Okaloosa County BOCC — April 5, 2016 — Letter of Engagement for IT Risk Assessment — reading text

INFORMATION TECHNOLOGY RISK ASSESSMENT PROPOSAL OKALOOSA COUNTY BOARD OF COUNTY COMMISSIONERS MARCH 16, 2016 TABLE OF CONTENTS About Us ………………….……………………………………………………………………………………………………………………. 3 Executive Summary ……………………………………………………………………………………………………………………….. 4 Scope of Project: Summary ……………………………………………………………………………………………………………. 5 Scope of Project: Detail …………………………………………………………………………………………………………………. 7 Fee Schedule ………………..……………………………………………………………………………………………………………….. 9 Responsibilities ……………………………………………………………………………………………………..………………………. 9 Project Team…………………………………..…………………………………………………………………………………………….. 10 2 Warren Averett Technology Group Resource Center: Toll‐free: 1‐888‐419‐9090 ▪ email: resource.center@watechgroup.com ▪ learn more: www.watechgroup.com ABOUT US Warren Averett Technology Group, LLC (WATG) is a leader in software solutions, managed IT services, and security consulting. Since its inception in 1999, Warren Averett Technology Group has worked to maintain the highest possible level of client service while continually improving in our ability to deliver true technology solutions to our customers. Our mission is to provide innovative information technology consulting services of exceptional value and superior quality to those we serve. We strive to do so in a way that:  Recognizes our clients as our most important asset  Fosters an environment that enables our team members to reach and contribute to their full potential  Fulfills the highest standards of our profession, our clients, and the public, and continually strives to set and uphold the highest ethical standards  Provides rewards to our team members for their contribution to the Firm WATG recognizes the importance of maintaining a team of highly skilled individuals, and we have invested in the most current training and certification programs to ensure that we are providing the best service possible to our clients. Our team of 50+ members possesses qualifications and industry recognition in all areas of software and managed IT services including but not limited to Intacct, Intuit, Microsoft Dynamics GP and Sage Software along with network design, security and auditing. Warren Averett Technology Group has carefully and strategically aligned itself with industry leading manufacturers, developers, and service providers including Microsoft, IBM, Intuit, Lenovo, Level 3, VMware, Tech Data and others. These strategic partnerships allow us to design and engineer the best possible solutions for our clients, and they extend our depth and support capabilities to virtually any location or business. Working with many different organizations and industries, Warren Averett Technology Group is committed to providing enterprise level IT services and to delivering solutions that help our clients focus on growing their businesses by using technology. About Warren Averett, LLC Warren Averett has grown substantially over the last few years to become one of the largest accounting firms in the Southeastern region, ranking among the top 30 firms in the United States. With more than 800 employees and 350 CPAs, Warren Averett offers clients depth and experience in a variety of industries including healthcare, manufacturing, financial services, construction, real estate, aerospace and defense, life sciences and technology, nonprofit and public sector, with services that span beyond audit and tax to include wealth management, staffing and recruiting, technology consulting, financial outsourcing and retirement plan administration and investments. Our 15 office locations include Birmingham, Huntsville, Montgomery, Mobile, Cullman, Anniston, Auburn, and Foley, Ala., Pensacola, Fort Walton Beach, Destin, and Tampa, Fla., Atlanta, Georgia; and affiliate offices in Houston, Texas and the Cayman Islands. To learn more about our firm visit www.warrenaverett.com. 3 Warren Averett Technology Group Resource Center: Toll‐free: 1‐888‐419‐9090 ▪ email: resource.center@watechgroup.com ▪ learn more: www.watechgroup.com EXECUTIVE SUMMARY Government organizations, large and small, increasingly rely on information technology and information systems to successfully deliver effective public services. Okaloosa County Board of County Commissioners seeks qualified independent analysis of its information technology to identify improvements needed to advance data security, workforce productivity, and service delivery to the public. Additionally, this use of technology spans multiple operating units supporting more than 195,000 residents, 95,000 housing units, 19,000 business establishments, and a large tourist industry with an estimated 13.6 million visitors to the Emerald Coast annually. These information systems are at risk to threats that can have negative effects on government operations, assets, and individuals. The confidentiality, integrity, and availability of data being stored or transmitted on company systems can be compromised once these threats have been experienced. Additionally, new technologies should be leveraged to increase productivity, improve business continuity and advance security. Warren Averett Technology Group proposes to conduct an IT Assessment to analyze the information systems technology employed by Okaloosa County to assess its architecture, function, performance and manageability. The assessment will also consider data security risk to Okaloosa County operations, assets, and individuals resulting from the use of information systems. This assessment will provide information on the state of systems and infrastructure, and of relevant threats, internal and external, potential impact and harm to the organization. Some significant components of this IT assessment will include Corporate Governance, Change Management, and Infrastructure. The IT assessment is a component of Okaloosa County’s overall IT Steering and Risk Management process and will begin with framing data security decisions by describing how risk based decisions are currently made. The resulting risk management strategy will define how your organization establishes boundaries for making risk based decisions going forward. Following that, an assessment of your information technology (structure, performance) and current risk (threats and vulnerabilities) will be evaluated and reported. Based on these findings, a list of recommendations will be made to address risk response and to advance the County’s investment in technology. Recommendations will provide a roadmap for determining appropriate courses of action. The final component will include recommendations on how to manage future risk going forward. Outlined within this document are the specific steps Warren Averett Technology Group has identified to assess the infrastructure and the risk to Okaloosa County by the use of technology information systems and recommended remediation activities to ensure the risk is minimized on an ongoing basis. 4 Warren Averett Technology Group Resource Center: Toll‐free: 1‐888‐419‐9090 ▪ email: resource.center@watechgroup.com ▪ learn more: www.watechgroup.com PROJECT SCOPE: SUMMARY Under the supervision and management of County Administration, Warren Averett Technology Group will provide consulting services in the form of an Information Technology Review and Data Security Risk Assessment for the Okaloosa County Board of County Commissioners (the Client). The proposed engagement will consider Okaloosa County’s current information technology (i.e. systems, infrastructure, communications, etc.) and relevant risk factors. Risk factors are categorized in three tiers; organization, mission/business process, and information systems. Threats are identified and evaluated to determine vulnerabilities, extent of adverse impact and likelihood. This evaluation is then leveraged to quantify the risk level associated with each threat and vulnerability, and will direct considerations for leveraging technologies and solutions. Statutory, regulatory and policy requirements for data security will be considered throughout this assessment. Data security compliance standards involving personally identifiable information such as cardholder data and healthcare information, as well as other mission critical processes and data will be considered in the assessment. Assessment services will consider systems, processes and procedures at all County Departments, including those with separate networks having network point‐of‐presence at the main administration building. Assessment services will require discovery interviews to be conducted with key members of management and IT staff as assigned by the County. Vulnerability scanning will be conducted from the main administration building on connected LAN and WAN network segments. Scanning will assess infrastructure components including, but not limited to, servers and endpoint devices for current, published vulnerabilities at: 1. the main location, 2. other locations having servers present and with network presence at the main location, 3. a representative sample of other locations having no server equipment, but with network presence at the main location, and 4. a representative sample of other locations with VPN Internet only access from the main location. Assessment services will also include web application testing of five (5) applications and external penetration testing of five (5) public IP addresses. The web servers targeted for testing include:  County Web Server built and hosted by L3, managed by Randy Sims.  GIS cluster – web application, managed by Chuck LaRouche.  Water & Sewer web application managed by SunGard.  EOC web application located on the DMZ, managed by County IT staff. Warren Averett Technology Group’s network penetration testing services, conducted with a formalized methodology, will provide reporting on the ability of malicious hackers to gain access to Okaloosa County’s network. Network penetration tests mimic the approach of an external attacker and rely on limited or no previous knowledge of the network infrastructure and systems or their configurations. 5 Warren Averett Technology Group Resource Center: Toll‐free: 1‐888‐419‐9090 ▪ email: resource.center@watechgroup.com ▪ learn more: www.watechgroup.com Our network penetration testing services include the following activities: develop a testing plan and schedule for defined IP addresses targeted, validate and test all external IP ranges, perform tests as vulnerabilities are discovered, document testing and exploitation (if any), analyze results, and provide reports and a remediation plan. Penetration testing will be considered complete either upon successful exploitation, with administrative access gained to the internal network, systems and data; or upon failure to exploit all probable vulnerability vectors for each of the IP addresses to be tested. In conjunction with penetration testing, Warren Averett Technology Group will perform a Web Application Assessment utilizing state of the art commercial, open source, and