2017-10-10 Services & Organisation Committee Agenda

SERVICES & ORGANISATION COMMITTEE MEETING AGENDA                                     10 OCTOBER 2017


REPORTS FOR NOTING BY THE COMMITTEE
8                        UPDATE ON COUNCIL INFORMATION COMMUNICATION TECHNOLOGY (ICT)
                         SECURITY
DOCUMENT INFORM AT ION




Author                             ICT Manager, Justin Thomas
                                   Corporate Services Department

Index                              ECM/ Subject/ Information Management Strategies

Attachments                        Nil


EXECUTIVE SUMMARY
Not applicable.


RECOMMENDATION
That Council note the report by the ICT Manager to the Services & Organisation Committee
meeting dated 10 October 2017 providing an update on Council’s ICT security.


REPORT
The purpose of this report is to update Council on ICT security including recent security incidents.

1.                       Phishing testing and training

Phishing is defined as the attempt to obtain sensitive information such as usernames,
passwords, and credit card details, often for malicious reasons, by disguising as a trustworthy
entity in an electronic communication. Phishing is not just a risk for government and business but
to all individuals utilising electronic communication.

As this is a significant risk for Council an ongoing education program has been established to
inform staff regarding the risks of phishing in order to minimise the risk of the loss of sensitive
information (both public and private).

As part of this program ICT sends random test phishing emails to staff using a commercial
phishing testing solution. The program is structured in such a way that if staff are deceived by the
test emails they are presented immediately with online training with the intention to reduce the
risk of future deception. To date four tests have been conducted, with test results indicating that
the risk of phishing is not reducing via current initiatives and Council will need to continue a
disciplined multifaceted approach to security including awareness, training and technology.

2.                       Service Provider Assurances

Council’s major ICT service providers for cloud and ICT infrastructure have provided assurance
they are certified to the appropriate international Information Security Management Standard
(ISO27001:2013). This certification indicates an organisation has a systematic approach to ICT
security applying a risk management process, control objectives and controls. The certification
provides assurance to Council that our cloud and managed ICT systems are secure.




                                                                                         Page 82 of 84