The URL can be used to link to this page

Home My WebLink About2006 Audit Report ITBREMERTON CITY AUDITOR 345 6h Street, Bremerton, WA 98337 — (360) 473-5369 MANAGEMENT AUDIT REPORT Information Technology Division January 31, 2006 p EWIERT'Or;CITY MUMMOR Gary W. Nystul, CPA gnystu1@c1.brennerton.wa.us May 11, 2006 Honorable Cary Bozeman, Mayor Laura Lyon, Director of Financial Services Phil Williams, Director of Public Works & Utilities To/ 360-473-5369 Fax 380-4735080 345 8th Street, Suite 800 Bremerton, WA 98337 The Office of the City Auditor has completed an audit of the Information Technology Division and has issued the attached report. Six findings and five other observations were noted. While many of the findings and other observations relate to the Information Technology Division, many items also need to be addressed by other departments. The assistance provided by Bill Eley, Manager of Information Technology, and his staff is greatly appreciated. Sincerely, Gary W. Nystul cc: City Council City Attorney Bill Eley AUDIT REPORT INFORMATION TECHNOLOGY DIVISION January 31, 2006 Purpose The Office of the City Auditor periodically reviews various phases of city operations. This review of the Information Technology Division was scheduled in the 2005 work plan. Scope This review is of the operations of the Information Technology Division. The primary inquiry was of department activities during and at the end of 2005. The financial activity during 2004 and 2005 was also reviewed. Statement of Auditing Standards This audit was performed in accordance with government auditing standards. Those standards require that I plan and perform the audit to afford a reasonable basis for my judgments and conclusions regarding the organization, program, activity or function being audited. An audit also includes assessing applicable internal controls and compliance with laws and regulations. I believe that my audit provides a reasonable basis for my conclusions. Summary of the Results Several findings are noted. Most findings are the result of actions or lack of actions by individuals outside the IT division. Several recommendations are made for activities that the IT division performs. Background The history of information technology at the City of Bremerton is chronicled in a strategic plan document prepared by Bill Eley, the Information Technology manager. In 1975, the city purchased a Burroughs B 1855 Small Systems Mainframe. Its primary functions were utility billing and parking infraction processing. All of the data had to be entered by keypunch operators. In 1984-85 the city purchased its first microcomputers which were used for word processing and spreadsheets. In 1987, the city upgraded to an NCR System 32/600 for utility billing and an NCR System 32/800 for all other central applications. Thirty NCR PCs and ten desktop printers were also purchased. Shortly after that, the integrated accounting/payroll/billing software package was purchased. The first network was introduced in 1990. Today there are over 250 computers linked to servers in the government center by fiber optic cables. City employees can access the internet, the financial system and communicate with each other via email. Individual employees have also obtained various programs specific to their areas of work that enhance their performance. The IT Division is under the Department of Financial Services and has a staff of 5. FINDINGS AND RECOMMENDATIONS The following are the Audit Findings. The response received from the department relating to the finding is included at the end. Following the audit findings are the Other Matters which are additional significant items the auditor believes should be called to the attention of city management. 1. The space provided to the IT Division in the new Norm Dicks Government Center does not have adequate floor space for the division's normal work, has significant deficiencies in its HVAC systems, and does not have proper space for the servers. DESCRIPTION OF CONDITION The IT Division moved into the new Government Center in December 2004 -January 2005. The office space given IT is not adequate for their work. When a shipment of computers is received, they are stacked in the middle of the room limiting access to some of the work space. The air conditioning is not adequate to cool the space to a normal working temperature. The staff had to leave the door open during the summer to try to get additional cool air so that the work space would be somewhat comfortable. The server rack was originally located in an open space at the side of the office. It had a noise level that was a potential hearing problem for staff working at the desks nearby and they created more heat. The servers were subsequently relocated to the sixth floor telephone room that also did not have air conditioning and was not designed as a server room. The server for the city financial system is still on the floor in the IT manger's office where it is exposed to potential accidental damage and access to it is not secure. CAUSE OF CONDITION In planning and building the new city hall, the City failed to allocate adequate and proper space to the IT division. EFFECT • There is a loss of productivity because the staff is working in a warm office. • There is a loss of productivity from the staff having to work around the pile of new computers. • Moving the servers to the 60' floor telephone room was an added expense. • Two $6,000 tape drives located in the server rack failed due to the high temperatures in the telephone room. (Dell replaced them under warranty.) • An air conditioning system had to be added on the roof and run to the telephone room to cool the servers. This was an added expense. RECOMMENDATION When new offices are designed and constructed, the reasonable needs of the staff using the space should be addressed. These needs include adequate space and proper heating and cooling systems. In the case of the IT division the reasonable need includes a secure server room that is air conditioned. Those responsible for designing and acquiring city office space should be cognizant of each departments needs. Some additional secure space needs to be found for IT to use to carry on the normal departmental activity of receiving shipments of new computers and equipment. FINANCIAL SEVICES DEPARTMENT RESPONSE We concur. The space is inadequate as there is no storage for either new equipment coming in or old equipment being collected for surplus/disposal. Further the technicians have no space to perform repair or set-up work. Our original request was for 1440 sq ft, we were allocated 856 sq ft. A more serious issue is the space we have to use for our servers and network equipment. There was room to place one standard server rack in the 6th floor telecom closet. This has allowed us to place our rack -mounted servers in this space. All other servers remain in our space on the 51h Floor. However, the 51h Floor space and the telecom closet have a water based fire suppression system. In the event of a discharge of that system, it is estimated that all of the Cities servers and the core switches of the City's network could be rendered useless. The non -rack mounted servers in our 5th Floor workspace are positioned on the carpet. This is not a good environment for our equipment and will probably shorten its lifespan. We have been considering alternate locations to house our staff and equipment: • We looked at the new Cencom facility. However, we noted that their available space was filling up fast and the Cencom staff recommended that we look at their old facility. 3 • We looked at the old Cencom facility. We felt that this was a good location although at the time we did the walk-through, the place was a mess and in need of significant work. We understand that this has now been rectified. • We have considered briefly the space at Oyster Bay. There appears to be sufficient room although it would require some remodeling. Our main concern with Oyster Bay, as with the new Cencom facility, is the remoteness from other City facilities. In all of the above alternatives, additional funding would be required to relocate. 2. The city has expended over $100,000, plus personnel costs, since 1997 to acquire and install CarteGraph software in Public Works but only three modules are functional. The Department of Public Works & Utilities does not have an adequate plan to properly complete the installation of the remaining software modules. DESCRIPTION OF CONDITION In 1996 the City started using CarteGraph software in Public Works. Software updates and training were acquired and paid for starting in 1997. Expenditures for software, support, and training in recent years were $19,220 in 2003, $44,480 in 2004 and $35,261 in 2005. At the end of 2005 only the modules for WORKdirector, CALLlink, and WATERview were being utilized. WATERview, for example, was being used to track only fire hydrants. Some users have both CALLIink and WORKdirector which is a duplication. The modules for LIGHTview, SEWERview, STORMview, SIGNview and SIGNALview have not been utilized. There is no written plan or schedule to start using these modules. Also, there is no written plan or schedule to more fully utilize the existing programs. The Equipment Services Division installed the software without the benefit of a project manager experienced in the software. They had to learn the system as they installed it. In doing so, they did not properly trace the ending inventory from the old system to the beginning inventory in the new system. The staff did not recognize the necessity of this procedure. The Equipment Services Division manager has now been assigned as the project manager for the several modules to be installed. However, he does not have the necessary knowledge of the software and authority within the city organization to succeed in this assignment. Some staff in PW&U expect that the IT division is the one to provide the necessary assistance to install the modules. M CAUSE OF CONDITION Initially, the Department of PW&U did not sufficiently understand how to manage the installation of the various modules. They did not recognize the complexities of this software and the time and knowledge required to implement it. A written plan and time schedule was not prepared. PW&U had not assigned a project manager or project management team with sufficient knowledge, skill, authority and understanding of the software to successfully install it. EFFECT Money has been expended on training and software that is not being used. Money has been invested in software that is still on the shelf. More time and effort will be wasted if a project manager with adequate training and authority is not assigned. The city has not been able to utilize the efficiency and management tools the software is intended to provide. RECOMMENDATION • PW&U Management should assign or obtain a properly trained project manager or team with sufficient authority to oversee the installation. • A written implementation plan and schedule should be developed. FINANCIAL SERVICES DEPARTMENT RESPONSE The IT division has never been adequately staffed to support new development. We have only had sufficient staffing to maintain the status quo. Similarly there is no one in the other departments with sufficient time to support new development. IT plans to include in the 2007 budget the provision to add a systems analyst/systems support specialist to the IT division. The duties of this person would be to conduct the needs analysis, system design (or selection), testing, training and implementation of all new applications or major upgrades to existing applications. We have several major new applications either in the process of being implemented or being planned for near-term implementation. However, Project management staffing must be provided by the department initiating the system implementation. In this finding, that will require resource dedication from Public Works to provide necessary leadership and oversight. PUBLIC WORKS & UTILITIES DEPARTMENT RESPONSE We concur with the generalized response made by the Financial Services Department on this issue but would like to offer some additional comment. 5 In 2003when the additional modules and services were purchased, the IT Division indicated their willingness to support the CarteGraph platform. PW&U negotiated a contract for the licensing of the software, conversion of historical data, installation, testing, software updates, and staff training. The contract for purchase was sent to IT for their review and comment prior to placement on the Council Agenda for action. Several of the modules are up and running and working well. Several more are waiting for what we hope will be additional time availability from both IT and PW&U staff to complete the implementation. PW&U did pay for a week of CarteGraph specific training for an IT staff member in October, 2005. That investment will promote an efficient implementation of additional CarteGraph tools in the coming months. We have no lack of confidence in the technical abilities of our IT staff to provide us the assistance we need to be successful. There are times, however, as noted in their response, when staff resources are strained to the breaking point just maintaining current users. It is very difficult for them to justify working on new platforms at those times. The statement that PW&U did not assign a Project Manager with sufficient authority and expertise to be successful is incorrect. The Department initially assigned Jeff Collins of the Electronics Division to be our Project Manager to work with the vendor and IT staff. Jeff is very capable technically and was initially successful in working with CarteGraph and IT staff to take the software installation through the required steps and get large amounts of historical data converted. It became apparent over time, however, that Jeff was just not going to be able to spend as much time as necessary to get everything completed as quickly as desired. At that point Jim Orton was assigned as Project Manager and remains in that position. Jim does not have extensive technical ability in Information Technology but is an effective manager as well as a directly affected user of the software. As such he is in a good position to understand what is working and what isn't, what the Department's priorities are for the software, and who to work with to implement each module as resources are available. We are confident we will be successful in getting all of the expected functionality from this investment. Has the entire process gone as smoothly and quickly as originally envisioned? No, but that is certainly not unprecedented when implementing a major new software package. We do appreciate the Auditor's general comments regarding the need for good local management, appropriate technical assistance, and continual evaluation of our progress. It will be a useful exercise to de -brief all involved staff at the completion of the CarteGraph roll-out to see what lessons can be learned or re -learned from the effort expended. This will be particularly helpful in improving schedule and cost performance on the upcoming implementation of a new Utility Billing software package and the continued development of the City's GIS system. We have been coordinating our efforts on these two projects with Financial Services but our experiences with CarteGraph suggest that even closer coordination and partnering will be required. 6 3. The City administration has failed to provide policies and procedure for the retention of electronic records (email) to comply with state law. DESCRIPTION OF CONDITION The city does not have a policy or procedure for the retention of email. Policy 2-20-05 Computer System Use & Security says that the city records management policies apply to electronic mail. Policy 2-20-06 Records Management, effective April 1996, does not even refer to electronic mail. There is no city guidance to employees as to what are "electronic public records" that need to be retained. There are no city policies or procedures on how or where to physically keep these records. City employees look to the IT division to "back up" data. But the IT division does not have the ability to keep electronic records for the required retention period or provide a means to retrieve data that may be needed in the future. State law, found in the General Records Act, Chapter 40.14 RCW, requires keeping public records. The Secretary of State published an informational pamphlet in March 2001 giving suggestions on keeping of email. CAUSE OF CONDITION City administration has failed to promulgate any policies or procedures for employees and officials to follow regarding properly keeping email. EFFECT There is the potential of not having records that might be beneficial to the city in support of litigation. The city could be in violation of state law if public records cannot be found. There are potential audit findings for not having record retention policies. RECOMMENDATION The City administration should develop a policy for the retention of electronic records. FINANCIAL SERVICES DEPARTMENT RESPONSE Council has just passed Ordinance 4964 (March 15, 2006) that covers electronic records retention. The e-mail retention policy stemming from this ordinance will cause the IT Division to provide the means, within the City's network and data storage infrastructure, to retain in recoverable form all e-mails in accordance with the retention rules as determined by the Public Records Officer. The policy has been signed by the Mayor and is effective 3/30/06. It is anticipated that the provision of equipment and software necessary to effect the required storage capabilities will be a budget item for the 2007 budget. rA 4. The forms and procedures used by HR and Finance to add new employees as computer users and remove them upon their departure are not adequate. DESCRIPTION OF CONDITION The HR department has various forms to be completed for new employees hired by the city. There is no form to notify IT of the need for computer access of a new employee. When employees leave, there is a check list of tasks and there is a form to notify IT of the employee's departure. The form has a space to request that all files of the employee be deleted. This could be a violation of state law for failing to keep public records. There is also a space to indicate that another employee should be granted access to the files and email to review them. IT is frequently not notified when the need for access has ended. As a result, the user's name appears in the directory long after the employee is gone. There is no established procedure to keep the departed employee's electronic records. There is not a procedure in place for IT or the Finance Officer to be notified when an employee changes jobs within the city. New access requirements or the termination of prior access permissions may not be reported. CAUSE OF CONDITION The departments of Human Resources and Financial Services have not adopted policies or procedures to timely notify IT to add new employees who need computer access, report changes in jobs or positions that may change computer system access needs, or properly and timely report departures of employees. EFFECT New employee's access could be delayed because of lack of notification. The files of departed employees could be inappropriately deleted or not retained for future use. System access for employees who change positions may not be changed consistent with their new position. Users, who are no longer employed, remain in the address book which gives the appearance of inappropriate access to the system. This has been an ongoing issue for several years. RECOMMENDATION HR and Finance should adopt a procedure to promptly notify IT, in writing, of new employees and the systems they need access to. Procedures should be adopted to promptly notify IT and the Finance Officer when employees transfer within the city so that access can be adjusted appropriately. Procedures should be adopted so that when employees leave, public records are properly preserved and the employees accesses to the systems are removed in a timely manner. FINANCIAL SERVICES DEPARTMENT RESPONSE In the case of new employees, the form should also show the new employee's department. Currently IT has to try and decipher the Department Head Signature in an attempt to determine this information. IT and HR will work together to improve the notification process. 5. Help Desk does not provide good communication to its customers, service responses are not timely, and work orders are not followed up with it's customers. DESCRIPTION OF CONDITION The Help Desk does not have good organization or customer service skills to support the computer users in the city. Requests to the help desk are not always acknowledged. Requests for assistance are occasionally not responded to. There have been instances where the requested assistance was provided but the user was not notified that it is completed. There are instances where devices, such as networked printers, are down but the users are not notified. CAUSE OF CONDITION The IT division has a standard procedure for managing the help desk but management does not review compliance. The procedures to receive requests for assistance, assign these requests for action, and follow up to see that they are completed are not reviewed. EFFECT Some city computer users are frustrated with the level of support given by the help desk. Users do not know, for example, that a printer has not been accessible for several weeks because the network card is out and continued to waste time trying. Users had to learn by trial and error that printers were renamed. RECOMMENDATION The division's procedures for the help desk should be reviewed and distributed to all division employees. Performance standards should be conveyed to the users so they know what to expect. Management should review the tracking of requests for assistance to ensure assistance is provided according to policy. FINANCIAL SERVICES DEPARTMENT RESPONSE There have been problems with the helpdesk process due in large part to lack of resources. The process is sound in theory, but has suffered from unreliable 9 communications back to the user. It is unfortunate that the conversion from Novell to Microsoft occurred during the period of audit investigation. During this period, we have only had only one staff member assigned to the helpdesk, the other members of staff have been working almost exclusively on the conversion. When the helpdesk staff member had to pass on calls to other members of staff, those calls have not always been answered in a timely manner. The situation was exacerbated by the fact that during the conversion, helpdesk calls were coming in via telephone, GroupWise e-mail and Outlook e-mail. We will retrain the IT staff in better communication practices and hold weekly status meetings to check for overdue tasks. 6. An inventory of the software on 231 of 255 personal computers found several software programs that are not appropriate and several computers that had not been restarted for several weeks. DESCRIPTION OF CONDITION A physical inventory of 231 of the 255 personal computers in the city network found two workstations with no anti-virus software. Two other single purpose computers (not networked) were found that did not have anti-virus software. Thirty three pc's (14%) did not have a current anti-virus definition. Thirty two pc's had not been rebooted recently. These had been running continuously ranging from 6 days to 118 days. Several computers have software that is not city issue and which is not proper for public computers on the city network, but which had been placed on pc's by the user. This software includes Empire Poker, Party Poker, Supercollapse, Clean Get Away, and Evidence Eliminator. CAUSE OF CONDITION Each pc has had administrator rights. This allows each employee to load any software they wanted. Departments have not reviewed the software placed on computers in their departments nor has the IT division approved of all software. EFFECT Computers without antivirus programs place the network at risk for viruses. Without current definitions, the newest viruses are not able to be detected. If a computer is not rebooted, the new definitions of anti-virus are not applied to that machine. Unapproved software may subject the city to licensing issues. RECOMMENDATION The conversion to Microsoft Active Directory will prevent any new programs from being installed. The IT division should advise the individual departments of software that has been improperly installed. 10 FINANCIAL SERVICES DEPARTMENT RESPONSE The automatic antivirus update procedures are working. Leaving machines connected when not in use, while a dangerous practice, will not prevent the automatic updating of virus definitions. For those machines found without current updates, it is likely that the path variable to the update data was either set incorrectly or changed during a machine/operating system change. We will work with the City Auditor to correct the users appearing on his list. OTHER MATTERS 1. The Policies and Procedures are outdated. (IT) The formal city policies for computers, computer software and computer use are found in the Policies and Procedures manual. These policies and the dates they were adopted are as follows: • 1994 Computer User Committee • 1996 Selection, acquisition & Maintenance of Computer Hardware/Software • 1998 Computer System Use & Security The computer users committee has not met in four years. There have been many changes in software and hardware and related procedures since the adoption of the policy in 1996. System security and standard procedures for use have changed since the adoption of the 1998 policy. The policies and procedures need to be updated to the current level of technology and customary system use. Financial Services Department Response New draft policies are being worked on at this time. The older policies, although somewhat out of date still contained the essential information for acceptable computer practices. It is only of late, with the advent of wireless technology, remote access etc. that there has been a real need to change them. 2. Place the city web support specialist under the IT division (PW & IT) The city recently upgraded a position to Web Support Specialist. The position is in Public Works and is physically located at the Olympus facility. The IT division is paying approximately one half of the salary for the position with the balance paid by the water, wastewater and storm water utilities. The payroll costs paid by IT are included in the operating costs of the IT division. This cost is apportioned to all users. All departments of the city benefit from the web page. Since IT is paying part of the salary, it would be appropriate to place the position under IT. There is an additional advantage of having another staff person in IT. There is need for assistance in manning the help desk. There would be a need to find space in the IT office for another person. Financial Services Department Response This would serve to provide IT with more direct control over the website function that is currently funded out of the IT budget. Further it would improve the operation of the IT Division by adding an administrative clerical function that does not exist currently. However, this move would clearly result in other staffing functions performed being removed from PW&U. It would require an IT budget increase for the additional Vi FTE. The Public Works & Utilities department would have to make up their 1/s FTE staff shortfall. The Director of Financial Services and the Director of PW&Us have proposed that IT be moved into the PW&Us Department — placing both functions under one director. 3. Should the city telephone system and related staff be incorporated in the IT division? (PW & IT) The technology used by telephone systems and computer systems has changed significantly in recent years. They have become very similar in that some of the technology and physical facilities are used by both. Voice over I/P is current technology that in effect uses computers for telephones and it is used by many businesses. The City Administration should consider the advantages of having the telephone system and related personnel under the management of the IT division. Financial Services Department Response The City's telephone function should be be in the same department as IT. This would follow the precedent now set in the vast majority of public agencies in the State. Voice and data technologies have now converged to the point where we could satisfactorily deploy voice over the City's data network. That is not to say that we would immediately move from the PBX technology. Nor does this mean that there would not be a future need for a telephone support function. However this organizational change would allow us to make objective decisions the next time we have to invest in either technology. The Director of Financial Services and the Director of PW&Us have proposed that IT be moved into the PW&Us Department — placing both functions under one director. 4. There is no in-house computer training provided to city employees and there is no formal effort to improve skills to utilize technology. 12 The city does not provide any training courses in Microsoft Word or Excel. Training was provided several years ago when the conversion was made from Word Perfect. Each department now finds training at outside sources as they feel needed. The IT division provided several short MS video clips for training in the newly installed Outlook. While this is helpful, the ability to use of all the capabilities of the software is difficult to learn on-line. Some individuals are more skilled in the use of certain programs. One way to increase productivity and increase use of the programs would be to sponsor in-house workshops. Skilled users could share their knowledge with other interested users. Training could be provided to experienced users and then let them share some of their learning with other employees in small workshop settings. The IT Division could facilitate in house training for improved use of technology. Financial Services Department Response The IT Division has never really had the resources to offer any kind of significant training programs. The training that was done when we switched to MS Office products was performed by a member of Olympic College's adjunct faculty on a contract basis. It was felt at that time that computer literacy in the City was at a low enough level that we needed to invest in that kind of training. We also had a permanent training facility for up to 12 students. Even so, the administration of mass training of that kind was a staggering task. After that period of training, response to offers of future classes was too low to justify the cost. It is still our thought that with the resources available at the City, the best use of training dollars is to utilize external classes such as those offered by Olympic College. We would be happy to assist with "brown bag lunch" type training sessions given by the more experienced application users. 5. Providing information to users for the 2006 Budget. In the 2006 Budget, the IT Division provided all of the users with listings of the software and hardware that they would be charged for as an indirect cost. This should be a good tool for the users to manage their IT costs. This should also be a good tool for IT to help the users to better understand what they are doing. The Division should be commended for making this addition to the budget process. 13 MO S S A DAMS LLP m ir1 CERTIFIED PUBLIC ACCOUNTANTS AND BUSINESS CONSULTANTS November 7, 2005 Mr. Gary Nystul, City Auditor City of Bremerton 345 6th Avenue, Suite 600 Bremerton, Washington 98337 Dear Mr. Nystul: 1001 Fourth Avenue, Suite 2700 Seattle, Washington 98154-1199 Phone 206.442.2600 FAX 206.233.9214 www.mossadams.com Thank you for the opportunity to provide a proposal for Moss Adams LLP to assist the City of Bremerton (the City) by providing the key technology consulting services you have requested. Specifically, the City has identified assistance with testing and evaluating security as your most important need, along with an assessment of City technology operations and systems compared with standard procedures and best practices. Moss Adams is pleased to offer our services in these areas to meet your defined needs. The purpose of this letter is to confirm our understanding of the situation and to present our approach for the various services we might provide, a standard project schedule, a list of selected relevant experience, an overview of our firm, a project team overview, and estimate of the associated project costs. Approach and Work Plan Based on the scope of work requested by the City, we have identified discrete projects that the City might consider engaging Moss Adams to perform. We have itemized each project so that the City can clearly identify the exact scope and costs involved, as well as best manage our work. Accordingly, the specific projects include: • General Security and Controls Review • Network Penetration Testing • Standard Technology Controls Audit Program • Novell vs. Windows Network Alternatives Analysis • Disaster Recovery Plan Coaching • Independent System Acquisition (Project Management) • Independent System Acquisition (Quality Assurance/Coaching) An ala carte overview and work plan for each project is presented on the next few pages. It is expected that this will allow the City to evaluate and select only those services that will provide the greatest value to Bremerton. A member of Offices in Moores Rowland International Principal Cities of an association of Independent Washington. Oregon acoounting firms throughout and Callfomla the world MOSS -DAMS LP City of Bremerton November 7, 2005 Page 2 General Security and Controls Review Our approach for the general security and controls review is based on the AIPCA and COBIT standards, as well as our direct experience in evaluating various municipalities and other government agencies. The project follows a proven work plan to collect information in an efficient manner, and to communicate relevant technical information in a clear format. The work plan for the general security and controls review is presented below. 1. Confirm objectives, work plan, schedule, and management activities. 2. Scrutinize available and current technology documentation provided by the City. 3. Conduct a walkthrough of the applications, network infrastructure, security controls, and systems. 4. Interview technology staff and selected City management representatives. 5. Review existing applications, network design, security, and system configurations. 6. Identify and analyze potential opportunities for improvement. 7. Summarize fmdings, risks, and recommendations. 8. Assemble the general security and controls review report. 9. Present and finalize the draft report with IT staff and the City management. The process begins by fust establishing the project and then gathering information through documentation review, walkthroughs, network and systems review, and interviews with technology staff and selected City management. The process next shifts to assess the technology infrastructure, security environment, and systems, using best practices from a security perspective. The project team will then identify risks and corresponding improvement opportunities, and the difference between current conditions and needs. Relevant technical issues that can be considered and measured against best practices as part of the general security and controls assessment include: • Network infrastructure • Logical network design • Physical access controls • Environmental controls • Hardware, domain and system access controls • User access and application management • Server and workstation management • Operating system and application security • Software licensing • Software development • Data management and reporting • Outsourcing and vendor management • Technology standards • Organizational controls • Segregation of duties • E-mail and website administration • Trojan and antivirus countermeasures • External connectivity • Remote access controls • Information leakage • Monitoring functions • Logging and alerting • Perimeter defense and intrusion detection • Incident response planning • Backup and recovery • Disaster recovery planning The project concludes with a succinct report of findings and recommendations for a more secure operating environment. To ensure that the project is completed in a timely manner and at a reasonable cost, the resulting general security and controls review report will be concise and focus on specific planning and improvement issues. In addition, we will use the data gathered from the review to help support the information and analysis associated with any other work that the City might request. MOSS LLP City of Bremerton November 7, 2005 Page 3 Network Penetration Testing Moss Adams can be available to conduct penetration testing of the City's network infrastructure. Such testing is considered critical to ensure that sensitive electronic data and systems are appropriately protected. The testing would involve the use of both commercial and open market testing tools that can identify potential vulnerabilities. Our preference would be for your IT staff to observe our test work so that they learn first hand how to perform comparable testing on their own. By leaving a copy of the testing tools after our fieldwork and instilling the necessary knowledge for your IT staff to use the tools through one-on-one guidance, the City can then implement an ongoing monitoring function intemally without the need for further assistance from external IT consultants. The work plan for the network penetration testing is as follows: 1. Confirm project objectives, establish schedule, and define scope of technologies at greatest risk. 2. Review relevant documentation and network schematics. 3. Perform high-level server review of services, settings, etc. 4. Assess existing network security. 5. Assess perimeter security at a high level. 6. Conduct high level investigation of potential exposure of information leakage through public sources. 7. Perform focused penetration testing with the City IT staff in attendance on selected hosts. 8. Review logs at the City to determine system detection of penetration testing. 9. Analyze potential opportunities for improvement. 10. Develop findings, recommendations, and alternatives. 11. Prepare succinct network penetration testing report. 12. Review report with management. The results of our testing will be compiled in a succinct report that is subsequently presented to the City management. The content of the report will be focused on specific vulnerabilities and will include suggested remedies to mitigate the risks associated with our findings. Raw logs of penetration testing will also be made available upon request. To be efficient in our data gathering and analysis, our team will rely on work done in the general security and controls review as an initial foundation for the network penetration testing. MOSS -DAMS LLP City of Bremerton November 7, 2005 Page 4 Standard Technology Controls Audit Proaram Like many organizations, technology is a critical resource used by the City to serve the public. Therefore, it is important to maintain close control and oversight of the information technology function. Given that most managers outside of an IT Department often lack the necessary technical knowledge to assess and monitor the performance of the technology function, this makes it difficult for an organization to ensure technology is being effectively and efficiently managed. With the heightened importance of maintaining strong security controls and greater emphasis on institutions having a defined internal control environment, Moss Adams is frequently called upon to develop and test the technology controls within an organization. The purpose of this project is to use the internationally recognized COBIT framework to define the standard technology controls that the City should use to manage its IT function, educate the City Auditor on how to test these controls, and develop a test program that the City Auditor can use in the future to monitor IT operations. As such, the work plan to assist with developing a standard technology controls audit program is as follows: 1. Confirm objectives, work plan, schedule, and management activities. 2. Review COBIT framework of standard technology controls with IT staff and the City Auditor. 3. Facilitate a discussion with IT staff and the City Auditor to define the key IT controls for the City. 4. Review current technology operations/business practices using focused interviews and walkthmughs. 5. Assist City Auditor in defining the current control activities used to support the key IT controls. 6. Share templates that can be used by the City to document the IT control environment. 7. Provide a high-level assessment of major control gaps (design weaknesses and operating deficiencies). 8. Guide the City Auditor in the development of the test programs (based on available examples). 9. Provide suggestions to the City Auditor for preparing/conducting tests of the IT control environment. 10. Define technical elements required for the City Auditor to test more technical technology matters. Novell vs. Windows Network Alternatives Analysis City officials in Bremerton are contemplating the future of the network infrastructure as the City prepares to consolidate and streamline the existing computing environment. As such, the City has identified the need to analyze whether to (1) remain with Novell NetWare, or (2) migrate to a Windows-based network environment. Moss Adams has direct experience working with other municipalities and government agencies as they have contemplated the same situation. Given the continuously evolving market conditions and unique needs for Bremerton, Moss Adams will work to conduct an alternatives analysis of these options that will include a comparison of the strengths and weaknesses, timing and staffing implications, short and long term costs, and an assessment of the associated risks. The work plan for the network alternatives analysis is as follows: 1. Confirm objectives, work plan, schedule, and management activities. 2. Determine priorities for the future network infrastructure from the City's perspective. 3. Interview IT staff, the City Auditor, and selected City representatives and business partners. 4. Identify future requirements related to the logical network design and infrastructure. 5. Conduct supplemental market research to gather current and updated information. 6. Perform high-level alternatives analysis of each platform. • Strengths and weaknesses (capabilities, support, security, compatibilities, market position, financial viability, etc.) • Staffing and timing implications • Budget impact (initial and ongoing) • Risk assessment 7. Prepare a succinct alternatives analysis report. 8. Review alternatives analysis report with defined City representatives. Moss DAMS LLP City of Bremerton November 7, 2005 Page 5 Disaster Recovery Plan Coaching Moss Adams regularly works with clients to develop and test disaster recovery and business continuity plans. Such work is performed based on the NIST and ITII, standards. It is our intent to draw upon these experiences to provide guidance to the City on the risks and nature of elements that should be included in a disaster recovery plan for the organization. Given the relationship that the City has with other entities, it is also expected that our analysis would provide natural factors that should be considered for these business partner relationships to ensure that the interests for continuity of the City operations are sufficiently covered. The work plan for the disaster recovery plan coaching is as follows: 1. Confirm objectives, work plan, schedule, and management activities. 2. Analyze the infrastructure, systems, data and operations required to maintain the business. 3. Meet with the City management and IT staff about the relevance and requirements for each service. 4. Perform an initial risk assessment of each service to understand the driving priorities for the City. 5. Evaluate alternatives and strategies for the City to prepare for responding to a disaster. 6. Develop a disaster planning framework and issues list. 7. Meet with the City management and IT staff on the disaster planning framework and issues list. 8. Respond to questions and provide supplemental guidance about the framework and issues list. The disaster recovery plan coaching is intended to communicate to the City management the practical issues that must be considered related to planning for business continuity and to share basic planning materials to empower the City to develop a disaster recovery plan using its own staff. Moss Adams will assist in this process by analyzing the current situation and recommending specific actions that can be taken by the City to assess the risk factors and proceed with developing the disaster recovery plan. Independent System Acquisition Moss Adams routinely assists cities through the process of independently evaluating and selecting a new municipal accounting and utility billing systems. Depending on the circumstances, our team can be involved in a variety of tailored capacities. The most common role for Moss Adams is either in a project management or quality assurance/coaching capacity. A traditional independent system acquisition should involve defining extensive requirements for the new system, selecting and evaluating a number of software vendor products, conducting sufficient due diligence, and negotiating the purchase of the new system It will be important for the City to manage the acquisition process in a structured manner, and gather all the information that is needed to make a rational, fact -based decision. At a minimum, the acquisition process should include the following tasks: 1. Define system requirements 2. Develop Request for Proposal (RFP) 3. Establish selection criteria and pre -qualify vendors/systems 4. Distribute the RFP to designated vendors 5. Hold scripted vendor demonstrations 6. Conduct reference checks and site visits 7. Scrutinize the user counts, proposed modules, hardware requirements, and costs 8. Perform supplemental due diligence 9. Complete contract negotiations 10. Conduct implementation and resource planning The ultimate goal for the acquisition process should be the selection and purchase of the appropriate new system, with the software purchase decision being based on clearly defined system requirements and a thorough evaluation of competing software vendors. MOSS ADAMS LLP City of Bremerton November 7, 2005 Page 6 Schedule Moss Adams is prepared to commence this project in December, assuming the City personnel are readily available to meet and work with our team members. An elapsed time of approximately two to three months is expected to complete the work. This is considered an accelerated schedule designed to meet your needs in this situation. We can make significant progress in December given your current budgetary considerations. Factors that could influence the overall schedule include staff availability, availability of documentation, extent of supplemental analysis, desired level of documentation, holidays, and employee leave time. Moss Adams is comfortable working with the City to prioritize and stage each of these services so that they are delivered based on the schedule that will best meet your needs. Selected Relevant Experience The following examples of clients for whom we have performed recent and comparable technology projects are provided to the City of Bremerton for the purposes of this proposal. Additional examples of our work are available upon request. • City of Bellevue, Washington • City of Bellingham, Washington • City of Ellensburg, Washington • City of Issaquah, Washington • City of Kent, Washington • City of Shoreline, Washington Firm Overview • King County, Washington • City of Albany, Oregon • City of Corvallis, Oregon • City of Hillsboro, Oregon • Benton County, Oregon • Clatsop County, Oregon Moss Adams LLP is the largest regional accounting and management consulting firm on the West Coast. Founded in 1913, Moss Adams has provided professional services to clients for over 90 years. The firm has over 1,400 professionals in 17 locations. Corporate headquarters and our consulting division are both located in Seattle, Washington. Other office locations are strategically situated throughout Washington, Oregon and California. In addition, Moss Adams has three affiliated companies located in the three western states. The firm also enjoys a growing affiliation with the international group of Moores Rowland International, which provides accounting services in 85 countries. Moss Adams specializes in providing management consulting and accounting services to specific industries or niches. Moss Adams' niches include government, non-profit, high technologies, telecommunications, professional service firms, transportation, financial institutions, health care, construction, fisheries, forest products, and apparel. We strive to be industry experts in each of these areas. Our Consulting Division is a full-service management consulting practice based in Seattle. It is comprised of more than 100 professionals. The consulting group specializes in information technology, strategic and business planning, management improvement, policy planning, financial services, valuations, mergers and acquisitions, and human resources. This group consults to public, private for-profit, and private non-profit clientele. MOSS -A DAMS LLP City of Bremerton November 7, 2005 Page 7 Information technology services represent a core component of the full service consulting practice for Moss Adams Our seasoned staff members understand the benefits that can be gained through automation and technology, as well as the associated risks that must be carefully managed through each step of the process. Our team members have extensive business and technology backgrounds that are complemented by their systems expertise. To support our efforts, we bring over 20 government technology professional consultants that are quite comfortable with the unique computing requirements of government agencies. In addition to our practical experience, our technology professionals retain relevant certifications including Microsoft Certified Systems Engineer (MCSE), Microsoft Certified Professional (MCP), Certified Novell Administrator (CNA), Certified Information System Security Professional (CISSP), Systems Security Certified Practitioner (SSCP), and Certified Public Accountant (CPA). We have earned recognition for our services based upon our solid track record of thorough and discriminating analysis. The information technology group and public sector practice offer a wide range of related services. Our team members have years of consulting experience with the following technology services: • Independent Technology Assessments • Feasibility and Alternative Analysis • Independent System Acquisitions • Vendor Contract Negotiations • Project Management • System Implementation • Software Development • Database Design and Development • Forensic Research and Data Mining Staffing • Security Audits • Penetration Testing • Operational Review • Strategic Technology Planning • Disaster Recovery Planning • Reengineering and Workflow • Technology Controls Auditing • Benchmarking and Performance Studies • Coaching and Quality Assurance We propose to staff this engagement with an experienced project team that has expertise involving both COBIT and security standards, technology best practices, technology internal audit programs, alternatives analysis, and disaster recovery best practices. Our project team has a track record of working together on similar types of assessments. Our approach to staffing is to assemble a highly skilled group of consultants to deal with the variety of specialties and tasks that must be performed during the course of the project. Our team is organized in a reporting hierarchy that defines responsibilities by each individual and provides oversight to all members. Team members are given roles that match their qualifications and experience. Accordingly, each individual on the team has been assigned certain tasks and responsibilities, and given authority and oversight to ensure proper review and management of work performed. Moss Adams provides staff continuity at all phases of the project by balancing workloads and ensuring there is sufficient coverage for each member of our project team. Moss Adams proposes three core staff to assist the City. Chris Kradjan, a CPA and Technology Practice Leader in our consulting division, will direct this project and provide quality assurance. Todd Atteberry, a Microsoft Certified Systems Engineer + Security (MCSE + Security) and a Senior Consultant in the Technology consulting practice, will be the lead security analyst. Kevin Villanueva, a Certified Information Systems Security Professional (CISSP) and Senior Consultant in the Technology consulting practice, will serve as the lead technical specialist. Based on the overall scope of services and technical specialties required, the Moss Adams team can be supplemented with additional skilled and experienced professionals. We will introduce you to any further team members before they begin fieldwork. Moss ADAMS LLP City of Bremerton November 7, 2005 Page 8 City Participation City personnel will need to be actively involved in this engagement to make it a success. We anticipate direct involvement from technology personnel, the City Auditor, and selected members of the City management. This joint team approach is critical to the success of the engagement. We will work closely with you in a hands-on capacity in order to maximize the involvement of personnel from the City, leverage internal resources, and reduce the overall cost of the engagement. At all times we will respect the other obligations and time commitments of your employees and maintain both our integrity and independence in the process. Estimated Fees Our fees are based upon the hourly rates of individuals assigned to the project, plus direct out -of --pocket expenses. Hourly rates for our project team are expected to average $175 per hour. Fees will be billed monthly as incurred on a time and materials basis. An itemized breakdown of the professional fees for each of the projects requested by the City based on our current understanding of scope is estimated as follows: • General Security and Controls Review $9,250 to $10,000 • Network Penetration Testing $12,500 to $15,000 • Standard Technology Controls Audit Program $9,250 to $10,000 • Novell vs. Windows Network Alternatives Analysis $4,500 to $5,000 • Disaster Recovery Plan Coaching $7,500 to $8,500 • Independent System Acquisition (Project Management) $32,000 to $40,000 • Independent System Acquisition (Quality Assurance/Coaching) $12,500 to $17,500 Upon review of these estimates, should the City seek to have Moss Adams conduct a different level of analysis and scrutiny in any or all of these areas, we remain receptive to refining scope and cost before executing an agreement. In addition to the professional fees presented above, Moss Adams would also incur out-of-pocket expenses. These out-of-pocket expenses include such items as ferry fares, mileage, word processing, photocopying, telephone, postage, etc. We can jointly manage the budget for this engagement at project initiation through discussions regarding project scope, resource availability, assignment of duties between the City and Moss Adams team members, the anticipated level of documentation, and overall project timing. If our time is less than anticipated, we will bill the lesser amount. If our time is more than anticipated, we will discuss this with you before proceeding further. We will strive to keep fees to a reasonable level while ensuring high quality services. We provide monthly progress billings for time incurred for professional fees by period, and for project expenses at cost. Payment is expected within thirty days of the invoice date. We will support our progress billings with detail of project activities. Moss -ADAMS LLP City of Bremerton November 7, 2005 Page 9 We feel uniquely qualified to offer our services and look forward to providing assistance to the City of Bremerton. Please contact me at your convenience at (206) 442-2383 to discuss any questions you might have. We look forward to hearing from you to commence this important work. Since , C stop dj an, CPA Partner for MOSS ADAMS LLP cc: Laurie Tish Please indicate your acceptance of this services proposal on behalf of the City of Bremerton by signing in the space provided below and initialing the respective service. Accepted By: Signature Printed Name General Security and Controls Review Initial for Acceptance Network Penetration Testing Initial for Acceptance Standard Technology Controls Audit Program Initial for Acceptance Novell vs. Windows Network Alternatives Analysis Initial for Acceptance Disaster Recovery Plan Coaching Initial for Acceptance Independent System Acquisition (Project Management) Initial for Acceptance Initial for Acceptance Date Position Independent System Acquisition (Quality Assurance/Coaching) MUSS -ADAMS u,i, City of Bremerton November 7, 2005 Page 9 We feel uniquely qualified to offer our services and look forward to providing assistance to the City of Bremerton. Please contact me at your convenience at (206) 442-2383 to discuss any questions you might have. We look forward to hearing from you to commence this important work. Sincer , C estop er adjan, CPA Partner for MOSS ADAMS LLP cc: Laurie Tish Please indicate your acceptance of this services proposal on behalf of the City of Bremerton by signing in the space provided below and initialing the respective service. Accepted B_y: Signatu e 62 -17 - Printed Name General Security and Controls Review Initial for Acceptance Network Penetration Testing Initial for Acceptance Standard Technology Controls Audit Program Initial for Acceptance Novell vs. Windows Network Alternatives Analysis Initial for Acceptance Disaster Recovery Plan Coaching Initial for Acceptance Independent System Acquisition (Project Management) initial for Acceptance Date Position Independent System Acquisition (Quality Assurance/Coaching) Initial for Acceptance MEMORANDUM TO: Gary W. Nystul, City Auditor Laura Lyon, Director of Financial Services CC: Phil Williams, Public Works & Utilities Director FROM: Bill Eley, Manager of Information Technology DATE: March 3, 2006 SUBJECT: Moss Adams LLP Review of Information Technoloav Department The following is an outline of the report findings from Moss Adams' review of the Information Technology Division. My response to each item is italicized beneath it. A. Staffina. Management and Overslaht 1. Form an IT Steering Committee or equivalent to help guide the efforts of the City's Information Technology Department. This was set as one of the goals for the Information Technology Division for 2006. We have prepared a draft proposal as to how we think the Technology Steering Committee should operate and we are currently holding one-on-one meetings with department directors to obtain their feedback. This is planned to be implemented in advance of the 2007 budget development process. 2. Information Technology should be more visible at the Executive level. It is intended that the Technology Steering Committee be a director level committee. We believe that when this is operational it will provide the desired exposure for the Division at the senior management/Executive level. 3. Designate Information Technology as the central point of management for all City systems. We agree. This is the original vision and expectation for IT. Lack of divisional resources and the absence of a strong steering committee have led to the voluntary or otherwise delegation of management for some of these systems. 4. Create service level agreements (SLAs) between IT and the various City departments. We believe that this is a good idea that will help departments understand the level of support they can expect from IT. This will be undertaken with the 2007 budget development. 5. Document Information Technology policies and procedures. We are in the process of revising all of the policies relating to Information Technology. These should be ready in draft form by the end of March 2006. 6. Formalize IT staff performance reviews to ensure that job functions and responsibilities are performed appropriately and can be measured. We agree on the need for this communication process and we will bring the review process back on track in 2006. 7. Allocate funds for Information Technology staff training purposes. There are some funds in the IT budget that are designated for staff training. We will determine the formal training requirements for staff and make the corresponding budget request starting in 2007. 8. Ensure that credit and criminal background checks are performed for all new hires. Criminal background checks are performed on all new hires. Credit checks are performed on certain classifications of new hires. We have spoken with the Human Resources Department and they will initiate credit checks on all IT new hires effective immediately. B. Physical Controls 1. Relocate the City's Unix/Pentamation, Novell, and other production servers to the server room or another secure and climate controlled environment. We concur with this observation, but will not be able to change the physical arrangements immediately. However, this issue will resolve itself eventually. The servers referred to in this item are our older legacy servers. As we move away from UNIX and Novell, these servers will become redundant and the data involved with these systems will be transferred to servers already in place in the 61ft Floor closet. It is misleading to refer to the room where the new servers are located as the "server room" It is actually the 6"' floor telecom closet and was never designed to house servers. Space limitations will prevent us from expanding to a second server rack when the current rack is full. For this reason we are considering any options made available to house the IT Division and its equipment Locations such as Oyster Bay, the old Cencom building and the new Cencom facility have all been discussed for this purpose. A final recommendation will be prepared and brought forward for approval. 2. Install fire suppression in the City of Bremerton server room. There is fine suppression equipment already installed in the 6"' Floor Telecom Closet, unfortunately it is a water fed sprinkler system. It is likely that a discharge of the fire suppression system would cause more damage than the fire. The sprinkler system should be removed or capped in place and a fire retardant gas system installed/provided. We will research the feasibility of such a change with the Housing Authority. 3. Configure all servers to gracefully shutdown during a power outage. This will require new hardware and software to accomplish. We will plan to make this acquisition in 2007 and budget accordingly. 4. Protect access to the City server room. As far as I can ascertain, the following people have been issued keys to the a floor telecom closet.' Kevin Matthew, Network Administrator Bill Eley, IT Manager (shared with 1T staff) Tom Baker, Electrician Steve Reed, Electrician Greg Cryder, Electronics Supervisor Pam Wilson, DCD Front Office Charlotte Belmor+e, HR Generalist Paula Johnston, City Clerk Tom, Steve and Greg require access to the electrical and telephone components installed in the room. Pam, Charlotte and Paula are holders of spare keys to the closet They have no need to enter the space. C. Security 1. Review the process for removing users from the Pentamation financial system. The current form, completed by Human Resources, to remove people from the network and e-mail system, also contains an entry item to remove the person from the UNIX system. This in effect is the remove from Pentamation request. This process will need to be modified when we upgrade the Pentamation system to run in a Microsoft SQL environment. We will provide a list of authorized users and their locations to the Human Resources Department at the beginning of each Quarter in order for them to confirm that our information is accurate. 2. Review the Windows Domain Administrator group to ensure that the proper accounts are given this level of access. This has been reviewed and appropriate action is pending. This topic will be covered in the draft policies due out in draft form by the end of March 2006. 3. Formalize procedure for changing user rights. The current add/delete request form and its successor will be modified to become an add/change/delete form. The form will still be generated by Human Resources. 4. Improve password security for computer resources including administrator level accounts, service accounts, and hardware. This will be addressed in the new security policy and the required changes will be implemented when the policy is accepted. 5. Review the use of the SA password within applications. Same as C4 6. Enforce automatic lockout of accounts after five failed attempts. Again this will be addressed in the new security policy and enforced centrally. 7. Enforce automatic, password -protected screen savers on desktops. Same as C6 8. Conduct independent penetration testing of the network to identify weaknesses. We have already discussed this item with Moss Adams. It is our intention to either squeeze the cost for this out of this years budget or include it in the 2007 budget. It is anticipated that the initial test would be performed by an independent tester, such as Moss Adams. Subsequent testing could then be performed by IT staff. 9. Provide formal security awareness training for City employees. KI We concur with this. We used to have training films that were shown at departmental meetings. However, the subject matter became out-of-date and the films were not renewed. We will acquire a new film library and restart the training process. D. Disaster Recovery 1. Ensure that all data is being backed up. All data that is held on the network drives is currently backed up. At the time of the Moss Adams walk-through we were just (within 1 or 2 days oo bringing a new server on line and testing it. That server was not being backed up at that time and we believe that that prompted this finding/observation. That server is now backed -up on a routine basis. 2. Create a formal disaster recovery plan. This is another 2006 goal for the IT Division. The plan will be created this year. 3. Add an additional Domain Controller to prevent loss of access to the network. This was a budgeted item for this year. The item is on order. 4. Conduct regularly scheduled restoration testing. We do restore from backup from time to time. So far, this has been on an as needed basis. We will add test riles to our data and backup system so that we can routinely test restoration capabilities. E. Monitoring 1. Monitor the servers and network equipment for hardware, performance, and load issues to proactively respond to potential issues. We had funds set aside in the 2006 budget to acquire 3Com's Network Director Software. That software is now on order and will facilitate the above level of monitoring. 2. Actively monitor the UPS system to proactively react to capacity issues before a power outage occurs. The hardware and software referenced in B3 will aid in accomplishing this item. We do not intend that the backup power provided by our UPS(s) will allow continued operation of the network. The primary function of the backup devices is to ensure clean power is received by the equipment served. The secondary function is to allow a grace period sufficient to perform a "soft landing" of the equipment in the event of a power loss. 3. Monitor firewall and other security logs. The recent conversion from Novell to Microsoft has some things in a temporary state of flux. We will get back to firewall monitoring as soon as the entire conversion process is complete and we are back to working with a single operating system. 4. Monitor access to the City's server room using a proximity card reader system. Since access to the room is limited to the key holders listed above, we think that it would be less expensive and essentially more effective to monitor access to the space using a motion activated, remote monitored camera. We will research the cost and availability of such devices and consider what options best address the need for the least cost. 4 F. Workstations 1. Limit or restrict users from having local administrator rights. This is the standard City practice. Recently however, in order to expedite the operating system conversion we have granted administrator rights in technically challenging situations. When the conversion is complete we will return to these isolated workstations and address the issues, so as to be able to rescind those temporary administrator rights that were granted. 2. Encourage users to store files on the network. All of the shared application riles are already stored on the network. Part of the conversion process is to set the default for users' "My Documents" to the network drives. Under the new email retention policy, all emails will be stoned on the network. This will also be incorporated into user training programs to educate City staff. 3. Implement an enterprise -wide anti-spyware solution. We will budget to implement this in 2007. 4. Utilize imaging tools to more efficiently setup workstations. We plan to do this as soon as the network conversion is complete and the number of local administrators is reduced as much as possible. 5. Enforce frequent password changes for use with Virtual Network Computing (VNC). We do not use VNC at present. However, when this happens our remote access policy will contain the complexity of passwords and the frequency of password changes. These will be forced items. 6. Consider an enterprise -wide defrag solution. We will budget to implement this in 2007. In the meantime we will determine a strategy to reduce the level of invasiveness that this process may cause to the end-user. 7. Consider a different licensing program for commonly used software. We have considered different strategies for licensing desktop software. However, it is a good practice to periodically revisit a cost benefit analysis to ensure our decisions are remaining optimal. 8. Utilize banner warnings at login. We concur and will implement. G. Cablina Infrastructure 1. Maintain and provide cable test results to the Information Technology Department after installation. We concur. We will coordinate with Public Works staff who perform this work. 2. Obtain agreement on testing standards prior to testing. Same as G1. 5 3. Do not accept work without a thorough review. We concur. We need to establish a project review process with Public Works Staff. City of Bremerton Wireless Network Security Policy City of Bremerton Wireless Network Security Policy 1 of 12 City of Bremerton Wireless Network Security Policy 1.0 INTRODUCTION............................................................................................................................. 3 1.1 SCOPE............................................................................................................................................ 3 2.0 Security Threats in Wireless Networking......................................................................................... 4 2.1 Eavesdropping.................................................................................................................................4 2.2 Communications Jamming.............................................................................................................. 4 2.3 Denial of Service (DoS) Jamming................................................................................................... 4 2.4 Injection and Modification of Data................................................................................................... 5 2.5 Replay Attacks................................................................................................................................. 5 2.6 Man -in -the -Middle (MITM) Attacks.................................................................................................. 5 2.7 Rogue Client.................................................................................................................................... 5 2.8 Rogue Network Access Points........................................................................................................ 5 2.9 War Driving...................................................................................................................................... 6 2.10 Client -to -Client Attacks.................................................................................................................... 6 2.11 Infrastructure Equipment Attacks.................................................................................................... 6 2.12 Covert Wireless Channels............................................................................................................... 6 2.13 Cryptographic Threats..................................................................................................................... 7 2.14 Dictionary Attacks............................................................................................................................ 7 3.0 POLICY GUIDELINES..................................................................................................................... 8 3.1 AUTHENTICATION......................................................................................................................... 8 3.2 ENCRYPTION................................................................................................................................. 8 3.3 ACCESS CONTROL....................................................................................................................... 9 3.4 ANTIVIRUS SOFTWARE................................................................................................................ 9 3.5 PERSONAL FIREWALLS................................................................................................................ 9 3.6 PHYSICAL SECURITY.................................................................................................................. 10 3.7 LOGICAL SECURITY.................................................................................................................... 10 3.8 INVENTORY, MONITORING AND AUDIT.................................................................................... 11 3.9 SYSTEM ADMINISTRATION /VENDOR RESPONSIBILITIES................................................... 12 3.10 USER RESPONSIBILITIES........................................................................................................... 12 2of12 City of Bremerton Wireless Network Security Policy 1.0 INTRODUCTION The purpose of this policy is to provide guidance for the secure operation and implementation of wireless local area networks (WLANs) and Internet -enabled handheld devices throughout the City of Bremerton (City) environment. Ensuring sufficient security is a vital concern when designing, deploying, and managing wireless networks and devices. When introducing wireless technologies into the City environment, special care and consideration must be exercised since they introduce both comparable vulnerabilities as in the wired world as well as unique vulnerabilities due to their electromagnetic and portable characteristics. This policy provides consistent and up-to-date guidance for implementing secure WLANs and Internet - enabled handheld devices in the City environment, and establishes a comprehensive wireless network security policy that sets the foundation and direction for sound implementation and usage of WLANs and their devices. Since wireless technologies are continuously evolving, it is essential to remain abreast of the current and emerging trends in the technologies and in the security or vulnerabilities of these technologies. This policy is intended to achieve the confidentiality, integrity, availability, and accountability requirements of the City Enterprise data network (wired network) and addresses the minimum requirements for mitigating the risks associated with wireless network device deployment. 1.1 SCOPE The purpose of this document is to provide the City with guidance for implementing secure wireless networks and the use of Internet -enabled handheld devices, whether standalone or connected as an extension of the City Enterprise data network. All offices that connect to the City Enterprise data network must follow this policy guidance since the improper introduction of WLANs in one office can create a backdoor and make not only their data and resources vulnerable, but potentially put the entire City Enterprise data network at risk. This policy provides direction to secure transmissions between the wireless station and an access point (AP). A wireless station, or client, is typically a laptop, notebook personal computer (PC), or personal digital assistant with a wireless network interface card [NIC]. The wireless NIC uses radio waves to connect to the WLAN. The access point, which acts as a bridge between the wireless and wired networks, is typically a wired network interface and bridging software. The access point functions as a base station for the wireless network, aggregating multiple wireless stations onto the wired network. This policy serves as the foundation for a comprehensive risk mitigation strategy that is enhanced by published security standards, best practices, policies, and technologies of the wired local area network (LAN). 3of12 City of Bremerton Wireless Network Security Policy 2.0 Security Threats in Wireless Networking In order to deploy an effective City wide security policy it is important to first initiate and execute a proper threat analysis. Not only is it important to define the potential security threats but also to define what services and assets that need to be protected, as well as the value of those assets, the cost of having them compromised, and what security services are required to protect them. 2.1 Eavesdropping The anonymous attacker can passively intercept radio signals and decode data being transmitted. The equipment used to perform eavesdropping on the network can be as simple as the equipment used to gain access to the network itself. With little or no modification, the devices can be configured to capture all traffic on a particular network channel or frequency. The attacker must be in proximity to the transmitter in order to receive the transmission. These types of attacks are nearly impossible to detect and even harder to prevent. Eavesdropping is used to gather information on the network under attack. The primary goals of the attacker are: • to understand who uses the network • what is accessible • what the capabilities of the equipment on the network are • when it is used least and most • what the coverage area is. This information is needed to launch an attack on the target network. Active eavesdropping is possible when an attacker can connect to a wireless network. Active eavesdropping on a wireless local area network (LAN) normally involves Address Resolution Protocol (ARP) spoofing. Essentially this is a uran- in -the -middle attack (MITM) at the data link layer. The attacker sends out unsolicited ARP replies to target stations on the LAN. The target stations will send all traffic to the attacker instead of the intended destination and the attacker will then forward the packet to the originally intended destination. Therefore, it is possible for a wireless station to sniff the traffic of another wireless client that is out of signal range or a wired client on the local network. 2.2 Communications Jamming Jamming occurs when an intentional or unintentional interference overpowers the sender or receiver of a communications link, thereby effectively rendering the communications link useless. An attacker can apply jamming in several ways. 2.3 Denial of Service (DoS) Jamming Jamming the entire network can cause a denial of service (DoS) attack. Dos attacks on wireless networks may be difficult to prevent and stop. Most wireless networking technologies use unlicensed frequencies and are subject to interference from a variety of different electronic devices. Client Jamming - Jamming a client station provides an opportunity for a rogue client to take over or impersonate the jammed client.Jamming can also be used to Dos the client so that it loses connectivity and cannot access the application. 4nf19 City of Bremerton Wireless Network Security Policy Base Station Jamming - Jamming a base station provides an opportunity for a rogue base station to stand in for the legitimate base station. The jamming can also deprive clients of service or a telecom company from revenue. 2.4 Injection and Modification of Data Injection attacks occur when an attacker adds data to an existing connection in order to hijack the connection or maliciously send data or commands. An attacker can manipulate control messages and data streams by inserting packets or commands to a base station and vice versa. Inserting control messages on a valid control channel can result in the disassociation or disconnection of users from the network. Injection attacks can be used for DoS. Bait -and -switch attacks or midstream insertion attacks are also possible if the upper -layer protocols do not provide real-time integrity checks in the data stream. 2.5 Replay Attacks A replay attack is a breach of security in which an attacker stores and retransmits information to trick the receiver into unauthorized operations, such as false identification or duplicate transactions. Without proper replay protection, it is possible for an attacker to record messages sent during the authentication of a legitimate user and later use these messages to get access to the system. 2.6 Man -in -the -Middle (MITM) Attacks Similar to injection attacks are MITM attacks. MITM attacks can take many forms and are designed to subvert the confidentiality and integrity of the session. MITM attacks are more sophisticated than most attacks and require significant information about the network. An attacker will normally impersonate a network resource. When a victim initiates a connection, the attacker will intercept the connection, and then complete the connection to the intended resource and proxy all communications to the resource as shown in the image below. The attacker is now in a position to inject data, modify communications, or eavesdrop on a session that would normally be difficult to decode, such as encrypted sessions. 2.7 Rogue Client After studying a client in the field, an attacker may choose to mimic or clone the client's identity and attempt to gain access to the network and advertised services. A common wireless security mechanism was supposed to use layer 2 (Data Link Layer) access controls to limit access to resources. This failure was shown in the 802.11 wireless LAN standard with Media Access Controls (MACs) that can be easily circumvented by a skilled attacker. 2.8 Rogue Network Access Points An adept attacker can set up a rouge access point to impersonate a network resource. Clients may unknowingly connect to this false access point and divulge sensitive credentials such as authentication credentials. This type of attack can be used in conjunction with directive jamming to block the ears of the legitimate network access point. Note: Users with access to the wired network may also install rouge access points, unknowingly opening up the network to attacks. Users may install a wireless access point seeking the convenience of wireless without knowing the security concerns. These access points can serve as backdoors to the wired network because they are normally installed with the default configuration so they are wide open to attack. Attackers can easily connect to these access points and have the same access that a wired user would ..; of 19 City of Bremerton Wireless Network Security Policy �.�■ice ..��r+� have. Most networks rely on firewalls for perimeter security and are not prepared for an attack from an attacker on the inside. 2.9 War Driving War driving is the process of searching for open wireless LANs by driving around a particular area. Note: War driving software is freely available on the Internet.. Many attackers are searching out networks not to attack internal resources, but to gain free anonymous Internet access. One important thing to note here is that the access can be used for a malicious attack against other networks, thus making you liable for damage inflicted against other networks. 2.10 Client -to -Client Attacks Once on a network, other network clients can be attacked directly. If successful, the attacker may gain the credentials required to gain further access into the corporate or telecom network. Successful attacks on wireless -connected clients may reveal sensitive information such as the username and password that can be used to access other network resources. All Internet or wireless -connected stations need to be adequately hardened. 2.11 Infrastructure Equipment Attacks Incorrectly configured infrastructure equipment is a prime target for attackers and usually provides a means for attaining further penetration into the network. These are sometimes referred to as stepping stones and can be used to bypass access controls. Network devices such as routers, switches, backup servers, and log servers are prime targets. Many network administrators rely on layer 2 security mechanisms such as virtual LAN's (VLANs) to keep wireless networks separate from wired networks. There are many documented attacks that can be used to bypass VLAN security. There are many attacks depending on the switch, but they break down into three main categories: switch attacks, MAC attacks, and routing attacks. Switch attacks take many different forms. Some involve flooding the MAC or ARP table in the switch to cause it to fail open. This attack is often caused inadvertently by administrators choosing a low -quality switch. Other attacks against the switch involve manipulating the protocol that switches use to communicate such as spanning tree. MAC attacks include ARP spoofing and other physical layer attacks that can be used to fool network devices into sending the data to unintended recipients. Routing attacks are very difficult and normally involve participating in the routing protocol, such as Open Shortest Path First (OSPF) or Enhanced Interior Gateway Routing Protocol (EIGRP), to change the flow of traffic for DoS or sniffing. 2.12 Covert Wireless Channels Wireless implementers must consider when evaluating or designing a wireless network. Due to the low cost of wireless access points and the ease of creating software -based access points consisting of a standard desktop or laptop computer and a wireless NIC, one must be vigilant in detecting incorrectly configured or unintentionally deployed wireless equipment on the wired network This equipment can poke very damaging holes in the fabric of the wired infrastructure, which will be exposed to attackers within several miles of a target network. Anf19 City of Bremerton Wireless Network Security Policy 2.13 Cryptographic Threats CDMA and GSM cellular networks and wireless Ethernet networks have employed cryptographic mechanisms in order to deter eavesdropping and stymie unauthorized network usage. However, in both networks, oversights resulted in the compromise of communications and fraudulent use. Wired Equivalent Privacy (WEP) is a cryptographic mechanism designed to provide security for 802.11 networks. Implementation flaws and key management issues have proved WEP almost useless. WEP was designed with a single static key that was to be used by all users. Controlling access to these keys, changing the keys frequently, and detecting compromises is nearly impossible. An examination of the implementation of the RC4 algorithm—in WEP has revealed weaknesses that enable an attacker to completely recover the key after capturing minimal network traffic. Tools are available on the Internet that allow an attacker to recover the key in a number of hours. Therefore, WEP cannot be relied on, by itself, to provide authentication and confidentiality on a wireless network. 2.14 Dictionary Attacks Also known as brute force attacks. Passwords and encryption keys created by a human being often include a name or a word that has some form of meaning. A dictionary attack exploits this fact and uses a dictionary to try to find the right password. A computer with a reasonable amount of computing resources could easily, within minutes or hours, guess a password. It is therefore important to define a strict password policy, requiring the passwords to be of a certain length and complexity. Also, the security system should be able to detect a dictionary attack and take proper actions, for example locking out the user account that is being attacked. 7of12 City of Bremerton Wireless Network Security Policy 3.0 POLICY GUIDELINES It is essential that the following policy guidelines for wireless connectivity to the City data network be observed to ensure the security and integrity of the City-wide systems. All wireless network devices and technologies that provide a bridge between the City Enterprise data network and the wireless network, or any device that is designed to communicate with such a device via the wireless network that do not comply with this policy shall not be permitted to operate. All requests and accompanying justifications for wireless connectivity shall be thoroughly reviewed and approved by the City Information Systems Office (IS) before deployment. Only wireless devices and City -owned access points that have been authorized by the IS will be permitted to operate and connect to the City Enterprise data network. As part of the overall defense -in-depth strategy of the City IS, both the wired and wireless networks will be monitored for unauthorized use or devices. WLANs and wireless devices existing throughout the City environment, or connected to the City Enterprise data network, before the establishment of this policy will be audited by the City IS and required to meet the standards set forth in this policy to continue operating. 3.1 AUTHENTICATION This security service verifies the identity of communicating client stations and provides access control to the network by denying access to client stations that cannot authenticate properly. All wireless devices must positively authenticate the network. Digital PKI Certificates will be installed on all wireless device clients. These certificates will be used by the network to authenticate the device. All wireless devices must be positively authenticated by the network. Digital PKI Certificates will be installed on all authentication servers. These certificates will be used by the wireless device to authenticate the network. All wireless device users must be authenticated to the network using personal user id's and passwords. If a central authentication server or VPN gateway is used in the WLAN architecture, each wireless user must uniquely and successfully authenticate to the WLAN. Wireless device users must use strong passwords (alphanumeric and special character string at least eight characters in length). All wireless users must logon to the City Enterprise data network services as a separate step from the WLAN authentication. 3.2 ENCRYPTION All WLAN traffic must be encrypted to limit eavesdropping and ensure confidentiality. All Wireless Access devices connected to the City Network will conform to the Wil'i Protected Access 2 standard and shall employ 802.11x/EAP authentication and AES-CCMP encryption (WPA2-Enterprise mode). 9nf19 City of Bremerton Wireless Network Security Policy All wireless handheld devices must encrypt information leaving the device for an adequate level of protection. Wireless device default settings must not be set to "no encryption." Sensitive data and application data files stored on handheld devices must be protected with robust encryption and password protection utilities. It is required that sensitive data files be deleted from the handheld device once they are no longer needed and archived on a desktop PC. Data residing on external storage modules should be encrypted and stored in a secure manner. 3.3 ACCESS CONTROL All access to the MAN system, including its data and resources, shall be restricted unless authorized by the City IS. Data traversing wireless networks and data accessible via wireless entry must be protected from unauthorized access, use, modification, or deletion using access control methods. To mitigate data leakage, Infrared (IR) ports must be disabled during periods of inactivity. File sharing on wireless client devices shall be disabled. Wireless client devices shall only operate in infrastructure mode. (Ad Hoc mode disabled) Non -City employees, excluding approved vendors and contractors, must not have access to WLANs that connect to the City Enterprise data network. Service Set IDs (SSIDs) must be changed from the factory default to something that is meaningless to outsiders. SSID character strings must not reflect names, locations, or products being used. Broadcast mode of SSIDs must be disabled in products that permit it so that the client SSID must match that of the access point. Where possible, the wireless network should be configured with the longest beacon interval. The authentication server, firewall, and/or VPN gateway must enforce access control mechanisms. 3.4 ANTIVIRUS SOFTWARE All WLANs and handheld devices must utilize antivirus software as directed in the City Security Policy. Antivirus software for handheld devices shall scan all entry ports (i.e., beaming, synchronizing, email, and Internet downloading) as data is imported into the device, provide online signature update capabilities, and prompt the user before it deletes any suspicious files. 3.5 PERSONAL FIREWALLS Personal firewall software helps mitigate threats of confidentiality, integrity, and authenticity of information being transferred over the Internet. anf97 City of Bremerton Wireless Network Security Policy �a It is highly recommended that WLAN client and handheld devices utilize personal firewall software. Users that access public wireless networks (e.g., in airports, conference centers, coffee shops) should install personal firewall software on all WLAN client and handheld devices. A personal firewall protects against wireless network attacks and rogue access points (e.g., Ad hoc networks, accidental or malicious association, soft access points) that can be easily installed in public areas. 3.6 PHYSICAL SECURITY The physical security of all wireless access points and handheld devices is the first line of defense in WLAN security. It is essential that proper physical countermeasures be in place to mitigate risks such as theft of equipment, insertion of rogue access points, and wireless network monitoring devices. Access points must be physically secured upon proper configuration to prevent tampering and reprogramming (i.e., to prevent unauthorized physical access). Access points must be placed in secure areas, such as high on a wall, in a wiring closet, or in a locked enclosure to prevent unauthorized physical access and user manipulation. Devices must not be placed in easily accessible public locations. To mitigate eavesdropping, access points shall be placed strategically within the building so that the range does not exceed the physical perimeter of City -controlled facilities and allow unauthorized users to eavesdrop near the perimeter. Access points shall be placed to minimize or prevent the distance that the signal can travel outside the area that is under the control of the organization, including buildings, court yards, adjacent parking areas, etc. In areas where utilization is not required on a 24 hours per day, 7 days per week basis, access points shall be turned off during all hours during which they are not used (e.g., after hours and on weekends) to minimize potential exposure to malicious activity. The transmission power of WLAN access points must be restricted to the lowest power required for coverage. In the event that the reset function of an access point is used, the device must be restored to the latest security settings. Wireless handheld devices and Network Interface Cards (NICs) must be physically protected from loss and theft. Wireless handheld devices, backup modules, and NICs (e.g., laptop computers) must be stored in a secure area, such as a desk with drawers that lock, or a file cabinet that locks when they are not being used. 3.7 LOGICAL SECURITY All wireless LAN access points and handheld devices must be authorized. All access points shall be logically separated and isolated from the City Enterprise Data network, such as on a different segment, in a demilitarized zone (DMZ), or in a virtual LAN (VLAN). 1n of 12 City of Bremerton Wireless Network Security Policy �.a W� WLANs must be treated as insecure counterparts to their wired associates. Access to resources on the wired network must be restricted. All access points must be firewall protected outside the wired network. Placement of access points and channel assignments shall be such that coverage/throughput is maximized while interference (denial of service) is kept to a minimum between different access points or WLANs. Access points shall be physically situated so that authorized users can connect, yet away from sources of interference such as microwave ovens and Bluetooth devices. To keep interference to a minimum, access point channels shall be at least five channels different from all other nearby access points on different WLANs. Some coordination may be required if multiple WLANs are to be used within close proximity. All insecure and nonessential management protocols shall be disabled. If SNMP is turned on for management purposes, the SNMP Community Strings must be changed from their manufacturer default to unique and difficult to guess strings. SNMP settings must be set to least privilege (read only). Web -based management of access points shall be from pre -defined management stations controlled by access lists on the access point. SNMP requests shall only be accepted from specified management devices. SNMPv3 products or equivalent cryptographically protected protocol shall be used since they include mechanisms to provide strong security. 3.8 INVENTORY, MONITORING AND AUDIT All wireless access points must meet the current security configurations established by the City IS. All wireless LANs and handheld devices must be routinely monitored and security audits performed to verify that security configurations comply with this policy, access points and wireless devices are authorized, and to identify unauthorized activity. The City IS will conduct yearly audits of access points to ensure that security configurations conform to this policy and to maintain a current inventory of the devices. If DHCP is used in the environment, logs shall be reviewed for static addresses to determine if rogue access points have been installed. Access logs and system audit trails shall be routinely monitored. The City IS will conduct routine controlled penetration tests or packet sniffing/wireless traffic analysis on WLANs and within the coverage area. All access points must have Intrusion Detection Systems (IDS) at designated areas on House property to detect unauthorized access or attack. Procedures must be established and followed for the inventory and control of wireless devices and equipment. City of Bremerton Wireless Network Security Policy 3.9 SYSTEM ADMINISTRATION/ VENDOR RESPONSIBILITIES It is the System Administrator's / Vendor's responsibility to ensure that Wireless LANs and devices meet the technical standards outlined in this policy at all times. System Administrators / Vendors are required to operate Wireless LANs and devices in a secure manner. This includes, but is not limited to, proper authorization and termination of access, proper configuration and placement of wireless components and associated security technologies, routine, random, and event -driven maintenance, support monitoring and audit functions, etc. System Administrators / Vendors are required to change factory default settings and use strong administrative passwords on all wireless devices to ensure a higher level of security. (On some wireless devices, the factor default password is blank.) All insecure and nonessential management protocols must be disabled. To the extent possible, System Administrators / Vendors shall ensure that their wireless implementation and associated security technologies are up-to-date with evolving standards and best practices. Client NICs, access points, and handheld devices must support firmware upgrade so that security patches and upgrades may be fully tested and deployed as they become available. System Administrators / Vendors are required to maintain a list of authorized wireless device users to enable them to perform periodic inventory checks and security audits. 3.10 USER RESPONSIBILITIES It is the wireless user's responsibility to comply with this policy. Wireless users must only access information systems using approved wireless device hardware, software, solutions, and connections. Wireless device hardware, software, solutions, and connections that do not meet the standards of this Policy shall not be authorized for deployment. Wireless users must act appropriately to protect information, network access, passwords, cryptographic keys, and wireless equipment. Wireless users are required to report any misuse, loss, or theft of wireless devices or systems immediately to the City Information Systems Help Desk at (360) 473-5475. a� m in c t/l U m o a � r7LgpF r I C - P" � a CC U Cg � Q�y✓j� r � � O C6 cc a aLL- V <>7 :o GO .o LZ m HI \ � f a)u / � 2 � t 0 E .$ 15 7 co � a :# _ :o ,\ .3 1± 3 � g 3 � E 0 � a) q @ E » co m % q o _j U LLJ Z 1:4 & 2 C) $ E � +7 @ ƒ §t�-)k T-7-aj \ � f a)u / � 2 � t 0 E .$ 15 7 co � a :# _ :o ,\ .3 1± 3 � g 3 � E 0 � a) q @ E » co m % q o _j U LLJ Z 1:4 Y O W Z w W I- D CL O U Z O H tY W 2 W m LL O I N O LL I ci 0 m 3Z c O U CL .N.. ♦ M ♦ Y O W Z w W I- D CL O U Z O H tY W 2 W m LL O I N O LL I ci 0 m 3Z •• X � ,`�� I '� 1 �. � lam° 1 Ot � a ca w ♦ M v d Y ♦ U ♦ I I = I N U O m O C13w � U ii V - c 0 cc cc CO Y a ii O tm � c E L 0 CD E L 0 LL 3 E 00t C iL D0 C U. O Z co U� U 0 o n Z Z LU 4) U - IL c ii U Ld rn 0 a V EcacD N Z U O UA N Cl) 1 wLL o (n a) o a a 1 m Ocn c LL a N E O as �m O U N V 00 a0 0CO C Z- I I admm cd J cd 'd Z cl Nc� ri 16 mv U2, --------------------------------- I I -W M: o old o M 6. Uo ':I FS *0644400 c4 ............ M ---------------------------- admm cd J cd 'd Z cl Nc� ri 16 mv U2, I I -W M: Uo ':I (\ 9, (n z w a LL z 0 a X [SNI r om ci c p Ery O Qa tL LL N Y -------------------------------- U EE 81:1 ES Si O O wit m m ?O� N o;; vamam wv N am LL C U O E N --------- - - - --- N � ` X to m SA fV w N 'Op C) Eby O � r om ci c p Ery O Qa tL LL N Y 8 •LL N J a z w 0 LL �z O U ai �f —ai ® miss z LU ILL O �J OG L� LJ d' �� m ! x= a o LL V a S f Oa o m o�V co I J% ! § I Io 1� fid Y � Q r z LuI in LL z D Ui v e all C3 J Q Z W ko LL �Z 0 U INFORMATION TECHNOLOGY AUDIT Technology Standards 12/02/05 Current Standards Desktop Intel Based PC, 3GHz, 1GB Memory, 80GB HD, CD Burner, 17" LCD (Dell) Windows XP Professional MS Office 2003 either Basic or Professional depending on user. Older PCs are Intel based 1.7GHz or 1.6GHz (IBM or Dell) Windows 2000 Professional MS Office XP Professional Rack mounted Intel Xeon 2.8MHz processors, 146GB HD RAID 5 (Dell) Windows Server 2003 or 2000 Older Servers are either SCO UNIX or Novell 4.2 Database Microsoft SQL Older database applications running on Informix database Network_ Hardware 3COM Gigabit enabled Ethernet switches, 100Mb or IOMb to the desktop. Single Mode Fiber I -Net between buildings C k f 2 § §E f§ X08 /CD £ (D ©kSE zmkf = u §Rw }3C;) 2kk f%» <Oo § \ §$Co u e o� %� 2(D =J �L 'E o$� J2 k s 5 = k �§ @£ .� Q(D \� a)\ a � ® e o (D . �k o{ a$2 t/aa38k I$�zaLL =r-k��a 2-_ o 2 q= x oE��. zwmoD § m 0��«v 22 . � -j22020000 LLLLLLLLU-LLLLLLLL =_=_r-____ eeeee§eco @n LO e P u') nM _k ogee§k �§ k)��k)kL) z z z z � \\ CL T00000<<mo £��0 LO �§§�§g2o § @ - - 9 0 a EoR��3vvvk a �_$(D ©k ` �k © aO00C) z§Q=zn@aE :t--10 5o 60M(nmmv2e 5o zommmm<-J= a) c CL a) za) C� U J (n N fa t6 %f Z f Z Z a� W z a) a) CD o 0 C O U n Jpcu CL< cu C C L L a°)i ami `C `t UU-j_3 � N CO It N yJ U) O U) CN .ai U LO N 06 CL z`o p U U dC 0 2 Q o a p x Z — N M I C-7 J'vO O N U � cU a) 'ca E� O D U O O U u) U Q U L U a) aN a) Z �� •` fl.ana iia LO- 000 clli 0(D0U CV ce) d LLq �[ f6 O N m l` U 4 Z E / / r . Z fu U) U) am) �o (D c c� C C r N Cy U rn �Nc"7 r T ca 0) ..III cI1 v U s.�I c w m E c: D � N Q CL L) E< L N d � Z a x w a U. x 0 0 CITY OF BREMERTON INVENTORY OF WORKSTATIONS/LAPTOPS AND THEIR FUNCTION December 1, 2005 Attached is a list from the 2006 budget document which lists by department the number of PCs that are assigned. This list excludes the MDTs in the police cars and the fire engines. All computers have MS Word, MS Excel and GroupWise email. Each department usually has someone with an accounts payable function and may have other financial uses. Some departments use their computers for time records. Some specific functions include: • Police department — Report writing by the officers and maintenance of case records by the records section; a work schedule program • Municipal Court — management of court cases and parking tickets • Fire department — fire incident and ambulance call reporting • Parks department — scheduling of recreation programs, use of facilities, and payments of fees • Public Works — some computers have engineering software used for design of various types of improvements and systems and some have GIS capabilities • Water Resources — maintains a data base of water production, rainfall, etc. • Community Development department — management of building permits • Human Resources — maintain the employee master files • Finance department — operate the financial system and control access to it • Council, Finance, Clerk — records and document management and retrieval (((C!C4 �((Op•c0o��(pp . (OOCOtiNC0(C!, 1t(cUppCRC"!(p.Nrr":(P . ("IP.: . .C4 N �0)00)v0co ,O)0) (3) D 0)(V)COi_1 co O CD�o»ITN( w-*Nmq� O� NNO»1wcV) OpMjNNor cCOOONw�tiN�hC*4 CM ItC14 04 N� �NvNh(M V- Co O O O Cl O O O O O �pC3 to t � I Iq N N O �O N N N r co O N m t ar O V. O O O O O O O O ao 000 o go 0 a0 000 O 00 O 3C� 070N h NCD O V- r r O CD z w C CL W OM(ON woo mocnl( WMC3N W"mN(OO(nh."wmwwf,-mmm O ON(ONO c?NOCDMOhCDCDOmtMrq(nNgNhCDh(nCOM �CAC7r('7(��(7Mr (hCD('7CD CO CU�CV CD CO (O ODs�(O('7r('� � CAh � i- (O Co (O N N (O (O CD (O (O p r N CD 4 NN N O (7 N W W w CO m CO O v m ®IM rMC-4 r 00 V) V�N(+SgCDqwhCV) r T - VI - V ONO r N r r M CA r O. E O 0 (O�p M�p NO(O(O Mt00(OCDCA ++M O(AOrCA0000CA0�'t() ��pprtnrCV CV �e=t�r((� rCD(G OON OOCOOtpN O(OOOh r CD � CD h M CD CD � CD h CO CO N V tD (O C4 (p r W CL m d E 0 v 9LQq �CMOLPU� Cl (D CA r-kn ODDN�CND�CODIVCOottL CN01W)(OONN rNOrrhefNMr NMCM CA r CA NN CDNvONN(ONON(pCOavWv Ov"c g V wNoosAzgwwa rON OOOOrNOCOO(p00(OhOCA(OMMOONCOhM O hyo~ ��ot�-h�• ChO��N(p��NNcp��c'OC�D�tiChDtiNCDN�(r(pp�[ D. � CA 01 OCA CD CA CD O CA t0 O h O O CA CA CD O CA � CD 01 O CA O CA CA CA CO CA CD Of h =MM�MI-C mmM Mmm( LAO)hrh(p►�MCbOfh(�MrMr1`rr(A(p N N N O M r r N CD r r r r r N O O W O NNrNqtONNrNON(OMO`R(OgM V NOOCA V Nr NCDCnCDrMO r r r M r r r r r (n N (A V _ E N (n N CL $ of V> '' Q A € N N Q Q1 a O = .r > C N o �'o Urns°' Z ��(000rn ma.is owwcz >= my�Zv= M 3= x o o� �i'w o 0 o033�33��3�0 sILL EUm5580�d-wwwu.U.(D a-0-cnacnaaaaaaaaaaaf- X335 1. N U 7 O C (n 0 c o E 0-.2 N V ~ Q•V—o-N CL 0 c no' Q(a m [C E L �CL �L- NCO :3Fx.9 ca Cl U co 2 Z CV c+M d' cn 7 V Ri 1 ca I m ( CD CIa N D Q) u7 03 CO N> 1 v ro O o r cu _'C]Q❑ ''^^ ^^L ''^^ CN Z U_ U_ N 5U) c N O ❑ a] a) cE cC 0) E Q) cn LL❑J U E � CJUJJ x0 r CVch Wco �- N M d `m a`r Z Inni L� uU'>� _ i 'rr)O CO Nn7 47 Q'n ncli ❑ j +O+ cc 9z C d � N i it O R LO X 6a C I L cu Er 7 V Ri 1 ca I m ( CD CIa N D Q) u7 03 CO N> 1 v ro O o r cu _'C]Q❑ ''^^ ^^L ''^^ CN Z U_ U_ N 5U) c N O ❑ a] a) cE cC 0) E Q) cn LL❑J U E � CJUJJ x0 r CVch Wco �- N M d `m a`r Z Inni L� uU'>� _ i 'rr)O CO Nn7 47 Q'n ncli ❑ J Q 1- Z W 0 LL Z O U v CITY OF BREMERTON City Hall Govt Ctr Key Chart 1-12-05 DEPARTMENT: Room # Card # Parking Bldg. RM KEY DEPT KEY 6th FL GATE MSTR KEY Mayor Bozeman 634 1360 X X X Elaine Valencia 636 1155 X X X X Patty Graf -Hoke 633 1257 X X Storage 635 X Conference Room 637 X Balcony off Mayor's Ofc Balcony off Conf. Room Carol Conley 632 1158 X X X Charlotte Belmore 643 1157 X X X Rob Tomlinson 644 1156 X X Storage Finapcial'Services %+ :::•:, , . Laura Lyon 640 631 1016 X X X X Cathy Johnson 630 1169 X X Paula Johnston 629 1170 X X X Mark McLaughlin 642 1147 X X X Terry Fischer 647B 1148 X X Jeannette Wischhoefer Steve Nute 647I 647G 1176 1163 X X Mavis Dick 647H 1165 ADA X Karla King 647C 1162 X Felicia Brown 647F 1160 X Judie Carlson 647E 1164 X Andrea McCracken 647D 1582 Cherie Henry 647A 1166 X Storage 648 Reception Community Development Chris Hugo 645 618 1183 X X X Jim Svensson 621 1181 X X X Andrea Spencer 619 1350 X X X Hugh Morgan 628 1177 X X X Janet Lunceford 616 1184 X X X Nicole Ward 624B 1578 X Geoff Wentlandt 624A 1368 X Betsy Howe 624D 1201 X X Pam Wilson 624C 1178 X X X X X JoAnn Vidinhar 624G 1367 Larry Craze 624H 1174 X 624I X Pat Conroy 624J 1172 X Val Wolf 624K 1171 X Code Enf Veh #338251) 1127 X Bldg Insp Veh #319741) 1128 X Storage Entry Office Suite 604 11 Council Office 607 11 Daren Nygren 1146 X\ Cecil McConnell 1143 X Diane Robinson 1390 X Mike Short 1139 X f Mike Shepherd 1140 X f 61- C C CITY OF BREMERTON City Hall Govt Ctr Key Chart 1-12-05 DEPARTMENT: Will Maupin Room # L Card # 1142 Parking X Bldg. RM KEY •DEPT KEY 6th FL GATE MSTR KEY Carol Arends 1351 X Wendy Priest 1138 X Brad Gehring 1141 X 1 Lori Smith 606 1190 X X Christine Grenier 604 1145 X X Storage 605 Roger Lubovich 608 1565 X X Dave Horton 609 1188 X X X Ken Bagwell 610 1312 X X X Peggy Lesser 611 1186 X X Thelma Swem 614 1185 X 2 Storage evelopme Office Suite 615 6 - x Gary Sexton 408— 1117 X Alyce Fierro --564— Conference Room Information Technology! Bill Eley e405 -- 509 1152 X X Kevin Matthew 512 1151 X Geoff Schaffer 510 1149 X Dave Buffington 510 1 1150 1 X David Sorenson 510 1115 X Storage Room 511 IT Veh # 10441D Gary Nystul Al Duke 504 1126 1154 1122 X X X x Phil Williams 1567 X Jorma Koehn 1121 X Ken Mickelson 1124 X Bob Tulp 1395 Jeff Collins 1196 ✓ Fire Dept. 1116 Craig Cryder (Oyster Bay) 1566 Don Bellmore (Cochran) BKAT 112 X BKAT 111 x Paula Johnston 1209 X Paula Johnston X 42 Information Technology Strategic Plan Planning Information Technology for 2002 and beyond Prepared by Tami Brazell July 3, 2001 Page 2 Table of Contents Executive Summary 5 Section 1. Planning for Technology 9 Goals 9 Objectives 10 Challenges 10 Section 2. Current Technology Environment 11 Technology Based County Services 11 Systems and Application Architecture 11 Database Architecture 14 Desktop Hardware and Applications 15 Data Communication Architecture 16 Section 3. Information Technology Initiatives 17 Outstanding Technology Initiatives for 200117 Proposed Technology Initiatives for 200218 Proposed Technology Initiatives for 2003 and Beyond 23 Section 4. A Vision for the Future 26 Looking toward the Future 26 Implementing Information Technology 27 Strategies for Technology—based Decisions 28 Conclusions 29 Appendix A Hardware Inventory 31 Appendix B Application Inventory 35 Appendix C Database Standards 43 Appendix D Technology Assessment by Department Contributors 47 Appendix E Six year Microcomputer Study 51 Appendix F GIS Assessment 67 Page 4 Kitsap County Information Technology Strategic Plan Executive Summary This executive overview highlights the recommendations identified in the Information Technology Strategic Plan. The main body of the report provides the background for these conclusions along with a detailed plan for their implementation. Overview of Approach The Information Services and Purchasing Division was tasked by the County Administrator and Board of Commissioners to provide a document to assist with the long term planning of information technology at Kitsap County. Information Services and Purchasing worked with the Technology Committee, represented by the following departments, agencies and individuals: Karen Flynn, chair Auditor Jim Avery Assessor Maury Baker District Court Madelyn Botta Superior Court Steve Boyer Sheriff Randy Casteel Public Works Dayle Crane Probation Ned Delmore Juvenile Malcolm Fleming County Administrator Bruce Freeland Community Development Bert Furuta Personnel and Human Services Cris Gears Parks and Recreation Russell Hauge Prosecuting Attorney Dean Logan Clerk of the Court Ron McAffee CENCOM William Nogle Administrative Services William Perrin Information Services and Purchasing Greg Sandstrom Coroner's Office Sharon Shrader Treasurer Louise Turner Cooperative Extension The Technology Committee was tasked with providing feedback regarding their needs, desires and vision for information technology within their department and countywide. Appendix D is a summary of the Technology Committee's needs assessment. Utilizing this information, along with an assessment of the present technology environment of Kitsap County, this document identifies opportunities for improving, expanding and embracing new information technologies. Page 5 Assessment of Cuffent Technology Section 2 of this document assesses the technology based services and infrastructure at Kitsap County. It provides a review of the current information technology environment and existing standards for hardware, data communication, databases and application software. The strategies for managing each of these areas is discussed. Strategies for Managing Systems and Application Architecture Systems and Application architecture can be broken into three basic categories—host based, distributed and stand alone. Kitsap County s hardware inventory is found in Appendix A, while the Application Inventory is found in Appendix B. Standards and strategies for replacement include: ■ Plan for replacing or moving host -based applications to a distributed environment as end of Iffe approaches for hardware and/or software platforms. ■ Continue efforts to standardize the platforms for hardware, database and application development to further lower the total cost of ownership. ■ Choose platforms with a high market presence to obtain better price competition, improve availability of tools and integrated solutions, and enhance availability of qualified staff and oontract/oonsultants. ■ Identify opportunities to improve service levels through hardware and data redundancy. Examples of this include the use of storage area networks and database replication strategies. Strategies for Managing Database Architecture The Database Standards in Appendix C outline strategies for managing data, data models and relational database management systems within Kitsap County. To summarize, the database should meet the following requirements: ■ Relational Database Management System (RDBMS) Compliant ■ Structured Query Language (SQL) Compliant ■ Open Database Connectivity (ODBC) Compliant ■ Open Systems Compliant Oracle meets all of these requirements and is the standard product for database management and development. SQL Server meets the first three requirements, and maybe implemented when the advantages of its use outweigh the disadvantages of varying from the standard platform. Strategies for Managing Desktop Hardware and Applications The Six-year Microcomputer Study in Appendix E outlines Kitsap County s strategy and standards for PC based hardware and software acquisition and support for the next six years. These are the highlights of that strategy: ■ Continue to standardize and acquire 'Tier I or II" microcomputers. ■ Assume a microcomputer life cycle of four years. Page 6 ■ Continue to acquire Microsoft Office Professional for each microcomputer. ■ Institute a formal software licensing tracking program. ■ Acquire work group or departmental printers wherever possible ■ Replace printers during the five to seven year period. ■ Select scanners that can meet the production requirements. ■ Continue to use remote management tools. Strategies for Managing Network Architecture ■ Continue to monitor and ensure balance regarding application needs, desktop needs, and the backbone architecture and speed. As the user needs increase and create more/bigger data traffic, the back -end platforms need to have faster and multiple network connections. ■ Monitor technology evolution to cost effectively improve network throughput to remote locations such as Silverdale, Poulsbo, and Bremerton. Current key issue is the performance of the Sheriffs Records Management System from Silverdale office. ■ Pursue Wireless for both in -building convenience and County staff needing "Portable Office" capabilities. Current concerns with Remote Access center around security. ■ Closely monitor the explosion of Web -enabled cell phones and PDAs. Identifying the market leader may be difficult early on. Hitching -on to the wrong choice, or too many choices, could be expensive in the long run. ■ Maintain model for security that protects against both external and internal threats. Assessment of Technology Needs The Technology Committee and Information Services have identified a number of new requests for technology and opportunities to improve the existing applications, systems and data communications infrastructure. Section 3 outlines the proposed strategic technology initiatives for Kitsap County for 2002 and beyond. Vision for the Future We can identify basic strategies for maximizing our technology resources and implementing technology with a positive net value to the County. When addressing technology-based decisions, applying these principals and strategies enhance our opportunity for success. ■ Minimize the variation of hardware platforms, operating systems, network infrastructure, database and application development platforms so that depth of technical staff knowledge is attained and cross training maintained more easily. ■ Minimize support issues by standardizing the desktop configurations and software interfaces (the look and feel of an application). Promote self-sufficient users through user-friendly interfaces, authentication, applications and training. This lowers the total cost of technology ownership. Page 7 ■ Identify and establish Best Practice standards and methodologies for technical support, application development and support, database management, disaster recover, and change management in an effort to standardize support efforts and lower total cost of ownership. ■ Use technology that has a high market presence. This presents greater opportunity for long term viability of the product or platform, lowers costs for support in terms of maintenance contracts, integration tools, and potential employee base. ■ Provide seamless integration and data sharing between applications. Identify opportunities to share data between departments and applications to promote data consistency and integrity. ■ Take advantage of commonalities among department needs by utilizing generic solutions and customizing and/or integrating these solutions for each department. ■ Evaluate and utilize efficiencies in out -sourcing where it lowers the total cost of ownership. This may be applicable to multiple aspects of Information Services - hardware support (as evidenced by the out -sourcing of PC and printer maintenance), software development (the buy or build dilemma), or technical support of legacy systems ■ As technology evolves update the security model to continue to protect the County's information resources. ■ Provide increased public access to information by expanding E-Govemment services on the Internet. ■ Build on Application/ Web Server Infrastructure to accommodate increasing demand for web -based information services both internally and externally. Page 8