San Joaquin agencies, cities weak on Internet security, grand jury report says

By Mike Martinez
San Joaquin Herald
Posted: 06/02/2009 01:14:01 PM PDT
Updated: 06/02/2009 06:57:55 PM PDT

STOCKTON — In a countywide investigation, a San Joaquin County civil grand jury found only two cities — Lathrop and Escalon — were meeting or addressing expectations for Internet security, while three county organizations were operating on outdated server systems, including the Public Defender's Office and the Sheriff-Coroner's Office.

In a 10-page report released Tuesday morning, the grand jury said while the city of Tracy enforces a strong password policy that includes the routine changing of passwords, the city lacks a written security policy and allows employees to have unrestricted access to Web e-mail accounts and the Internet.

In a statement issued by the city of Tracy late Tuesday afternoon, City Manager Leon Churchill said the city takes the continuous threat of Internet security seriously, and the grand jury's findings are "open for debate.''

"We equate Internet usage to be similar to phone usage,'' Churchill said. "We have never recorded or restricted employee's phone usage. We are not about to start, and we won't do it for the computer either. It's not a question of privacy. It's more a matter of trust with our employees.''

The city expects to respond to the grand jury's findings within the next 90 days and anticipates completing and submitting a written security policy.

Meanwhile, the city of Manteca has limited security policies in place that address e-mail and software use, but it does not
Advertisement
have a documented disaster recovery plan or emergency backup power for the entire data center, according to the report.

In Lathrop, the grand jury reported that the technology manager has only been on the job a short time but "has a clear vision of security goals and is working to meet them.''

It said the city's written security policy was clear, and all employees were made aware of its content. A recently upgraded e-mail filter has "dramatically'' reduced spam.

The investigation discovered the San Joaquin County Sheriff-Coroner's Office was operating at least one server on a dated operating system, Windows NT 4.0, which was released in 1996.

Microsoft stopped providing updates in 2005 because of numerous security flaws.

Recognizing the current budget problems governments are facing, the grand jury recommended that all IT departments in the county contract for an independent security audit when they can afford it.

http://www.contracostatimes.com/search/ci_12503041?IADID=Search-www.contracostatimes.com-www.contracostatimes.com