Strengthen Your County’s Security Posture Cyber Incident Scenario Joe Frohlich State of Montana – Enterprise Security Manager

Accept that this scenario is possible Together we will discuss possible responses No right or wrong answers Use ideas to create or improve incident response plans Cyber Incident Scenario

An employee in your County Clerk’s Office received an in his work account which contained a malicious link. The employee clicked on the link and moments later a pop-up message appeared on his screen telling him all of his files had been encrypted. He has 72 hours to pay $50,000 or the files will be permanently encrypted. The message also warns that any attempt to remove the encryption without the proper key will result in the files being destroyed. Cyber Incident Scenario

A short time later county employees start reporting that they are unable to access the county’s recording software. It appears likely that all county records from the Clerk and Recorders system are encrypted. Soon after you receive a phone from a reporter asking about the county systems all being down.

What are you going to do first? Who are you going to contact? Who is going to manage the response? Who is going to communicate with the media? Would you pay the ransom?

Strengthen Your County’s Security Posture Incident Response Plans Lisa Vasa State of Montana – Security Analyst

Create a plan BEFORE you need it Applicable to any type of incident FEMA ICS forms, checklists, and training SITSD Incident Response manual

Identify an Incident Commander and backup Identity spokesperson Key staff knows their roles Exercise the plan with tabletop exercises

Strengthen Your County’s Security Posture Security Awareness Training Lisa Vasa State of Montana – Security Analyst

95% of incidents are human caused Ransomware & other malware Phishing Poor password management Patch & configuration management Malicious insiders Human errors

Training is your best defense Formal training SANS Securing the Human PhishMe CBFree FedVTE

Training is your best defense Informal training Posters Newsletters & Handouts Security minute

Strengthen Your County’s Security Posture Questions / Open Forum

Dawn Temple: Sean Higginbotham: Joe Frohlich: Lisa Vasa: