1. Real Life Scenario An employee in the Finance and Business Operations receives a targeted phishing email. Follows e-mail instructions and infects his or her computer, and the virus spreads countywide Severe impacts to County agencies …

2. Status The state of information security at King County is GOOD! However, those with malicious intent will always be out there trying to take advantage of any vulnerability or opportunity to do harm.

3. Risk Sources for King County People: employees, contractors, volunteers Lack of clarity: what data needs protection and how Vulnerabiliti es in apps and systems – open to attacks Lack of Security factors in all system life cycle (SDLC) phases Minimal standards in systems & processes: “The weakest link …” Awareness!Data ModelUpgradesSDLC Standardization 2 3 4 5 1 What needs to be done?

4. IT Security Improvement Roadmap

5. Cyber Insurance Coverage Risk Management and KCIT partner to seek agency participation in managing the County’s IT Security We and our insurance brokers are pursuing Cyber Liability Insurance Coverage Essential: IT Security Awareness Training for Employees

6. What do we Ask? Endorsement for IT Security Roadmap