Union City is hiring a cyber security manager about a year-and-a-half after a ransomware computer virus brought digital city systems to a screeching halt and forced a major back-end overhaul of file systems, security protocols and training.
“We can’t let our guard down,” Mario Vallejo, the city’s chief technology officer said in an interview Wednesday.
The City Council unanimously approved the new position Tuesday and recruitment for the position could start as early as next week.
Vallejo said he and his team members have taken on the brunt of cyber security work while also heading up major city digitization efforts and day-to-day IT management, which he said does not provide effective security against looming digital threats.
“We’ve determined, like other neighboring cities, that security can really no longer be a part time job to somebody’s current job,” Vallejo said. “Security has to be always up front and center. So having someone who’s really dedicated to that position, allows them to do that.
“You can’t allow yourselves to fall back and then try to catch up when time permits. It has to be there all the time.”
In September 2019, the city announced it fell victim to a virus that locked up portions of the city’s systems, and as a precaution, much of the city staff was forced to temporarily give up email and other digital work norms, for “old school” pen and paper, or other rudimentary workarounds.
Officials say they learned that the virus was a ransomware attack, in which the culprits were seeking payment to release their grip on city systems.
“Since the attack occurred, Mario and his team have taken the organization through a number of trainings that really have become a routine faucet of the organization,” Lauren Sugayan, a spokesperson for the city, said.
She said the city has instituted “a whole employee education and outreach program” including newsletters and updates on the latest security trends to help lower the risk of another attack succeeding against the city.
“A cyber security manager will help us take that to the next level,” Sugayan said.
Vallejo and Sugayan also said the cyber security manager will help the city stay in compliance with often changing requirements for data protection, such as Payment Card Industry Data Security Standards, or PCI, the Health Insurance Portability and Accountability Act standards, often referred to as HIPAA, and standards for Criminal Justice Information Systems, or CJIS.
“It’s really become an insurance requirement to have a position focused on cyber security,” Vallejo added. “Premiums are rising, and insurers really want to make sure we’re doing all the preventative measures to make sure that we keep on top of our security.” .
While Vallejo said no personal information of residents or city contractors was released in the attack, many pieces of data were corrupted, and the city was forced to laboriously rebuild histories of datasets across departments.
The attack came in a year when more than 40 municipalities, including cities large and small, fell victim to similar attacks, according to reporting from The New York Times.
Though the the attackers demanded payment, Union City “elected to not pay the ransom demand and instead elected to rebuild our internal systems affected by the ransomware virus,” Vallejo said in an email.
“Certainly if you look across the nation, when a lot of medium-sized to small-sized cities were being hit, many of them had to pay out hundreds of thousands of dollars, if not millions to their attackers,” Sugayan said.
“That’s something the mayor and the council, very humbly and quietly, are probably proud of, is the fact that we were not a city like others that had to pay out these large amounts of money,” Sugayan said.
The new cyber security manager will be paid a minimum salary of $129,147, according to city reports, plus benefits.
