2016-09-06 Services & Organisation Committee Agenda

SERVICES & ORGANISATION COMMITTEE MEETING AGENDA                               6 SEPTEMBER 2016


2.     Cyber security awareness

Cyber security awareness is an important issue for all staff across the organisation, not only
relating to the use of Council systems but also for personal protection. The key messages being
communicated to Council officers on cyber security awareness are:
 The characteristics and importance of good passwords;
 Not reusing Council passwords for public internet services;
 Examples of malicious emails and what to look for; and
 To contact the ICT helpdesk if they see anything unusual including unexpected invoices.

This information is being communicated to all staff via:
   The monthly emailed ICT Newsletter;
   Posters in common areas;
   ICT staff attending team meetings;
   Information, videos and examples on the Intranet site; and
   Email alerts.

3.     New capabilities

The ICT branch continues to improve security and add new capabilities with recent activities
including:
 Improved email filtering;
 Auditing suspicious account activity, for example mailbox access from overseas;
 Ability to detecting an unusual number of password attempt failures; and
 Auditing of modification of security associated with user accounts.

These capabilities were used to investigate the unauthorised Council mailbox access.

4.     External review of internal ICT security

In December 2015 Council contracted an ICT security company to undertake a systems
penetration test (including external websites). This test involved attempting to gain access to
Council’s systems remotely via technical weaknesses. The test and the resulting
recommendations were used to improve the security of Council systems and were reported to
Council’s audit and risk committee.

A second security review of Council’s ICT internal security was conducted by the same ICT
security company in July 2016. The scope of the review included internal governance, policies,
procedures and internal capabilities. The review has provided a prioritised list of recommended
improvements, with five priority initiatives identified as follows:
 network design changes to better segment the network;
 new security software;
 central logging of messages from network and hardware devices;
 using a software system to manage mobile devices; and
 testing of psychological manipulation of staff for fraud (social engineering tests).




                                                                                      Page 42 of 47