Meeting discussionsStart with a topic.

1. Roll Call Present: 8 – Mayor Derek Norton, Councilmember Glenn Pickens, Councilmember Latonia

P. Hines (arrived at 6:20 PM), Councilmember Travis Lindley, Councilmember Charles Welch, Councilmember Susan Wilkinson, Mayor Pro Tem / Councilmember Tim Gould, Councilmember Rickey N. Oglesby, Jr. Also Present: 1 – Scott Cochran Staff: 9 – Tyler Addison, Joe Bennett, Richard Garland, Dat Luu, Paul Osburn, Heather Peacon-Corn, Kristin Robinson, Enoch Serna, Andrea Worthy Call to Order Mayor Derek Norton called to order the February 27, 2025 Committee of the Whole meeting held at A. Max Bacon City Hall in the HR Training Room at 6:03 PM.

2. Staff M&C Agenda Items to Review

3. Formal Business and Presentations

A. COW2025-030 Cybersecurity Penetration Testing - Executive Summary – Dat Luu Citywide Dat Luu, IT Director, introduced Gates Marshall, Founder / Chief Breach Officer for Before The Breach, who presented the following: Areas of Risk Everyone has risks that must accept or take steps to mitigate. City of Smyrna has 4 key areas of risk that should be managed to an acceptable level. • Life & Safety: Personnel life and safety, Impact to Operational Technology (OT), Industrial Control Systems (ICS), Equipment Safety, Computer Aided Dispatch (CAD) • Operational Disruption: Ransomware, loss of data integrity or availability, or other threats that stop service delivery or back office functionality • Regulatory and Compliance: Impact to compliance status, Service Level Agreements (SLA), interconnection agreements, regulatory fines, litigation, or law enforcement matters • Information Disclosure: Loss of Intellectual Property (IP), City of Smyrna operational information, personnel, customer, financial, or other sensitive information Penetration Testing Process What is penetration testing? • Enumeration and Vulnerability Scanning of Internet-facing and internal networks • Network attacks to capture credentials, data, or configurations as they cross the network • Targeted hacking attempts against applications and services • Post-compromise credential harvesting, privilege elevation to Domain Admin • Documentation of findings into Penetration Test Report Penetration Test Results • Library Software Programmatic Flaws – The Library Corporation (TLC) software noted to expose API and user credentials to internet due to lack of security in programming • Overall Strong Encryption in Use – Other internet exposed services for administration and monitoring are noted to have strong SSL/TLS configurations and be free of exploitable flaws • Security Defaults Compromise Devices – Weak or default passwords, SNMP configurations, telnet, FTP, or other insecure services present resulted in compromise of non-PC devices like printers, UPS devices, HVAC controller • Insecure Configurations Compromise Active Directory – Credential theft from unsigned SMB traffic, extraction from a printer, improper certificate issuance result in 3 administrative compromises of the Smyrna local domain Notable Exploitation • HELO Plus AJA Video System – An audio-video conferencing system compromised, allowing an attacker to monitor or change video content displayed by the system • Data Center Uninterruptible Power Supply – A battery backup system used to maintain power in the City Data Center was compromised, allowing as attacker to shutdown power or change configurations • TLC Library Database – The TLC data was compromised, allowing an attacker the ability to login as any user, update PIN values, and extract PII from the application • Police Station Uninterruptible Power Supply – A battery backup system used to maintain power in the City Police Department was compromised, allowing an attacker to shutdown power or change configurations • Weak User Passwords – 103 unique user accounts

were observed to have weak passwords decrypted through brute force password attacks • Usage of Netwrix Account to Compromise Active Directory – A harvested Credential for a network software tool is used to compromise Active Directory for the Smyrna.local domain Improvement Recommendations • Security Hardening – Configuration of security controls pre-production • Security Framework – Align configurations / operations with CIS controls • Network Update – Add segments to locational topology for sensitive devices • Dedicated Security Staff – Resources to perform security activities Journey to Cyber Security Maturity • Zero Trust Architecture, Cyber Resiliency: Diversity in data flows with strong resistance capabilities and authentication enforced per session • Advanced Attack Prevention and Mitigation: MITRE ATT&CK mapping of controls in context to threat actor tactics • Information Security Framework: Holistic set of controls aligned with known standards (ISO, NIST, CIS, HITRUST) • Regulatory Compliance: Meet internal, legal, or industry obligations (PCI, HIPAA, GDPR, etc..) CIS Controls v8 • Inventory and Control of Enterprise Assets • Inventory and Control of Software Assets • Data Protection • Secure Configuration of Enterprise Assets and Software • Account Management • Access Control Management • Continuous Vulnerability Management • Audit Log Management • Email and Web Browser Protections • Malware Defenses • Data Recovery • Network Infrastructure Management • Network Monitoring and Defense • Security Awareness and Skills Training • Service Provider Management • Application Software Security • Incident Response Management • Penetration Testing