County IT director reports upgrades, new staff and stronger cybersecurity posture

The Winneshiek County IT and GIS team updated supervisors on recent upgrades and staffing changes that county IT leaders say have improved reliability and security.

Key changes: The county hired a systems administrator (hired in May), who led a data-center upgrade, completed the purchase of three new server hosts and strengthened the county’s VMware environment. Staff implemented immutable backups (tamper-resistant storage of backups for a 60-day retention window) to mitigate ransomware risk and broadened backup coverage to include key users’ email and files. The team also implemented an automated local-administrator password rotation process to limit the risk from compromised local accounts.

Security and authentication: IT staff described pilot deployment of physical security keys (YubiKey-style hardware tokens) provided at no cost through a statewide program; the keys work for email and Windows logins and can be used with mobile phones. The county also expanded endpoint protection (CrowdStrike) and is working with the Iowa Security Operations Center.

Remote sites and next steps: IT plans wider network improvements for remote county offices, additional VoIP phone consolidations to lower recurring telephone costs, upgrades for a road-department camera system, and an HVAC fix where server equipment is housed (law center data room). Estimated upcoming costs include about $15,000 for data-room HVAC and up to roughly $40,000 for camera upgrades at remote sites.

Board response: Supervisors asked whether the county’s earlier IT assessment grade would improve; the director said the upgrades and added staff would positively affect the county’s assessment and response times. No formal budget vote was held; the IT budget will proceed through the county’s normal review cycle.