COUNCIL AGENDA ITEM
SUBJECT:
title
Florida Local Government Cybersecurity Grant Award
body
DEPARTMENT:
Finance
SUMMARY:
The City of Edgewater has been awarded a grant as part of Round 2 of the Year 2 Florida Local Government Cybersecurity Grant administered by the Florida Digital Service. In addition to software access for the capabilities awarded, the Florida Digital Service will provide the following:
- Incident response assistance when requested.
- Training, technical assistance, and support for the capabilities granted
Approximate value is based off of individual purchase price and does not indicate the high-volume discounts that may apply at the State level.
- Endpoint-Based Asset Discovery/Crowdstrike Falcon Discover = Annually $5,740
- Network-Based Asset Discovery/Armis Centrix = Annually $39,000
- Network-Based Asset Discovery/ Crowdstrike = Annually $18,299
- Security Operations Platform (SOP)/ReliaQuest-GreyMatter = Annually $172,500
ADDITIONAL INFORMATION:
Endpoint-Based Asset Discovery is a method used to identify and catalog assets within a network by directly interacting with the endpoints (devices) connected to that network.
Key Concepts
- Endpoints: These are devices connected to a network, such as computers, servers, smartphones, and IoT devices.
- Asset Discovery: This is the process of identifying and cataloging all devices and resources within a network.
Imagine a city with hundreds of computers and servers. By using endpoint-based asset discovery, the IT department can keep track of all devices, ensure they are up-to-date with security patches, and quickly identify any unauthorized devices connected to the network.
Network-Based Asset Discovery is a process used to identify and catalog assets within a network. These assets can include devices, software, services, and other resources connected to the network.
Key Concepts
- Assets: These are any resources connected to the network, such as computers, servers, printers, routers, software applications, and databases.
- Discovery: This involves scanning the network to find and identify these assets. The discovery process can be automated using specialized tools.
Imagine a city wants to ensure all devices connected to its network are secure and properly configured. They use a network scanner to detect all devices, identify their types and configurations, and then catalog this information in an asset management system. This process helps the city maintain a secure and well-managed network.
Endpoint Detection and Response (EDR) is a cybersecurity technology designed to monitor, detect, and respond to threats on endpoints, such as computers, mobile devices, and servers.
Key Components of EDR:
- Monitoring: EDR continuously monitors endpoint activities to identify suspicious behavior or anomalies. This includes tracking file changes, network connections, and user actions.
- Detection: Using advanced algorithms and threat intelligence, EDR systems can detect potential threats, such as malware, ransomware, or unauthorized access attempts. Detection can be based on known threat signatures or behavioral analysis.
- Response: Once a threat is detected, EDR can take automated actions to mitigate the risk. This might include isolating the affected endpoint, blocking malicious processes, or alerting security teams for further investigation.
- Analysis: EDR tools provide detailed forensic data to help security teams understand the nature of the threat, how it entered the system, and its impact. This information is crucial for improving defenses and preventing future attacks.
Imagine a city laptop gets infected with malware. An EDR system would:
- Monitor: Detect unusual file changes and network traffic.
- Detect: Identify the malware based on its behavior or signature.
- Respond: Isolate the laptop from the network to prevent the spread of malware.
- Analyze: Provide detailed logs to understand how the malware entered and what it did.
A Security Operations Platform (SOP) is a comprehensive system designed to enhance an organization's ability to detect, respond to, and mitigate security threats.
Benefits of a Security Operations Platform
- Improved Security Posture: Enhances the ability to detect and respond to threats quickly.
- Operational Efficiency: Automates repetitive tasks, allowing security teams to focus on more complex issues.
- Comprehensive Visibility: Provides a holistic view of the organization's security landscape.
- Proactive Threat Management: Enables proactive identification and mitigation of threats.
BUDGETED ITEM: ☐ Yes ☐ No ☒ Not Applicable
BUDGET AMENDMENT REQUIRED: ☐ Yes ☐ No ☒ Not Applicable
RECOMMENDED ACTION:
Motion to accept products and services provided by the Florida Local Government Cybersecurity Grant program