A TRIP TO CYBERIA
As public services become increasingly digital, local governments have become targets for cybercriminals. With this in mind, the Mono County Civil Grand Jury recently found some serious vulnerabilities in the County’s cybersecurity preparedness.
The report, filed March 1 with the Mono County Superior Court, requires the County’s Board of Supervisors to respond to the report 90 days after receiving it. Dr. Christopher Comfort, a member and foreperson of the jury, said response to grand jury reports is typically handled privately.
Jury member Bruce Burton said the County’s biggest problem is that cybersecurity rapidly evolves and requires consistent preparation. The County only recently hired a professional to manage it, and the position was reportedly vacant by the time the Jury filed its findings.
“Cybersecurity is an ongoing battle […] you’re never going to be done,” said “Even if the [County] did everything recommended in the report, there’s going to be another dozen things following that.”
The County’s Information Technology (IT) team lost its part-time Chief Information Security Officer in June 2021, and it only recently filled the position again. According to the report, throughout the position’s vacancy, the County shifted cybersecurity responsibilities to existing IT staff, which created delays in key initiatives and left room for cybervulnerability.
“I don’t know why it took so long [to hire a cybersecurity professional], but I think the county is big enough where having a dedicated cyber person is probably warranted,” Burton said.
Complying with Payment Card Industry (PCI) standards is the best way to stay on top of data breaches.
These standards are developed and required by major credit card brands to dictate how organizations accept payment to protect data. Depending on their business type, businesses must self-assess and report their adherence to PCI standards.
The report claims the County’s IT department was unaware of PCI Compliance requirements and the annual self-reporting process. As a result, the County was using the wrong form when self-assessing compliance with PCI standards and wasn’t conducting quarterly vulnerability scans.
This negligence has risk implications for credit cards in the system, including those used for property taxes.
“Whenever you take credit card payments, you’re taking on some risk that a bad actor could breach your environment and steal that credit card information,” Burton said. “If you meet these requirements, the odds of getting breached are low.”
Burton said that if there is a breach, credit card companies can say the County falsely claimed compliance and impose additional fines or penalties.
Moreover, the County’s self-reporting system is inefficient.
“The form that they happen to be using was the most complex form possible, which is overkill for their environment,” Burton said.
The report also includes more traditional cybersecurity risks, like outdated infrastructure and a lack of backups. Vendors no longer support some of the County’s computers and network devices, so they do not receive crucial security updates, which leaves the County open to cyber intrusions.
The County also lacks backups for critical systems, which could allow a ransomware attack that results in permanent data loss or service outages.
Ransomware typically operates when a threat actor quietly infiltrates an organization’s systems without immediately triggering any alerts. Once inside, the attacker gains persistent access and prepares to encrypt critical production data.
“There’s some pretty critical information the County has for the community,” Burton said. “They have mental health offices that track medical information for people, things like that.”
After encrypting the data, a ransomware attacker delivers a ransom demand — often hundreds of thousands of dollars — with the threat that the encrypted data will remain inaccessible unless payment is made.
Naturally, most organizations’ first line of defense is to restore from backups. However, threat actors have evolved. In many modern ransomware incidents, attackers also locate and encrypt backup systems before initiating the main attack.
Lacking backup, the County would be effectively forced to consider paying the ransom.
The report, created through anonymous staff interviews and documents, does commend the county for its progress in cybersecurity preparedness in accordance with its strategic plan.
The Grand Jury report is available on the Mono County website at https://www.mono.courts.ca.gov/system/files/general/cyber-security-investigation-report.pdf.SUMMER ADVENTURE PASS ON SALE NOWLock in unlimited access at Woolly’s Adventure Summit this summer — including the climbing wall, zip line, bungee trampoline, ropes course, archery, mountain coaster, and tubing. Plus, enjoy Scenic Gondola Rides. Buy now and start using your pass right away for available winter tubing and coaster days.Just $399 — and if you buy by May 31, you’ll score a $50 Resort Credit.GET $
