of personnel being their greatest challenge.
The Grand Jury recommends that the County and affected cities:
• develop, adopt and implement a Business Continuity Plan;
develop, adopt and implement an IT Disaster Preparedness Plan;
• remedy specific cybersecurity risks found in this investigation; and
• the City of Ripon undergo a data system security review by an expert third party to assess the
City's IT systems and protocols.
The Grand Jury recognizes that cybersecurity is a dynamic process, a continually moving target
which needs constant monitoring and updating.
Glossary
Access: The ability and means to communicate with or otherwise interact with a system; to use
system resources to manage information; to gain knowledge of the information the system
contains; to control system components and functions.
• Actor, bad actor, threat actor or attacker: An individual, group, organization or government
that attempts or executes an attack.
• Attack: An intentional attempt to gain unauthorized access to system services, resources or
information; an attempt to compromise system integrity.
• Authentication: The process of verifying the identity or other attributes of an entity (user, process
or device).
■ Authorization: A process of determining, by evaluating applicable access control information,
whether a subject is allowed to have the specified types of access to a particular resource.
* BCP: Business Continuity Plan. A document that sets forth procedures for the continued
performance of core capabilities, critical operations and user services during any disruption or
potential disruption.
CCISDA: California County Information Services Directors Association. This is the official
organization of the county IT directors and chief information officers throughout the state of
California. CCISDA represents all 58 California counties in the area of information technology
in county government. '
CIO: Chief Information Officer.
• Computer Aided Dispatch Systems: Used by dispatchers, call -takers, and 911 operators to
prioritize and record incident calls, identify the status and locations of responders in the field and
effectively dispatch responders.
• Confidentiality: A property of information that is not disclosed to users, processes or devices
unless they have been authorized to access the information.
• Cyber event or incident: An occurrence that actually or potentially results in adverse
consequences to an information system or the information that the system processes, stores or
transmits and that may require a response action to mitigate the consequences. An occurrence
that constitutes a violation or imminent threat of violation of security policies, security
procedures or acceptable use policies.
Cybersecurity: The activity, process, ability, capability or state whereby information and
communications systems and the information contained therein are protected from and/or
defended against damage, unauthorized use, modification or exploitation.
• DPP: Disaster Preparedness Plan. A document that sets forth policies and procedures for
restoration of information systems after a critical incident or event from any source. The plan
addresses interim restoration of information operations in the short and medium term and full
restoration of all capabilities in the longer tern.
• Data integrity: The property that data is complete, intact and trusted and has not been modified
or destroyed in an unauthorized or accidental manner.
• Data security policy: A rule or set of rules that governs the acceptable use of an organization's
information and services to a level of acceptable risk and the means for protecting the
organization's information assets.
• Encryption: The process of converting data into a form that cannot be easily understood by
unauthorized people or agents.
• Firewall: A capability to limit network traffic between networks and/or information systems. A
hardware/software device, or a software program, that limits network traffic according to a set of
rules of what access is and is not allowed or authorized.
■ Hacker: An unauthorized user who attempts to or gains access to an information system.
• ISD: Information Systems Department.
■ IT: Information Technology.
• KnowB4: A proprietary security awareness training platform. KnowB4 is used by agencies for
simulated phishing activities and other email compromise tests, as well as for other IT security
training needs.
• Malware: Software that compromises the operation of a system by performing an unauthorized
function or process.
• Mobile device management tool: A security software tool designed to help organizations
secure, manage and monitor mobile devices such as smartphones and tablets.
• Multi -factor authentication: An electronic authentication mechanism in which a user is
granted access to an application only after presenting two or more pieces of evidence (factors or
keys only the authentic user knows or possesses).
• Multi -layer security access: Multi -layer security refers to a system that uses numerous
components to shield the IT infrastructure. It is a defense mechanism that mitigates, delays or
prevents threats.
• Network or cyber infrastructure: The information and communication systems and services
composed of all hardware and software that process, store and communicate information; any
combination of all these elements.
• Next -generation systems: Security systems consisting of both firewall and intrusion prevention
systems built in, rather than as add-ons, along with the features of basic firewalls.
• Phishing: A digital form of social engineering to deceive individuals into providing sensitive
information.
• Phishing test: A security training exercise designed to test users' vulnerability and reinforce
vigilance.
• Presidential Executive Order 14028: "Improving the Nation's Cybersecurity" (issued May 12,
202 1) requires agencies to enhance their cybersecurity system integrity.
• Ransomware: A type of malicious software designed to block access to a computer system
until a sum of money is paid.
• Ransomware attack response plan: A set of predetermined and documented procedures to
detect and respond to a cyber incident involving demand for ransom for recovery and restoration
of data or systems.
• Records Management System: The management of records for an organization throughout the
records' life cycle.
• Redundancy: Additional or alternative systems, sub -systems, assets or processes that maintain
a degree of overall functionality in case of loss or failure of another system, sub -system, asset or
process. Typically applied to power supplies and data backup systems.
■ Vulnerability: A characteristic or specific weakness that renders an organization or asset (such
as information or an information system) open to exploitation by a given threat or susceptible to
a given hazard.
Wi-Fi network: A family of wireless network protocols used for local area networking of
devices and internet access, allowing nearby digital devices to exchange data by radio waves.
Background
The 2008-2009 San Joaquin County Grand Jury reported on information technology security, finding
that several County departments and two of the seven cities in the county met expectations for
Information Technology (IT) security, while some County departments and five cities did not.
Recommendations were made and generally accepted in agency responses. In terms of technology,
2008-2009 was at least a generation ago. Government agencies use and store vast amounts of
sensitive data on their residents and their employees, including personal identification data,
financial data, health data and legal data. Additionally, these agencies provide services essential to
our day-to-day lives, including public safety (police and fire), public works, health services, water
services and community development. The Grand Jury recognizes that we are lay people, hardly
experts, in the field of IT. It was the intent of the 2021-2022 Grand Jury to examine how the county
and city governments within San Joaquin County are exercising due diligence to protect
information, defend against future cyberattacks, maintain current disaster plans and provide on-
going training to employees in these matters.
Reason for Investigation
As stated in Presidential Executive Order 14028, "...the prevention, detection, assessment and
remediation of cyber incidents is a top priority and essential to national economic security."
San Joaquin County has experienced ransomware and cybersecurity attacks firsthand. School
districts, municipalities and county agencies have been victimized in recent years. Given the rise in
complexity of IT, the current sophistication of cybercrime, and the essential nature of government
services provided, the 2021-2022 Grand Jury undertook an investigation into the current state of
security and disaster preparedness of the IT systems of San Joaquin County and the seven
incorporated cities within the county.
Method of Investigation
The 2021-2022 Grand Jury surveyed six San Joaquin County IT department heads and the City
Manager or City Administrator of each of the seven cities in the county; each responded to the
survey. Subsequently, an agency IT department head or staff member, an IT consultant or a city
administrator was interviewed to clarify responses and to provide additional material when
applicable. The Grand Jury also interviewed independent cybersecurity experts. The expert
witnesses have collectively more than 50 years' experience at diverse levels of government ranging
from county to state to national information systems and cybersecurity. IT executives from one
school district were also interviewed. For this investigation, the Grand Jury interviewed 16
individuals and attended cybersecurity, presentations.
The Grand Jury also reviewed numerous websites and newspaper and magazine articles relevant to
this investigation. Additionally, the Grand Jury reviewed documents provided, including network
diagrams, ransomware insurance policies and other items.
Materials Reviewed
2021-2022 San Joaquin County Grand Jury surveys
• Biden, Joseph. Executive Order on Improving the Nation's Cybersecurity. 12 May 2021.
Executive Order#14028
California Joint Cyber Incident Response Guide. California Office of Emergency Services Cyber
Security Integration Center, 2 Aug. 2021
Cyber Atack Preparedness in Contra Costa County. Contra Costa County Civil Grand Jury,
2021. Report 2104
• Digital Services and Innovation Strategy. San Joaquin County, 19 Nov. 2020
How to Develop a Ransomware Remediation Plan. Rubrik, 2021
Information Technology Security. 2018-2019 Santa Barbara County Grand Jury, 2019
• Information Technology Security: Cities and San Joaquin County. 2008/2009 San Joaquin
County Grand Jury, 2009. Report No.03-08
■ Ransomware Defense for Dummies --2nd Edition. 2nd ed., Cisco Umbrella, 2021
Websites Visited
4 Cybersecurity & Infrastructure Security Agency. "CYBERSECURITY I CISA." Cisa.gov,
Cybersecurity and Infrastructure Security Agency, 2019, www.cisa.gov/cybersecurity. Accessed
6 May 2022.
Federal Trade Commission, and Alvaro Puig. "Cybersecurity Advice to Protect Your Connected
Devices and Accounts." Sjgov.org, 24 Mar. 2022, www.sjgov.org/department/da/consumer-
alerts/consumer-alerts/2022/03/24/cybersecurity-advice-to-protect-your-connected-devices-and-
accounts. Accessed 6 May 2022.
Is Kuykendall, By Kristal. "Cybersecurity Experts Call for More Transparency and Immediate
Resources for Schools -." The Journal, 17 Mar. 2022,
thej ournal.com/Articles/2022/03/17/Cybersecurity-Experts-Call-For-More-Transparency-and-
Immediate-Resources-for-Schools.aspx?Page=1. Accessed 6 May 2022.
Marcum Accounts Advisors. "What Is a SOC 2?" The SSAE 18 Reporting Standard - SOC I -
SOC 2 - SOC 3 (Formerly SSAE 16), 8 Jan. 2022, www.ssae-16.com/faq/what-is-a-soc-2/.
Accessed 30 Apr. 2022.
National Institute for Cybersecurity Careers and Studies. "Cybersecurity Glossary I National
Initiative for Cybersecurity Careers and Studies." NicesAsa.gov, niccs.cisa.gov/about-
niccs/cybersecurity-glossary. Accessed 6 May 2022.
Unisys. "Cyber Attacks --What You Need to Know." Unisys, 2022, www.unisys.com. Accessed 6
May 2022.
Discussions, Findings and Recommendations
General Discussion
The Grand Jury recognizes cybersecurity is an extremely complicated topic. Specialized knowledge,
experience and expertise are required for a deep understanding of what is necessary for adequate
policies, systems and architecture. Lacking such specialized knowledge, the Grand Jury researched
numerous sources, including recognized experts in this field to determine the following elements of
any ISD and to define the following expectations for adequate cybersecurity in today's
environment.
Expectations
• Organization: Each organization should have a detailed Organization Chart demonstrating the
structure of its independent IT department. Cities lacking an independent IT department should
have a chart showing where IT resides in their overall structure.
• Network Diagram: Each organization should have a detailed network diagram indicating the
relationships between all IT architectural elements. Best -practice guidelines suggest that this
diagram be confidential.
• Data Confidentiality: Each organization should have an organization -wide policy determining
data confidentiality and access control. Policy for data access should be clearly defined and desk -
specific or station -specific.
• Data Security: Each organization should have next -generation systems and controls to ensure
both physical and cyber security for all IT assets. Next -generation firewalls and endpoint
management systems provide protection against ever -evolving means of cyberattack. Data
should be protected with daily or continuous backup and archival systems. Backups should be
protected against corruption, external encryption and/or destruction. Agencies should require
multi -factor authentication for access to network systems.
• Business Continuity Plan (BCP): Each organization should have a detailed, current,
comprehensive plan for restoring services in the event of disruption from any source.
• Disaster Preparedness Plan (DPP): Each organization should have a formal, detailed plan to
prepare for various possible IT disruptions. This plan should be tested frequently and updated
regularly.
■ Ransomware Policy: Each organization should have an internal (confidential) documented
policy for agency response to a ransomware attack.
• Cyber Event Insurance: Each organization should have insurance coverage to help offset
economic losses from cyber events.
• Ongoing Employee Training: Each organization should provide rigorous, frequent training and
ongoing testing of all employees as an integral part of its cybersecurity profile.
Survey Results:
The table below indicates whether an agency met (M), did not meet (NM) or was in the process
of meeting (IP) the nine defined expectations.
1.0 San Joaquin County—Discussion
In November 2020, San Joaquin County released a three-year (2020-2023) strategic plan for
ensuring continuing security, efficacy, cost-effectiveness and best -service outcomes to all end-users
of County services and systems. The plan document "San Joaquin County Digital Services and
Innovation Strategy" established goals for County digital service systems. These goals—
Modernizing and Leveraging Our Technology Environment—address objectives for a security
posture:
1. Acquire and implement cybersecurity technology to enable SJC to develop industry-leading
capabilities to help mitigate and address cybersecurity risk.
2. Develop and mature security governance and processes to meet or exceed industry standards,
enhance security enforcement partnerships, and strengthen County practices.
3. Develop a robust security training program for the County workforce, including enhanced
training and development for the security workforce.
Excerpt from "San Joaquin County Digital Services and Innovation Strategy," November 19, 2020 (page 6)
San Joaquin County has met these objectives and continues to update and enhance these processes as
the cybersecurity landscape continues to evolve.
Org
Chart
Network
Diagram
Data
Confidentiality
Data
Security
BCP
DPP
Ransomware
Policy
Cyber
Insurance
Training
SJC
M
M
M
M
M
M
NM
M
M
Escalon
M
M
M
M
NM
M
M
M
M
Lathrop
M
M
M
M
NM
M
NM
NM
M
Lodi
M
M
M
M
IP
M
M
M
M
Manteca
M
M
M
M
M
M
IP
IP
M
Ripon
M
M
M
M
NM
NM
NM
M
M
Stockton
M
M
M
M
M
M
NM
M
M
Tracy
M
M
M
M
IP
IP
NM
M
M
1.0 San Joaquin County—Discussion
In November 2020, San Joaquin County released a three-year (2020-2023) strategic plan for
ensuring continuing security, efficacy, cost-effectiveness and best -service outcomes to all end-users
of County services and systems. The plan document "San Joaquin County Digital Services and
Innovation Strategy" established goals for County digital service systems. These goals—
Modernizing and Leveraging Our Technology Environment—address objectives for a security
posture:
1. Acquire and implement cybersecurity technology to enable SJC to develop industry-leading
capabilities to help mitigate and address cybersecurity risk.
2. Develop and mature security governance and processes to meet or exceed industry standards,
enhance security enforcement partnerships, and strengthen County practices.
3. Develop a robust security training program for the County workforce, including enhanced
training and development for the security workforce.
Excerpt from "San Joaquin County Digital Services and Innovation Strategy," November 19, 2020 (page 6)
San Joaquin County has met these objectives and continues to update and enhance these processes as
the cybersecurity landscape continues to evolve.
San Joaquin County ISD oversees all County departments, making it one of the largest county ISDs
in California. San Joaquin County ISD is an active participant in the California County Information
Systems Department Association (CCISDA). This association provides opportunities for counties to
share information and experiences and offers guidance, such as standards for best -practice policies.
Several large and specialized departments within the County have their own IT departments and
department chiefs who report to the County's Chief Information Officer. Additionally, SJC has a
dedicated Information Security Officer. All these IT executives form a cybersecurity governance
committee which meets monthly, with subgroups meeting more frequently as needed.
County ISD and Human Resource Departments conduct frequent and on-going employee training
and testing using proprietary software. In addition to these County departments, several Independent
Special Districts in SJC use County IT services through various memoranda of understanding.
The only element of the defined expectations not met by SJC is having an internal documented
policy for response to a ransomware attack.
San Joaquin County is a model agency in the realm of information technology and maintenance of
cybersecurity.
Findings
F1.1 San Joaquin County does not have a formal internal policy concerning payments or
procedures in ransomware attacks. This absence of policy could cause confusion, delay and greater
loss of security in the event of such an attack.
F1.2 San Joaquin County has an exemplary profile regarding cybersecurity and should serve as a
model for other government agencies within San Joaquin County.
Recommendations
R1.1 By November 1, 2022, the San Joaquin County Board of Supervisors, in conjunction with San
Joaquin County ISD, develop, adopt and implement a formal internal policy and procedure for
response to a ransomware attack.
2.0 City of Escalon—Discussion
The City of Escalon does not have an independent IT department but has a contract agreement
with Mid Valley IT to provide all IT services. In the City organization, IT functions report to the
Finance and HR Directors. Each employee is given a level of access according to assigned
responsibilities within their department. All employees receive information security training
specific to their responsibilities as well as general security awareness training. The IT consultant
employs an aggressive multi -layered approach to mitigate security threats through software and
hardware protection measures. Critical or confidential data is stored in multiple cloud -based
locations and systems employing numerous safeguards, including use of multi -factor
authentication for access.
IT functions are protected with a standby generator and redundant backups in case of a system
failure. The generator is tested periodically for functionality.
The City of Escalon met all but one of the expectations for adequate cybersecurity. Escalon is by far
the smallest city in San Joaquin County, but by using a contracted IT service provider, Escalon is
meeting its cybersecurity needs. The City of Escalon does not have a documented Business
Continuity Plan.
Findings
F2.1 The City of Escalon does not have a documented Business Continuity Plan, leaving the City
relatively unprepared to restore essential services in a disruptive event.
Recommendations
R2.1 By January 1, 2023, the Escalon City Council, in conjunction with Mid Valley IT, develop,
adopt and implement a Business Cohtiriuity Plan,
3.0 City of Lathrop—Discussion
The City of Lathrop met six of the expectations for the nine elements considered in this
investigation. Lathrop's IT organization includes a Director of Information Technology at the cabinet
leadership level, a policy strongly recommended by an IT expert for maximum IT security. Including
the Director of IT in frequent, regular meetings with other department heads allows effective
communication of IT security needs to all City departments.
Expectations for data confidentiality and data security were met. However, use of multi -factor
authentication for system access was not universal at the time of this investigation, leaving Lathrop
at higher risk of attack. Lathrop provides an unsecured public Wi-Fi network, separate from the
City's secure business network and accessible to any user. Hackers or other bad actors could take
advantage of the unsecured network, possibly resulting in compromise of log -in credentials from
that network and possibly exposing the City to costly liability suits. Lathrop was in the process of
developing and approving a BCP and DPP plan at the time of this investigation. Similarly, the City
was updating an internal policy for response to a ransomware attack. At the time of this
investigation, Lathrop lacked insurance against losses incurred in a cybersecurity incident.
Findings
F3.1 The City of Lathrop does not employ multi -factor authentication universally, leaving City
systems more vulnerable to the activities of bad actors.
F3.2 The City of Lathrop provides an unsecured public Wi-Fi network. Misuse of this unsecured
network could expose the City to liability risks.
F3.3 The City of Lathrop does not have an approved Business Continuity Plan, rendering the City
relatively unprepared to restore essential services in a disruptive event.
F3.4 The City of Lathrop does not have a formal internal policy or procedure to address
ransomware attacks. This absence of policy could cause confusion, delay and greater loss of
security in the event of such an attack.
F3.5 The City of Lathrop does not have an insurance policy covering financial losses from a
cyberattack, possibly exposing City financial resources.
Recommendations
R3.1 By November 1, 2022, the Lathrop City Council, in conjunction with the City's IT
department, develop, adopt and implement a procedure for universal multi -factor authentication
for access to City data.
R3.2 By November 1, 2022, the Lathrop City Council, in conjunction with the City's IT
department, provide a secure public Wi-Fi network.
R3.3 By January 1, 2023, the Lathrop City Council, in conjunction with the City's IT department,
develop, adopt and implement a Business Continuity Plan.
R3.4 By November 1, 2022, the Lathrop City Council, in conjunction with the City's IT
department, develop, adopt and implement a formal internal policy and procedure for a
ransomware attack.
R3.5 By January 1, 2023, the Lathrop City Council, in conjunction with the City's IT department,
obtain an insurance policy to mitigate fiscal impact resulting from cyberattack or other critical
information system loss.
4.0 City of Lodi—Discussion
The City of Lodi has a large IT division, responsible for all IT functions of the City. The division is
responsible for the integrity of the City's cyber infrastructure, maintenance and support of all
hardware and software, and assuring secure access to all network resources. Lodi fell victim to a
ransom attack in April 2019. That unfortunate event caused the City to change its management of
cybersecurity, significantly elevating the importance of vigilance by all City staff. Lodi has
implemented a robust cyber awareness training program for all City employees, incorporating
education in tactics used by bad actors both inside and outside the City's network. Monthly training
is followed by testing in topics covered. Citywide campaigns occur quarterly to test employee
response to phishing and other email -based attacks. The IT division head reports directly to the
Deputy City Manager and meets regularly with all City department heads. The City of Lodi met all
expectations for cybersecurity except for having a completed, up-to-date Business Continuity Plan.
The City has contracted a business consulting firm to create a BCP, projected to be completed and
implemented by the end of June 2022.
10
Findings
F4.1 The City of Lodi does not have an approved Business Continuity Plan, rendering the City
relatively unprepared to restore essential services in a disruptive event.
F4.2 The City of Lodi has implemented an excellent cyber awareness training program for all
employees minimizing risk to damage from cyberattack.
Recommendations
R4.1 By January 1, 2023, the Lodi City Council, in conjunction with the City's IT division, develop,
adopt and implement a Business Continuity Plan.
5.0 City of Manteca7Discussion
The City of Manteca met seven of the nine expectations considered in this investigation. Manteca's
Information Technology department is independent in the City's organization. The department
director reports directly to the City Manager and meets weekly with other City department heads.
User level of access is determined by position, background and other departmental factors.
Employees are trained on a regular basis. The training is mandatory for all employees. Hard drives
are encrypted, and a Mobile Device Management tool is used for tablets, laptops and phones.
Manteca's ISD is currently updating its Information Technology Security Policy. This comprehensive
policy has not been updated since 2010. Manteca's Department of Information Technology and
Innovation is collaborating with City administration and the City Attorney to update all policies
relating to information technology security. Similarly, the City is in the process of bringing both
hardware and software systems up to next -generation standards with new firewall, malware, user
access, backup systems and applications in place. Employee training is executed through KnowB4,
an industry -standard cybersecurity training program which includes phishing and other email
compromise testing.
Regarding firewalls and switches, roughly 60% still operate off single rather than dual or redundant
power supplies. Over the next five years, the City is phasing out older devices as they reach end -of -
life.
Findings
F5.1 The City of Manteca has an Information Technology Security Policy which has not been
updated since 2010, leaving the City relatively unprepared for a cyber event.
F5.2 The City of Manteca lacks a policy and procedure for ransomware attacks. This absence of
policy could cause confusion, delay, and greater loss of security in the event of such an attack.
F5.3 The City of Manteca has a significant number of security devices with single power supplies.
This lack of redundant power presents vulnerability in major or prolonged power outages.
11
Recommendations
IRS. 1 By January 1, 2023, the Manteca City Council, in conjunction with the City's ISD, develop,
approve and implement an updated Information Technology Security Policy.
R5.2 By January 1, 2023, the Manteca City Council, in conjunction with the City's ISD, develop,
approve and implement a confidential policy and procedure for response to a ransomware attack.
R5.3 By March 1, 2023, the Manteca City Council, in conjunction with the City's ISD, develop,
approve and adopt an updated timeline to replace single -powered units with dual -powered or
redundant -powered units in their network architecture.
6.0 City of Ripon -Discussion
The City of Ripon has experienced turnover and vacancies in the IT Department in the past year.
The Director of IT resigned in early 2021. Subsequently, another IT Director was hired but resigned
within three months. The City has contracted with a former IT employee as a temporary IT Director
and is currently updating the job description for a permanent director of the IT functions.
The City's organization chart does not include an IT department or department head. The only IT
position shown is within the Police Department.
Data confidentiality is maintained through a three -tiered access structure. Management
supervisors for each City department determine who has access to appropriate information.
Sensitive data is held within a Computer Aided Dispatch Program or a Records Management
System within the IT division of the Ripon Police Department. The sensitivity of data with all other
City departments is determined by supervisors.
Findings
F6.1 It is unclear in the City of Ripon's Organization Chart where responsibilities for IT and IT
security lie, creating confusion over who is responsible to act in a disruptive event.
F6.2 The City of Ripon has a rudimentary network diagram outlining the City's router and firewall
relationship with networks used, but the diagram lacks detail, leaving uncertainty about data
security.
F6.3 Although the City of Ripon met expectations in the areas of data confidentiality and
security, lack of IT staff and leadership leaves these areas vulnerable to cyberattack.
F6.4 The City of Ripon lacks a Business Continuity Plan, rendering the City relatively unprepared
to restore essential services in a disruptive event.
F6.5 The City of Ripon does not have a Disaster Preparedness Plan, leaving the City at risk for
significant delay and cost to restore IT systems in the event of a disaster.
F6.6 The City of Ripon does not have a formal policy or procedure to address ransomware
attacks. This absence of policy could cause confusion, delay and greater loss of security in the event
of an attack.
12
Recommendations
R6.1 By January 1, 2023, the Ripon City Council develop and make public an updated City
Organization chart showing details of the City's IT functions, including all IT positions.
R6.2 By January 1, 2023, the Ripon City Council develop and adopt a detailed Network Diagram
to decrease security vulnerabilities.
R6.3 By January 1, 2023, the Ripon City Council obtain a third -party security review of the City's
IT department assets, positions, and policies and an evaluation of data confidentiality, security
systems and protocols.
R6.4 By January 1, 2023, the Ripon City Council develop, adopt and implement a formal Business
Continuity Plan.
R6.5 By January 1, 2023, the Ripon City Council develop, adopt and implement a formal Disaster
Preparedness Plan for IT functions.
R6.6 By January 1, 2023, the Ripon City Council develop, adopt and implement a formal internal
policy and procedure for response to a ransomware attack.
7.0 City of Stockton—Discussion
The City of Stockton has a large IT department that oversees IT functions for all the City's other
departments. Data confidentiality and user access are determined departmentally, following
uniform standards. Information is protected by many safeguards aiming not only to minimize risk of
penetration but also to detect any breach that might occur. Stockton has both a BCP and a DPP.
Stockton is one of very few cities having license to use a cybersecurity tool integrating the City with
the State of California's Office of Emergency Services. Stockton's IT Director meets weekly with
other department heads, updating them on all matters related to cybersecurity.
Stockton met each of the cybersecurity expectations except for the presence of a documented
internal policy and procedure for response to a ransomware attack. However, the City does have a
Cybersecurity Response Book detailing response procedures for other cyber events. Employee
security awareness training is required every six months.
Findings
F7.1 The City of Stockton does not have a formal internal policy concerning payments or
procedures in ransomware attacks. This absence of policy could cause confusion, delay and greater
loss of security in the event of an attack.
F7.2 The City of Stockton has a large IT Department which places cybersecurity and disaster
preparedness at a high priority, minimizing risk to the City's information and service systems.
13
Recommendations
R7.1 By November 1, 2022, the Stockton City Council, in conjunction with the City's IT
department, develop, adopt and implement a formal internal policy and procedure for response to
a ransomware attack.
8.0 City of Tracy—Discussion
The City of Tracy met all expectations for cybersecurity or was in the process of meeting them
when surveyed. The City has an Information Technology Division, which is part of the Finance
Department. This division supports all departments and functions of the City except water
treatment. Data confidentiality and security are guaranteed with industry-leading, next -generation
firewalls and network access controls. Data storage, backup and cybersecurity are monitored
continually. The IT Manager meets every two weeks with all other City department heads to
address IT issues, including cybersecurity.
Tracy does not require encryption of thumb drives used on City devices, a requirement that is
considered a "best practice" by an expert witness.
Tracy does not have either a formal Business Continuity Plan or Disaster Preparedness Plan in place
but is in the process of developing both. The BCP was scheduled to be complete in April 2022.
Completion date for the DPP was not specified by the City.
Findings
F8.1 Lacking a requirement for encryption of thumb drives used on City devices exposes the City
of Tracy to potential data theft and contamination.
F8.2 The City of Tracy lacks a completed Business Continuity Plan, rendering Tracy relatively
unprepared to restore essential services in a disruptive event.
F8.3 The City of Tracy lacks a completed Disaster Preparedness Plan, leaving Tracy at risk for
delay and cost to restore IT systems in the event of a disaster.
Recommendations
R8.1 By November 1, 2022, the Tracy City Council, in conjunction with the IT division, develop,
adopt and implement a policy requiring encryption of thumb drives used on City devices.
R8.2 By January 1, 2023, the Tracy City Council, in conjunction with the IT division, develop,
adopt and implement a formal Business Continuity Plan.
R8.3 By January 1, 2023, the Tracy City Council provide the Grand Jury with an updated formal
Disaster Preparedness Plan.
14
Conclusion
San Joaquin County is well protected regarding cybersecurity. The seven cities in the county vary
with respect to Grand Jury expectations, most being well secured but lacking defined plans for
Business Continuity and IT Disaster Preparedness. Cybersecurity is an evolving concern and
requires ongoing efforts by government entities to remain current and vigilant against risks to their
Information Systems.
In this investigation the Grand Jury learned from cybersecurity experts that three key elements
lead to maximum agency cybersecurity:
• a dedicated information security position within each organization,
a "seat at the table" with other agency department heads in regular meetings, and
a rigorous employee education and training program in cybersecurity matters.
Disclaimers
Grand Jury reports are based on documentary evidence and the testimony of sworn or admonished
witnesses, not on conjecture or opinion. However, the Grand Jury is precluded by law from
disclosing such evidence except upon the specific approval of the Presiding Judge of the Superior
Court, or another judge appointed by the Presiding Judge (Penal Code Section 911. 924.1(a) and
929). Similarly, the Grand Jury is precluded by law from disclosing the identity of witnesses except
upon an order of the court for narrowly defined purposes (Penal Code Sections 924.2 and 929).
Response Requirements
California Penal Code Sections 933 and 933.05 require that specific responses to all findings and
recommendations contained in this report be submitted to the Presiding Judge of the San Joaquin
County Superior Court within 90 days of receipt of the report.
The San Joaquin County Board of Supervisors and the City Councils of each city addressed shall
respond to all findings and recommendations specific to their city.
Mail or hand deliver a hard copy of the response to:
Honorable Michael D. Coughlan, Presiding Judge
San Joaquin County Superior Court
180 E Weber Ave, Suite 1306J
Stockton, California 95202
Also, please email a copy of the response to Ms. Trisa Martinez, Staff Secretary to the Grand Jury,
at grandiurV@s�rts.org
15
CITY COUNCIL CITY OF Stephen Schwabauer
Mark Chandler, Mayor �! City Manager
Mikey Hothi, Mayor Pro Tempore .�i�� Olivia Nashed
Shak Khan �� City Clerk
Doug Kuehne
Janice D. Magdich
Alan Nakanishi
CALIFORNIA City Attorney
July 25, 2022
Hon. Michael Coughlan, Presiding Judge
San Joaquin County Superior Court
180 East Weber Avenue Room 1306J
Stockton, CA 95202
RE: Response to the San Joaquin County Grand Jury Report titled "San Joaquin County and its
Seven Cities: Cybersecurity: Local Defense Against a Global Threat" Case #0321
Dear Judge Coughlan:
The City of Lodi has reviewed the follow-up report to the 2021-20121 San Joaquin County Grand Jury Case No.
0321, regarding Cybersecurity.
As required by Penal Code section 933(c), the Council's comments were approved at the Council's regularly
scheduled meeting of July 20, 2022.
Finding F4.1: The City of Lodi does not have an approved Business Continuity Plan (BCP), rendering the
City relatively unprepared to restore essential services in a disruptive event.
City Response: Lodi agrees with this finding. However, Lodi was already on track to complete a BCP before
this investigation began and will have one in place by the end of June of 2023.
Finding F4.2: The City of Lodi has implemented an excellent cyber awareness training program for all
employees minimizing risk to damage from cyberattack.
City Response: Lodi agrees with this finding.
Recommendation R5.1: By July 1, 2023, The Lodi City Council in conjunction with the City's IT division,
develop adopt and implement a Business Continuity Plan.
City Response: Lodi will adopt a Business Continuity Plan by the recommended date.
The City thanks the Grand Jury for its engagement and review of Cyber Security in San Joaquin County and
appreciates the opportunity to respond to the report. Please feel free to contact us if you have any further
questions.
Respectfully,
Mark Chandler
Mayor
c: Stephen Schwabauer, City Manager
Olivia Nashed, City Clerk
Janice D. Magdich, City Attorney
City Hall, 221 W. Pine Street, Lodi, CA 95240 • (209) 333-6702 / Fax (209) 333-6807 • Lodi gov • cityclerk@lodi.gov
Signature:
•,:Lrh (Jul 11, 2022 09:54 PDT)
Email: jmagdich@lodi.gov
Signature:
....neer (Jul 11, 2022 12:30 PDT)
Email: sschwabauer@lodi.gov