Text · page 6 of 15
the risk that data may be lost or damaged by inappropriate access and use. In addition to IT policies defining the city council’s expectations for computer users, IT security awareness training will help provide city officials and employees with the skills to do it. The training should center on current and emerging trends such as information theft, social engineering scams and computer viruses and other types of malicious software (e.g., ransomware), all of which may result in PPSI compromise or denying access to the IT system and its data. Training programs should be directed at the specific audience (i.e., network users or administrators) and include information attendees need to perform their jobs. The training should also cover key security concepts such as the dangers of downloading files and programs from the Internet or portable devices, such as thumb drives; the importance of selecting strong passwords; requirements related to protecting PPSI; risks involved with using unsecured Wi-Fi connections, or how to respond if a virus or an information security breach is detected. City Employees Were Not Provided with IT Policies or IT Security Awareness Training The Council and City officials have not developed and adopted written IT policies and officials did not provide users with IT security awareness training to help ensure they understand IT security measures designed to help safeguard the network from potential unauthorized access or disruption. As a result, IT assets and data could be more vulnerable to loss and misuse. The Specialist stated that in the future he would like to provide IT security awareness training to City employees, however, due to current COVID-19 pandemic precautions in place, he has not been able to. The former City Comptroller indicated that prior to the Specialist being hired IT training was not something officials had discussed but they would consider going forward. City officials cannot be assured there is adequate protection of the confidentiality, integrity and availability of data and computer systems without ensuring that users, or those who manage IT, understand the IT security policies and procedures and their roles and responsibilities related to IT and data security. Without periodic, formal IT security awareness training, users may not understand their responsibilities and are more likely to be unaware of a situation that could compromise IT assets. For example, without such critical training, employees may not understand how their Internet browsing could cause their computers to become infected with malicious software or they may be fooled, via social engineering scams, into providing their passwords, opening harmful attachments or visiting malicious websites. As a result, City data could be at a greater risk for unauthorized access, misuse or abuse. 4 Of f ic e of t he New York State Comptroller