MISAC – Northern California Chapter

Meeting Minutes for January 9, 2004.

The January meeting was held at the Foster City Emergency Operations Center.

In attendance:

Joan Schoening, Foster City Sharon Caiocca, Santa Cruz

Jerry Burdick, Daly City Solomon Gee, Vacaville

Michelle Gitmed, Alameda John Pfeiffer, Monterey

Larry Johnson, San Pablo Chris Gjerde, Los Gatos

Judy Grosey, San Mateo Greg Park, Livermore PD

Gary Lech, Walnut Creek Dennis Jew, Dublin

Glenn Loo, Palo Alto Steve Pappa, Dublin

David Ramberg, Palo Alto External IT Services Art Closson, LanLogic

Clancy Priest, Hayward Joe Foos, LanLogic

Ron Kaetzel, Santa Rosa Nathan Kochly, Alameda County ITD

Tim Williamsen, Petaluma John Ostlind, Livemore PD

John McElligott, League of California Cities Chuck Deatherage, Vacaville

Laura Tredinnick, Santa Rosa Kim Sloan, South San Francisco

Gonzalo Gonzales, Vallejo Dave Torre, Foster City

Steve Toler, Foster City

The meeting was called to order by President Solomon Gee.

Approval of November Meeting Minutes

The minutes for the November 2003 meeting in Dublin were approved with two minor modifications:

1) It was noted that Palo Alto IT has a staff of 40 rather than 45 as stated in the minutes.

2) The MISAC award presented to Mountain View by Ron Kaetzel was the Achievement in IT award. It was incorrectly noted in the minutes that it was the Excellence in IT award. Mountain View has received the Achievement in IT award four consecutive years.

Treasurer’s Report

Treasurer Laura Tredinnick reported there is $7,327.71 on account. Pending payables are State MISAC dues for the Chapter and the cost of refreshments for the Foster City Meeting. Regardless, the Chapter budget is healthy. There were four new members whose dues were reflected in the treasurer’s report.

March 5 MISAC Meeting

The next MISAC meeting will be in San Mateo on March 5. This is the first Friday in March. Traditionally the MISAC meetings have fallen on the second Friday of every other month. Note the change for the March San Mateo meeting only.

The meeting will be held at Poppy Creek in San Mateo. Because of the length of the meeting content the March 5 meeting will begin thirty minutes earlier than the traditional start time. The meeting will begin at 8:30 a.m. rather than 9:00 a.m.

There will be one-hour presentations on the TROPOS project and by The Gartner Group on WIFI technology.

After the meeting convenes, there are four golf tee times reserved beginning at 1:30 p.m. This will accommodate a total of 16 golfers. Contact Steve Yoshifuji (650 522-7052, syoshifuji@cityofsanmateo.org) if you are interested in playing golf after the meeting. The cost is $45 per player plus the cart rental.

Security Presentations

LanLogic, a Livermore-based firm offering a full range of network to desktop services and security solutions, was invited to speak on the topic of IT security. Representing LanLogic were Art Closson, President, and Joes Foos, Director of Sales and Marketing.

LanLogic’s presentation can be viewed at www.lanlogic.com/misac

Some highlights of the presentation include:

• Laptops coming onto your network can bring you problems internally. Even the best defenses against intrusion from the outside can’t prevent internal-source attacks by unknowing and authorized nomadic laptop users.

• Internal source problems are a big threat

• Regarding legislation, it was stated that SB1386 (Breach Act) does not apply to cities and counties. It is intended for State agencies, businesses, and individuals that maintain personal data e.g. customer information. These entities must disclose to all “customers” if data is suspected of being compromised. Although this does not directly apply to cities, city subcontractors may be affected by this legislation. One caveat is that the “breach” does not have to be disclosed if the compromised data was encrypted.

LanLogic offered a free external vulnerability assessment to the Chapter members.

Also, a $1,000 discount was offered on a full internal security audit if contracted by the end of Febraury.

Contact Joe Foos at (925) 273-2316. joe@lanlogic.com

Upcoming RSA Security Conference in San Francisco. The multiple day exhibitor area is free to attend so register at http://2004.rsaconference.com/registration.aspx

The conference expo is at the Moscone Center, San Francisco, Feb 24-26, 10a.m.–5p.m.

Greg Park, IT Coordinator for the Livermore PD, gave an overview of the economic environment of the City of Livermore and IT organizations at the City of Livermore. Livermore has four separate IT groups to support City Hall, PD, Library, and the Livermore/Pleasanton Fire Department. This poses several security and management challenges, with an infrastructure of over 45 servers.

Livermore has approximately 11 total IT staff for it's 4 organizations. The Livermore PD is talking with Alameda County ITD about providing Internet access and other network services.

Nathan Kochly of Alameda County ITD spoke about CLETS related issues. Adopted in 2002 was the requirement that if CLETS data is on a PD network then either a firewall is required or the data must be encrypted. In 2003 this became mandatory.

Other CLETS information:

• Law enforcement network must be controlled by chief law enforcement officer or designee.
• Equipment must be owned by Police agency or designee.
• Firewall packet filtering meeting CLETS standard stated in specification.
• No data over the internet (VPN) but dial-in access acceptable.
• VLAN which can be shared equipment offering PC/non PD network access is questionable use under CLETS rules. So encryption a candidate for this scenario to satisfy CLETS rules.
• Encryption (128-bit) best way to meet CLETS certification standard.
• Megan’s Law, Cal Gang, Cal Photo, and other databases are not under CLETS authority.
• NCIC (Federal) requires WAN connections to be encrypted.

Alameda County firewalls-off city PD CLETS subscribers and assumes the subscriber PD’s firewall themselves from the city network.

Next Meeting

Friday, March 5, 2004. Poppy Creek, San Mateo. 8:30 a.m.