State security engineer briefs Legislative Post Audit Committee on mandated ITEC 7230 training

Bob Murphy, security engineer for Legislative Administrative Services, reviewed the state-mandated ITEC 7230 security and awareness training for 2025 during a premeeting briefing to the Legislative Post Audit Committee.

Murphy said the training covers passwords, privacy and data handling, physical security, common cyberattacks and acceptable use of state information systems. "A 14-character password with a mix of letters, numbers, and symbols will take a brute force attack piece of software about 16000000 years to crack," he told the committee to illustrate the agency's password standard.

The training outlined three Kansas data classifications in iTech policy: public, private and restricted. Murphy said restricted and private information must be encrypted when stored locally or on agency-approved portable media, encrypted when transmitted electronically and protected against unauthorized disclosure. He advised against storing restricted data on personal devices and urged staff to collect printed restricted information from printers immediately and to store it in locked drawers or locked rooms.

Murphy reviewed password rules and password management: passwords must be at least 14 characters and include upper- and lower-case letters, numerals and a nonalphanumeric character; the system enforces a 24-password history and a 180-day reset cadence. He noted a Bitwarden password manager is available on state machines and warned against sharing passwords, using sequence or personally identifiable data in passwords or reusing passwords across sites.

On phishing and malware Murphy warned that social-engineering attacks and increasingly sophisticated phishing lures are a top risk for state and local governments. He described how attackers use fake CAPTCHAs and malicious links to gain access, and he explained the differences between worms, viruses and Trojans before describing ransomware as the primary concern for government organizations.

Murphy also reviewed physical-security measures and statutory changes, noting Kansas Senate Bill 172 created criminal offenses for trespass and damage to critical infrastructure and observing the Capitol data center as critical infrastructure. He urged staff to keep badges and keys on their person, to scan badges when entering secure areas and to lock workstations when away from desks.

On acceptable use Murphy said state systems are monitored and discouraged personal use, including campaigning, personal financial transactions and piracy, and warned that automated monitoring will flag potential data leaks (for example, spreadsheets that include Social Security numbers). He reiterated that personal phones and thumb drives are not authorized to connect to the secure state network and said personal devices should use the KS open network instead.

Murphy closed by instructing staff to report suspicious activity to supervisors or the incident response team. He gave two reporting contacts in the meeting: bob.murphy@las.ks.gov and techstaff@las.ks.gov.

Murphy fielded questions from members about the password standard and about large-scale phishing emails tied to Turnpike scams; committee members discussed working with KDOT and the Turnpike Association to get information to constituents.

Ending: The committee then called the formal meeting to order and moved to its audit-selection agenda; staff said Murphy would be available for additional, one-on-one training sessions if members or staff needed them.