2016-09-06 Services & Organisation Committee Agenda

SERVICES & ORGANISATION COMMITTEE MEETING AGENDA                                     6 SEPTEMBER 2016



REPORTS FOR NOTING BY THE COMMITTEE


7                        UPDATE ON COUNCIL ICT SECURITY
DOCUMENT INFORM AT ION




Author                             ICT Manager, Justin Thomas
                                   Corporate Services Department

Index                              ECM/ Subject/ Information Management Strategies

Attachments                        Nil


EXECUTIVE SUMMARY
The purpose of this report is to update Council on organisational ICT (Information
Communication Technology) security measures following recent media surrounding security
breaches at the state and local government levels.

RECOMMENDATION
That Council note the report by the ICT Manager to the Services & Organisation Committee
Meeting dated 6 September 2016 providing an update on Council’s ICT security measures.


REPORT
1.                       Unauthorised access to Council’s system

In late July 2016 both the Queensland government and then a number of Queensland local
governments were impacted by a malicious electronic social engineering campaign targeted at
securing system login details of unsuspecting users. Social engineering, in the context of
information security, refers to psychological manipulation of people into performing actions or
divulging confidential information.

One Council email account was impacted by the scam following receipt of a state government
email containing a malicious attachment. The Council email account was then used to send the
same malicious email to hundreds of recipients in the email address book. Council ICT staff
secured the affected mailbox within thirty minutes of the email being sent, preventing further
unauthorised access. Council ICT staff also warned all recipients of the malicious email to delete
the email or change passwords if they had opened the link in the email.

The ICT breach at the state government is being investigated by the police. Council ICT provided
details of the Council mailbox access to the Queensland Government Cyber Security Unit to
assist with their investigation. The response to the incident was consistent with the cyber incident
response in Council’s ICT Business Continuity Plan (BCP). The Plan guides Council officers’
response to ICT outages and incidents.

The incident highlights the real and present ICT security risks facing individuals, governments
and organisations across the globe, with financial fraud, identity theft and also data theft and sale
a thriving industry for individuals as well as criminal organisations. As part of Council’s ongoing
ICT security efforts the following activities and programs are in place / are being implemented to
reduce ICT security risk where possible.



                                                                                          Page 41 of 47