The City of Dade City is taking actionable steps to strengthen IT security protocols to prevent future data breaches and hacks.
Dade City Commissioners on March 9 voted unanimously to purchase cybersecurity services from Arctic Wolf Networks Inc., to provide managed risk and managed detection and response solutions, in an amount up to $41,901.88.
The action follows a ransomware data security breach that occurred in November, which compromised the city’s website, email systems and online payment systems — which continues to prevent residents from paying utility bills online.
In a February proposal and presentation overview from Arctic Wolf, it was revealed the city’s core systems were down for weeks and other components of the network were affected months after the breach; the attacker had access since April 2020; and, there was a $25,000 deductible for cyber insurance.
The agreement with the Minnesota-based firm will provide log retention for one year, as well as 24/7 monitoring of those logs.
The service also includes monthly vulnerability scanning with recommendations on remediation of detected threats, as well as the ability to allow the firm’s security team to immediately quarantine threats and suspected compromised systems.
The company is described as “the market leader in security operations,” utilizing a “cloud-native security operations platform to deliver security as a concierge service.”
The cybersecurity service was not budgeted in the current fiscal year, however officials felt it vital to now provide additional protection for the IT and security system. A portion of the unanticipated costs can be funded through the city’s GIS analyst vacancy and changes to some existing IT programs. Also, up to $20,000 will be funded from the city’s General Fund contingency.
The decision to ultimately proceed with the purchase came after a recent IT risk assessment by Mandiant, a Virginia-based IT security firm. The firm recommended the city improve its system logging and monitoring, as well as hardening defenses on all systems.
Dade City Manager Leslie Porter underscored the need for the enhanced IT security measures: “Unfortunately, we know the threats will continue coming. We just have to position ourselves in the best way possible,” she said. The city manager also noted additional cybersecurity measures will need to be considered in forthcoming budget years, as well.
Aside from meeting general risk assessment recommendations, the Arctic Wolf package needs to be in place before reestablishing online utility billing payment options for local customers, said Kevin Towne, the city’s IT director. He observed, “When you bring (utility billing) online you’re allowing people to come into your network to see that stuff. I can’t watch it 24/7, that’s what this company will do. It’s 24/7 protection. It doesn’t matter if its midnight on Christmas.”
Towne said the price for the service is reasonable because a comparative package from other cybersecurity companies could have cost upwards of $94,000.
“I don’t think anybody offers a package like them,” Towne said of Arctic Wolf. “They’re providing above and beyond.”
Commissioners recognized the need for enhanced cybersecurity.
“We realized we’ve got to do something,” Commissioner Scott Black said. “We can’t afford to let things like that continue to happen to us.”
Mayor Camille Hernandez agreed that the additional security is the way to go. She also noted: “The price tag, even though it looks high, is a great deal.
“If this is going to get us on the path the progress that we need to see and the utility bill pay and other things, it certainly seems like the right thing to do,” she said.
Published March 31, 2021
