The City of Marysville’s website was down this morning as part of a world-wide cloud disruption. City officials said they did not have much information but they are trying to work with the domain host to get the matter fixed. (Photo submitted)
Council spent Monday work session discussing new online safeguards
Just hours after Marysville’s city council spent a work session talking about cyber security, the city’s website was disabled, part of a worldwide cloud disruption.
“Right now, we don’t exist to the outside world,” City Manager Terry Emery said this morning.
According to the Associated Press, multiple websites across the globe went offline today after an outage at the cloud service company Fastly. San Francisco-based Fastly acknowledged a problem just before 6 a.m. Eastern. It said in repeated updates on its website that it was “continuing to investigate the issue.”
About an hour later, the company said the issue had been “identified” and a fix was applied.
A number of sites that were hit early appeared to be coming back online.
One of the companies apparently affected was CivicPlus, which hosts Marysville’s internet domain.
“CivicPlus is having issues so no one can see Marysville (website),” said IT Director Aaron Story.
Story said he has tried to contact CivicPlus, but has been unsuccessful, noting the company’s phone lines “are getting slammed right now.”
“At this point, we don’t know much, but we are trying to get answers,” Story said. “Until we get ahold of CivicPlus to get the real reason, we don’t know much.”
Story said that because the city’s domain name is not working, not only can visitors not see the city website, anyone with a marysville.org email address is not receiving e-mail. He said it is unknown if the messages will be received once the domain name is functioning again or if the emails are lost for good.
Story said that while the website and email are down, the outage is not impacting emergency or safety services beyond that. Emery said that most emergencies are called into first responders.
“The phones are, of course, O.K.,” Story said. “So, they can continue to call in.”
Emery, Story and other members of the city’s information technology team were at Monday’s city council work session to talk about steps the city was taking to increase cyber security.
Story said earlier this year the city was contacted by the city’s cyber insurance carrier, Travelers. The city pays $26,000 annually for the cyber insurance.
“Insurance companies that are holding these policies are running a little scared,” said Story, detailing several recent high profile cyber security attacks.
The carrier told city officials they wanted all of their policy holders to have increased security, specifically multi-factor authentication.
Gwen Beech, who will serve as the project lead for security improvement, explained that city e-mail users will need to verify their identity several ways.
“When you log into your e-mail, not only will you be putting in a username and password, or your e-mail password, but you will also be authenticating with either an app that’s on your smartphone, or what is called a token, which has an eight to 10 digit number that changes every so many seconds,” Beech said.
She explained that the token would be “something you would have to take with you,” adding it is similar in size to a key fob.
“The phone app will be easier to use than carrying around a token,” Beech said. “Just because if you lose that token, in order to authenticate into your e-mail, you are going to have to get ahold of someone in IT in order to just to log into your e-mail.”
Though she added that a similar issue would occur if a user loses their cellphone.
Story said the facial recognition on many smartphones would work as verification for the app.
Initially the dual authentication was only to be needed for executive staff and other decision makers in the city as well as those working remotely. About 30 days later, the carrier said they wanted everyone in the city to have the dual authentication.
“That took a big project and made it huge,” Story said.
He added that “unfortunately council members are in the same boat as everyone else.”
He said the city has been able to get an extension from the company to allow for time to create the security system, “so we are still covered which is the big thing.”
Story said the city is working with several cyber security contractors to create the multi-factor authentication system. Emery said the city will pay about $130,000 for the system and implementation.
Beech said that with the authentication system, users will not be able to stay logged into the system indefinitely and will need to “reauthenticate every so often.”
Beech said the creating the system will begin “in mid- to late July and it will take quite a few weeks to complete the project.”
Until then, she said IT officials are asking users to “let us know what you prefer, if you prefer to use an app on your smartphone or you prefer to carry a token.”
Council President Mark Reams said he believes the process will “go pretty smoothly.”
Story said his department has already started meeting with city staff. He is asking for patience with the process.
“We are going to have some challenges with this project that are going to be very time consuming for us to work through,” Story said.