An internal audit obtained by the CBS46 Bulldog team, shows in stunning detail how the City of Atlanta was warned months before the recent cyber attack their IT systems could easily come under attack, if not fixed immediately. And the problem had grown for some time.
In the 41-page audit, the city was told last summer their IT department was on life support, and there was basically no formal plans in place to protect the city from cyber threats.
According to the auditor, it took months for the city to even respond to the audit, formally acknowledging the issues.
The document presented to city leaders states, "the large number of severe and critical vulnerabilities identified has existed for so long the organizations responsible have essentially become complacent and no longer take action." The audit also reveals "departments tasked with dealing with the thousands of vulnerabilities do not have enough time or tools to properly analyze and treat the systems," causing a "significant level of preventable risk exposure to the city." Finally, as mentioned above, the report concludes the city had "no formal processes to manage risk."
City Auditor Amanda Noble says one of the primary findings of the audit was that Atlanta Information Management and the Office of Information Security needed more resources. "The people that are working in the department are busy putting out fires," says Noble.
Typically, Noble says a department can respond to an audit with a plan of action within weeks, but Atlanta Information Management took months to come up with that plan. She says the city was in the early stages of implementing security features when the cyber attack happened. But the long simmering problem wasn't acted on quickly enough. "There were some vulnerabilities that were identified for a while in the previous administration that they were still working to fix," Noble says.
In the city's defense, Noble also noted the threats have increased tremendously over the last year. New threats are fluid and often hard to keep up with.
Copyright 2018 WGCL-TV (Meredith Corporation). All rights reserved.