Orillia is beefing up the security of its networks in the wake of costly and embarrassing cyber attacks against two area municipalities.
During budget deliberations, city councillors agreed to fund a new position at city hall. The Information Technology Security and Network Analyst carries a price tag of $78,647.
“This is a very, very important position with what’s happening in the world today,” said Coun. Ralph Cipolla, who referenced the attacks locally. “I think it’s really important for cyber security within our municipality.”
In 2018, both Wasaga Beach and Midland had their municipal systems infiltrated via cyber attacks; the Wasaga Beach incident ended up costing that municipality upwards of $250,000.
That is why the position is so important, said Liz Reid, the city’s IT manager.
“I have reviewed several municipal budgets and the expenditures that occurred after their cyber security incidents … the expenditures around those cyber security incidents would offset this type of expense,” Reid told city councillors.
According to a report included in the 2020 operating budget package, “recent cyber attacks and the increase in efforts of cyber criminals to de-fraud municipalities has demonstrated the need to have more internal IT expertise and up-to date knowledge in the area of IT security, firewalls, virus, ransomware, phishing, disaster recovery incident management and secure networking."
The report outlines the changing IT environment that includes:
- New and increased newtwork requirement (Orillia Recreation Centre);
- More cloud-based applications;
- Reliances on third-party vendors;
- Increased IT security threats that require more monitoring and proactive identification and monitoring; and
- Increased requirement to access city systems securely from anywhere.
Hiring an analyst would help city staff provide more expertise in the areas of network, risk management and IT security, the report noted.
This is needed “to ensure strategic IT systems that are being implemented have the necessary controls, risk mitigation and IT security measures to protect the city.”
Coun. Tim Lauer wondered about the need for a full-time position.
Reid said it’s necessary - along with the new backup policies recently enacted, the “investment in a secondary site” and a new firewall.
She said the analyst will “ensure security is in place. There are backups, network monitoring to see possible threats, taking a look at logs to ensure data coming through is legitimate data … there is quite a bit of work on a daily basis around maintaining the security of systems.”
Coun. David Campbell, who works in the IT department for the Township of Severn, said the investment is much needed.
He said it was like paying for “a security guard for the network.”
A majority of councillors agreed.
During budget, council also agreed to invest $41,700 to update the city’s IT network, which includes City Hall, the Municipal Operations Centre, Fire Hall 1 and the Waste Water Treatment Centre.
In addition, councillors agreed to increase the IT’s lease budget by $63,000 to:
- Replace and update 15 servers that will no longer receive secuirty updates
- Replace 146 computers;
- Replace critical network security components to reduce the risk to systems, data and services in the event of an emergency or incident.
All decisions made during budget deliberations are subject to ratification at a special meeting of council Dec. 9.