1. Strengthen Your County’s Security Posture Cyber Incident Scenario Joe Frohlich State of Montana – Enterprise Security Manager

2. Accept that this scenario is possible Together we will discuss possible responses No right or wrong answers Use ideas to create or improve incident response plans Cyber Incident Scenario

3. An employee in your County Clerk’s Office received an email in his work account which contained a malicious link. The employee clicked on the link and moments later a pop-up message appeared on his screen telling him all of his files had been encrypted. He has 72 hours to pay $50,000 or the files will be permanently encrypted. The message also warns that any attempt to remove the encryption without the proper key will result in the files being destroyed. Cyber Incident Scenario

4. A short time later county employees start reporting that they are unable to access the county’s recording software. It appears likely that all county records from the Clerk and Recorders system are encrypted. Soon after you receive a phone from a reporter asking about the county systems all being down.

5. What are you going to do first? Who are you going to contact? Who is going to manage the response? Who is going to communicate with the media? Would you pay the ransom?

6. Strengthen Your County’s Security Posture Incident Response Plans Lisa Vasa State of Montana – Security Analyst

7. Create a plan BEFORE you need it Applicable to any type of incident FEMA ICS forms, checklists, and training SITSD Incident Response manual

8. Identify an Incident Commander and backup Identity spokesperson Key staff knows their roles Exercise the plan with tabletop exercises

9. Strengthen Your County’s Security Posture Security Awareness Training Lisa Vasa State of Montana – Security Analyst

10. 95% of incidents are human caused Ransomware & other malware Phishing Poor password management Patch & configuration management Malicious insiders Human errors

11. Training is your best defense Formal training SANS Securing the Human PhishMe CBFree FedVTE

12. Training is your best defense Informal training Posters Newsletters & email Handouts Security minute

13. Strengthen Your County’s Security Posture Questions / Open Forum

14. Dawn Temple: DaTemple@mt.gov Sean Higginbotham: SHigginbotham@cascadecountymt.gov Joe Frohlich: JFrohlich@mt.gov Lisa Vasa: LVasa@mt.gov