Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
IT director briefs council on external cybersecurity audit and remediation steps
Summary
IT Director Thomas Sanchez summarized an external cybersecurity audit that found strong admin-account hygiene and patched Windows systems but flagged legacy systems, password-policy weaknesses, and mail-server/DNS issues; staff outlined ongoing remediation, longer passwords, SPF/DMARC implementation and planned retest.
City IT Director Thomas Sanchez presented an executive-summary briefing of a cyber security audit conducted July 22'August 1 by Artifice Security and described remediation steps underway.
Sanchez said external testing showed solid protections in several areas (administrator accounts, patched Windows systems, and firewall configurations) but identified vulnerabilities tied to older operating systems and legacy equipment. Key findings reported to council included an older docking station used for body cameras, legacy financial software that will be replaced, and a hosted mail server migration that is nearly ready but has not yet been cut over. Sanchez said the city is increasing password minimums (administrator passwords to 16 characters and certain hardware admin passwords to 20 characters), evaluating SMB signing (which can slow network performance), and moving toward DNS/email authentication with SPF and a DMARC record (DKIM is under consideration and may require a hosted service).
Sanchez said two-factor authentication is being considered for access from outside the municipal network and that some issues will be resolved by equipment upgrades (for example, new body cameras). Staff reported they are eligible for a focused retest after remediation. Council asked about patch-management, and Sanchez said the city uses ManageEngine Endpoint Central and AuditPlus for compliance and patch tracking; one department (streets) was caught mid-cycle during the audit and lacked recent patches, which staff are addressing. Sanchez said the audit included an external dark-web scan that identified some reused or compromised credentials; staff have begun remediating accounts and tightening notifications so administrators see critical alerts immediately.
Sanchez offered to present the full 70-page report in a work session or one-on-one for council members; staff said budget requests already include replacement of older servers and software as part of remediation planning.
