cover
TO: Mayor Richard C. Irvin
FROM: Shanita Thompson, Director of IT Operations
DATE: April 1, 2018
SUBJECT:
Requesting authorization to purchase a cyber security software for the City of Aurora Information Technology Division under the National Intergovernmental Purchasing Alliance (IPA) Technology Solutions contract (130733) from CDW Government, Vernon Hills, Illinois.
PURPOSE:
Cyber security awareness is at an all-time high globally. Many companies and countries understand that cyber threat is one of the most serious economic challenges they face and economic prosperity depends on minimizing cyber threats. It's not a matter of if, but when and how cyber threats will occur. Verizon found public administration was the third most prevalent victim of data breaches of various types, accounting for 12 percent of all breaches behind financial organizations with 24 percent and health-care organizations with 15 percent. According to sources:
- 9 out of 10 had at least 1 breach in the past year
- Ransomware attacks soared from prior year 113%
- Increasing number of zero day attacks
- 32% of organizations report insider crimes are more costly or damaging than incidents caused by outsiders
More problematic, Verizon found, was the period of time public agencies took to discover they’d been breached. In 39 of 66 cases, or nearly 60 percent of the time, their discovery was years in the making. In nine of 66 cases, or nearly 14 percent of the time, discovery took months.
BACKGROUND:
In July 2017, Crowe Horwath cyber security practice performed a penetration test of the City of Aurora network. Crowe provided the following recommendations to improve the organization’s cybersecurity posture:
1) Develop Cybersecurity Strategy:
The City of Aurora should conduct a cybersecurity maturity assessment of the organization in order to understand the organization’s current capabilities and how that aligns with organizational expectations related to IT risk. A roadmap should be developed to demonstrate how cybersecurity risks will be managed to an acceptable level for the organization.
2) Strengthen Password Security:
The City of Aurora should strengthen overall password security. Passwords should not be shared across technologies or accounts, particularly those with different privilege levels. Weak passwords, including default system passwords, should be changed to meet organizational expectations.
3) Improve Vulnerability Management:
The City of Aurora should establish a program to identify out-of-date technology and security updates for existing systems in order to protect the environment from the latest threats.
The City of Aurora should review network folders to confirm they are restricted to only authorized personnel. Sensitive information should not be stored in folders accessible to all authenticated users.
Solutions should be utilized to manage the risk of malicious content on endpoint devices. All devices should have anti-virus software set to scan accessed files in order to minimize the likelihood of a system compromise
The software that is being requested will secure privileged credentials on-premises and in the cloud from every endpoint and application that the City maintains. The solution will secure passwords within an isolated vault on a hardened secure server. It will also provide multiple High Availability (HA) and Disaster Recovery (DR) options and audit capabilities.
DISCUSSION:
The Information Technology Division is currently in the process of optimizing the City's network through consolidation of both the public administration and public safety networks. The cyber security software is a requirement in order to provide the appropriate level of control citywide. This software will be purchased using the National IPA. The National IPA aggregates purchasing volume of participating agencies in order to receive larger volume discounts from suppliers. All master agreements are publicly solicited, awarded, and held by a Principal Procurement Agency. National IPA serves as a government cooperative purchasing organization for agencies nationwide and their agreements are made available to eligible agencies including City and Local Governments.
Staff conducted multiple demos of similar software and the current choice represents the most protection at a competitive price. Due to the confidential nature of this software and the protection it provides details are not provided in this report and doing so could actually reduce the effectiveness of the software.
The approval for purchasing IT security related items was given in 2017 during the 2018 budget process with a decision package. The funds are available in the 2018 Information Technology's account 101-1380-419.64-10 budgeted for the amount of $47,237.24.
IMPACT STATEMENT:
Cyber threats are malicious and could damage equipment, as well as steal personal or financial information. It is imperative the City's information has another layer of security added for today's most common threats.
RECOMMENDATIONS:
It is recommended to purchase the cyber security software from CDW-G, Vernon Hills, IL.
cc: Alderman O’Connor, Chairman
Alderman Mesiacos
Alderman Bugg
Alderman Mervine, Alternate
CITY OF AURORA, ILLINOIS
RESOLUTION NO. _________
DATE OF PASSAGE ________________
title
A Resolution requesting authorization to purchase a cyber security software for the City of Aurora Information Technology Division under the National Intergovernmental Purchasing Alliance (IPA) Technology Solutions contract (130733) from CDW Government, Vernon Hills, Illinois for the amount of $47,237.24.
body
WHEREAS, the City of Aurora has a population of more than 25,000 persons and is, therefore, a home rule unit under subsection (a) of Section 6 of Article VII of the Illinois Constitution of 1970; and
WHEREAS, subject to said Section, a home rule unit may exercise any power and perform any function pertaining to its government and affairs for the protection of the public health, safety, morals, and welfare; and
WHEREAS, the City is in need of a cyber security software for an added layer of security for the network redesign, and
WHEREAS, this software will be purchased using the National Intergovernmental Purchasing Alliance (IPA) Technology Solutions contract (130733) from CDW Government, Vernon Hills, Illinois, and
WHEREAS, the available funds are in the 2018 Information Technology's account 101-1380-419.64-10 budgeted for the amount of $47,237.24.
NOW, THEREFORE, BE IT RESOLVED by the City Council of the City of Aurora, Illinois, as follows: the authorization to purchase a cyber security software for the City of Aurora Information Technology Division under the National Intergovernmental Purchasing Alliance (IPA) Technology Solutions contract (130733) from CDW Government, Vernon Hills, Illinois for the amount of $47,237.24.