The Anderson County Commission met Monday night and the breach of servers in the Courthouse was on the forefront of the agenda.
The breach was discovered earlier this month and is being investigated now by law enforcement. The scope and nature of the breach has not been divulged and while it is unclear what type of information may have been compromised, officials are urging all county employees to closely monitor all of their accounts for any suspicious or unauthorized activity.
Finance Director Natalie Erb presented potential solutions to commissioners that included a lower-cost option of reformatting the computer equipment, or magnetically “wiping” it, and possibly reusing the gear, or a more expensive option of replacing the machines, including two servers in the Accounting Department and 26 workstations. In the short-term, the plan calls for measures to be taken immediately to secure the system, replace outdated or vulnerable equipment and software and hire an independent IT specialist. Longer term goals conducting needs assessments with all of the county departments to find ways to make the system not only more secure, but also more efficient. The plan calls for Erb to oversee the improvements and authorizes her to contract for needed technical work.
Commissioners unanimously approved the plan itself and, in a separate vote, also unanimously agreed to move $100,000 from the county’s undesignated fund balance to the Finance Director’s budget. Commissioners indicated they went with the costlier option because of the potential impact of the breach on county employees and their families and wanted to “do it right the first time.” Erb says she hopes she does not have to spend the full amount but did lay out the cost estimates for each part of the plan:
- IT technical support—$28,000. That money that would be used to install two new servers and help the county get through a transition period.
- 26 workstations—$36,000. Erb had given commissioners the option of replacing the workstations later, but several commissioners, including Angeleque McNutt and Philip Warfield, said they’d like to start with a system that is safe. “I think if we’re going to do it, (let’s) do it right,” Warfield said. Other commissioners agreed.
- Two new servers in the Accounting Department—$12,000. Erb said those servers are in the most immediate need of replacement.
- An emergency IT contract—$7,000. This is the money spent starting in July in response to the breach.
Human Resources Director Russell Bearden told commissioners that his office has been in contact with at least four vendors of identity theft protection services seeking quotes on covering all county employees, an expense that will likely be absorbed by the county’s insurance policy against cyber crimes.
Law Director Jay Yeager estimated that it could take up to three months to resolve the breach and set up the new system.
During the meeting, commissioners praised both Erb and Bearden for their responses to the security breach and its aftermath.