County IT consultant presents security and inventory findings; final project list due

Avion (IT consultant, Stronghold) told the Bourbon County Commission on an IT work session that Stronghold’s preliminary assessment found a mix of adequate equipment and significant configuration and lifecycle gaps that increase security risk and operational fragility.

The consultant said the assessment identified needs for network segmentation between the county and city fiber, clearer asset control, reconfiguration of a recently installed firewall, routine patching and a disaster-recovery plan, and remediation of inactive or unsupported machines. "The higher [the risk score] is, the more concerned," Avion said when explaining the report's risk scoring.

The county’s preliminary report lists 266 computers found in the domain and — by Avion’s account — roughly 181 inactive devices that have not checked in recently; it also flagged a set of servers and legacy operating-system instances that cannot be upgraded to current supported versions. Avion told commissioners that Stronghold will map device serial numbers to manufacturing lifecycle data and recommend which workstations can be reallocated, repaired or retired to limit replacement costs.

Why it matters: commissioners oversee county-wide email, network and endpoint security and must prioritize limited budget dollars. Avion said most immediate costs will be for labor and configuration rather than wholesale equipment replacement, and the county will receive a final assessment that will include a prioritized project list and cost estimates.

Most important findings and recommendations

- Network segmentation and security: Stronghold recommended a reconfiguration that separates county and city traffic at the fiber entry point and tighter controls at that gateway. The firm described the planned work as a configuration project that will be scoped and quoted separately. "We're going to do a complete new configuration," Avion said, adding the goal is to protect the county while preserving necessary interoffice communications.

- Vulnerability scanning and remediation: Avion said an initial automated scan found no high-risk vulnerabilities but did identify a tool the team disabled. Stronghold runs monthly scans and will provide reports and remediation guidance.

- Asset inventory and lifecycle: Stronghold reported 266 assets discovered in the domain, including laptops and desktops; the consultant said it will produce a serial-number inventory and a physical audit to confirm which devices remain on site. Avion described a process to physically verify devices and remove inactive entries from the domain.

- Backups and disaster recovery: Stronghold recommended an "air-gap" approach: an on-site backup appliance that snapshots data every four hours and offsite cloud backups for redundancy. The firm said it would document procedures to spin up services in an alternate location if the county loses core systems or Internet connectivity.

- Authentication, patching and Microsoft tenant hygiene: The report includes Microsoft tenant findings and flagged unsupported Microsoft builds on several machines. Avion described a regular patch window (the firm recommends a monthly patch cycle) and monthly and quarterly reporting on tickets, device life cycles and project status.

- Dark-web monitoring and compromised credentials: The assessment included dark-web scans that flagged county email addresses as appearing in external credential lists. Avion said Stronghold will provide incident reports and recommend targeted password resets or other mitigations for identified accounts.

- Telephony and cloud migration options: The consultant discussed Microsoft Teams phone licensing as an option but said licensing and feature needs must be assessed with a proof-of-concept before adopting Teams as a county-wide phone system. He also recommended vendor evaluations and proof-of-concept testing for replacement or consolidation of the courthouse phone menu and call routing.

- Public-safety radio compliance: Avion noted a federal encryption standard referenced in the discussion (described as "256"/AES-256) and said the county should plan for a radio-compliance assessment and budget implications; Stronghold will coordinate with public-safety stakeholders and outside radio vendors for that work.

Commission direction and next steps

Commissioners and the sheriff asked questions during the presentation; commissioners heard that Stronghold will deliver a final assessment and a prioritized project list that will include estimated costs. Avion said the firm expects to supply a more detailed cost estimate soon and will produce a final report that identifies high-priority items and projects.

Operational details and county supports

Avion described Stronghold’s service model: 24/7 support for covered items, projects billed separately with a quoted scope of work, monthly reporting on tickets and a project roadmap. The firm said it will provide disposal services (data erasure and certification) for retired devices and can assist with website and social-media content updates if asked. Avion provided a help-desk number for county staff: (417) 627-9878.

No formal votes or binding policy actions occurred during the work session. Commissioners asked for the final assessment and the project roadmap so they can review budget implications and timing.

Ending: The county will receive Stronghold’s final assessment and project list; commissioners and public-safety officials will use that document to set implementation priorities and budget requests at a future meeting.