HomeMy WebLinkAboutItem #10 Approval of Proposed Inter-Governmental Agreement with the U.S. Department of Homeland Security for Cyber-Security Services ocoee
florida
AGENDA ITEM COVER SHEET
Meeting Date: January 3, 2017
Item # /0
Reviewed By: / /
/
Contact Name: Al Butler, Support Services Department Director: ' ��'
Contact Number: 407-554-7063 City Manager: / / /'Subject: Proposed inter-governmental agreement with the U.S. Department of Homeland Security for
cyber-security services.
Background Summary:
The city is a member of the Multi-state Information Sharing and Analysis Center (MS-ISAC), which is
funded by the U.S. Department of Homeland Security. The city is also involved in other programs
involving the U.S. Secret Service and the Federal Bureau of Investigation, in addition to local and
regional organizations involved in cyber-terrorism, both foreign and domestic. These various programs
inter-operate with our own internal controls and devices, in addition to those of the companies that
provide telecommunications services to the city, such as CenturyLink and Spectrum (nee Bright House
Networks) to protect the city from damaging attacks.
One problem with these various protections is that we cannot determine their effectiveness until they fail
to protect the city from a denial of service attack, virus, Trojan horse, or direct attempts to enter the
secure network and commit crimes, like corrupting our data, encrypting the data and holding it for
ransom, posing as a city employee to commit other acts, and numerous other offenses. In order to test
the city's network, data, and device security in a safe and structured manner, the U.S. Department of
Homeland has offered to install software, train staff in its use, and conduct the initial assessment of the
city's computer resources and telecommunications network. This work will be done onsite without cost to
the city.
The city will need to become a member of the Protected Critical Information Infrastructure (PCII)
Program prior to executing the agreement. Due to the nature of these investigations, the methods and
results affiliated with PCII are protected from public disclosure. Many of the communications and
technical documents provided by MS-ISAC and other cyber security organizations are also subject to
federal security laws and may not be disclosed. Portions of the proposed agreement have been
redacted in compliance with these requirements.
Issue:
Should the City Commission approve an inter-governmental agreement with the U.S. Department of
Homeland Security to conduct threat assessments of the city's computer network?
1
Recommendations
Staff recommends the City Commission approve the proposed inter-governmental agreement and the
city's participation in the Protected Critical Information Infrastructure (PCII) Program. Staff additionally
recommends that the City Manager or his designee be authorized to enter similar future agreements with
federal and state agencies to augment the city's capabilities to detect and resist cyber threats; the Mayor
should be authorized to execute any agreements necessary to implement this recommendation.
Attachment:
Proposed inter-governmental agreement (portions redacted).
Financial Impact:
There is no cost to the city for the proposed services.
Type of Item: (please mark with an Y)
Public Hearing For Clerk's Dept Use:
Ordinance First Reading X Consent Agenda
Ordinance Second Reading Public Hearing
Resolution Regular Agenda
X Commission Approval
Discussion&Direction
Original Document/Contract Attached for Execution by City Clerk
X Original Document/Contract Held by Department for Execution
Reviewed by City Attorney N/A
Reviewed by Finance Dept.
N/A
Reviewed by —
N/A
Reviewed by N/A
2
DOCUMENT VERSION 3.0-6/22/2016
CYBER HYGIENE
Authorization to Conduct Continuous Scans of Public-Facing Networks and Systems
The National Cybersecurity & Communications Integration Center (NCCIC) of the Department of
Homeland Security (DHS), under authority of the Homeland Security Act (6 U.S.C. § 101 et seq., esp. 6
U.S.C. § 148) would like to gain authorization from City of Ocoee
( Ocoee) to conduct continuous network and vulnerability scanning of Ocoee 's publicly accessible
networks and systems.
The goals of these activities are to:
1. Catalog Ocoee 's publicly accessible networks and systems, including services running and
version/patch levels
2. Identify vulnerabilities on Ocoee 's publicly accessible networks and systems
3. Identify potential configuration issues with Ocoee 's public facing networks and systems
4. Maintain tactical awareness of the operational risks and cyber health of individual entities
5. Inform the government's common operational view of cyberspace
6. Integrate relevant information, analysis, and vulnerability assessments, in order to identify
priorities for protective and support measures regarding potential or actual threats
7. Provide"early warning"of specific actionable vulnerabilities to Ocoee
DHS activities will originate from IP addresses that will be made known to (Ocoee ), DHS will also notify
Ocoee should the IP addresses change.
Scanning will be openly attributable to the authorized scanning source, and should be detected by
Ocoee 's network monitoring solutions. Connections and data will be sent to Ocoee 's publicly facing
networks and systems. The process has been designed to be as non-obtrusive as possible—scheduling,
intensity and frequency have been carefully planned to minimize the possibility of service disruption.
Activities under this authorization will be limited to scanning; no attempts to connect to Ocoee 's
internal network, penetrate Ocoee 's systems, or monitor Ocoee 's network traffic will be made under
this authorization.
NOTE: If a third-party, such as a Managed Security Services Provider (MSSP) or Security Operations
Center (SOC), operates or maintains Ocoee 's public and/or leased IP range, make sure that such third
parties are promptly notified and authorize in writing the scanning activity. Forward the written third-
party authorization along with Ocoee 's authorization to the DHS Point of Contact listed below. If any
such third party should fail to authorize in writing the scanning activity, promptly notify the DHS point of
contact listed below.
1
`\
DOCUMENT VERSION 3.0-8/22/2016 t 1 Q\
In a separate Appendix to this authorization Ocoee will provide: the point of contact for activities
performed under this authorization; an email address for the delivery of reports;the public IP addresses
relating to this activity; and any other relevant information. Ocoee may provide updates to this
information from time to time, in writing.
DHS acknowledges that Ocoee may withdraw this authorization at any time for any reason.
The DHS Point of Contact for this activity can be reached at NCATS info @hq.dhs.gov.
By signing below,the approving Ocoee official agrees to the following:
Ocoee authorizes DHS to conduct the scanning activities described above;
▪ Ocoee agrees to promptly notify and secure written authorization for the scanning activities
described above from any third-party, such as a MSSP or SOC, that operates or maintains
Ocoee's public and/or leased IP range,and to forward that authorization to DHS;
• Ocoee accepts that, while DHS teams will use their best efforts to conduct scans in a way that
minimizes risk to Ocoee's systems and networks,the scanning activities described above create
some risk of degradation in performance to Ocoee's systems and networks;
• Ocoee accepts all risks to its systems and networks for the activities described above;
• Ocoee acknowledges that DHS provides no warranties of any kind relating to any aspect of the
assistance provided under this authorization;
Ocoee accepts the risk of any damage that may result from implementing any guidance
provided by DHS;
• Ocoee hereby holds harmless the U.S. Government and those acting on its behalf from any and
all claims arising out of or in any way related to this authorization;and
• Ocoee has authorized you to make the above certifications on its behalf.
Signature:
Name: Rusty Johnson Date: 1/3/2017
Title: Mayor
Entity: City of Ocoee
City: Ocoee County: Orange State: Florida
2
DOCUMENT VERSION 3.0-8/33/3016
Appendix A
Authorization to Conduct Continuous Scans
of Public-Facing Networks and Systems
Ocoee provides the following information to facilitate the authorized scanning activities:
Please provide a technical point of contact at Ocoee for the NCCIC team to follow-up with:
Name: John Haas
Email: jhaas @ocoee.org
Phone: 407 554-7119
We recommend your organization create/use a distribution list email address to receive our reports.
This allows your organization to manage the recipients of our report. We will only deliver reports to a
single address.
Distro email: helpdesk @ocoee.org
Your report will be encrypted with a password which we will provide to you. How would you like this
password delivered (select one)?
cPhone(tech POC) @ Email
Text/SMS Tech POC
nom sm.
Call, leave voicemail • Distro POC
ElCall, but don't leave a voicemail
Enter your organization's public IPv4 addresses in CIDR notation:
[This Internet security information has been withheld from public disclosure in accordance with
federal and state laws.]
3