Colfax approves improvements to computer security for $15,000

By LeAnn R. Ralph

COLFAX — By all accounts, the lack of security for the Village of Colfax’s computer systems is a disaster waiting to happen.

The Colfax Village Board approved spending up to $15,000 to improve computer system security at the September 11 meeting based on a proposal for nearly $12,000 from Computer Integration Technologies out of Woodbury, Minnesota.

During the audit report several weeks ago, Eric Davidson of Bauman Associates pointed out the lack of computer security in Colfax was quite alarming for the auditors.

The security analysis included the village clerk’s office, the police department, the department of public works and the rescue squad. The Colfax Public Library was not included in the analysis.

Computer Integration Technologies assessed the village’s computer systems and found a number of security problems, including:

• All of the computers used local accounts, which is an insecure arrangement vulnerable to forgotten passwords, compromised security from compromised passwords, and a lack of centralized management of user accounts and end user security.

• No physical security was found for the network systems and computers beyond locked doors. The Colfax Rescue Squad was an exception because the network equipment is wall-mounted in a locked storage area, and the computers were in offices secured by locked doors.

• The village clerk’s office and the police department used different anti-virus software, although the rescue squad and public works used nothing more than the basic Windows Defender application. The lack of centrally managed, commercial grade anti-virus system is a significant security issue, with the rescue squad and the public works computers being especially vulnerable.

• Security updates were found to be missing on each computer that was visually inspected.

• User passwords are managed by each computer user. On each computer that was inspected, the passwords were not set to expire, and in some cases, used very simple, easily-guessed passwords. The password expiration features were disabled, and most of the users have used the same password for a long time.

• None of the computers had a user account lockout, which means unauthorized personnel can attempt to log in with a bad password over and over, with no automatic lockout occurring.

• Firewalls were not adequate and did not contain any content filtering or restrictions to prevent users from browsing sites categorized as entertainment, shareware, social media, webmail or illegally copied software.

• The computer in the village administrator’s office is accessible for remote access through an open port on the firewall. This is not recommended and should be replaced with a proper VPN-based solution as soon as possible.  The squad car laptop uses a remote access authenticated by the firewall. The rescue squad and public works computers do not use any sort of remote access.

• All computers are peer-to-peer work groups and have no centralized management.

• Files on the village hall computer are backed up manually with a flash drive on a periodic basis, but no backup system was found for the police department, rescue squad, or department of public works.  The rescue squad and public works computers use web-based applications only, but the database in the police department and the shared files in the village hall are completely vulnerable to corruption and loss.

The report includes recommendations to address the problems that were identified.

Minimum package

The recommendations from Computer Integration Technologies is the “minimum package” for the village to get started, Niggemann said.

The estimate from CIT notes the cost of $11,814 is only an estimate and not a fixed bid and that the project will be billed on a time and materials basis.

Colfax has “poor system backup,” said Keith Burcham, village trustee.

If another “perfect storm” were to occur, such as the problem that resulted in the water tower losing pressure and Colfax being under a boil water order, the lack of backup could create tremendous problems for the village, he said.

Colfax had an automated backup service at one time, but the service is no longer being used, Niggemann said.

The work done by the computers is “critical” for the village’s operations, Burcham said.

“I am alarmed by the state of the village’s computers,” he said.

The budget has funds available, so the village could go forward with computer security improvement, said Mark Halpin, village trustee.

The Colfax Village Board approved a motion to accept the proposal from Computer Integration Technologies at a cost not to exceed $15,000.

The village board also approved a motion to pay for the project using money from the major equipment fund.