Increasing Cyber Attacks Spur ADP to Restructure
The Geauga County Automatic Data Processing board is metamorphosing, following a vote to reconfigure March 4.
The Geauga County Automatic Data Processing board is metamorphosing, following a vote to reconfigure March 4.
In 2024, Geauga County Commissioners voted to have ADP absorb the archives department. Now, with ADP discussing a cybersecurity department, it is time to restructure, Chief Deputy Administrator Frank Antenucci said.
“I would love to say that that isn’t needed, but … we had another local court that experienced a cyber attack and were hacked, and we’ve placed another block on them,” he said, referring to a phishing incident involving the Painesville Municipal Court.
ADP has already had an unofficial cybersecurity department operating for around six months to a year, he added.
The reorganization will place three departments under the ADP umbrella — the Department of Advanced Technology and Applications, or DATA; the Department of County Archives and Records Enterprise, or CARE; and the Department of Advanced Research and Cybersecurity, or DARC.
DATA would essentially be the Department of Information Technology rebranded, Antenucci said.
DATA answers the question, “Can we do it?” County Auditor Chuck Walder summarized.
“Can we get a wireless mouse? Can we do livestream video?” he listed as examples.
Once options have been evaluated, the DARC group comes into play, Antenucci explained.
“We’re basically copying other mature agencies that also bring in the component of advanced research,” he said, adding once ADP answers the “can we” question, DARC explores the “should we” question.
“Should we even do that in our security infrastructure,” he said.
There is a check and balance between the two departments, rather than one department haggling, Antenucci said.
“The problem with having the same group doing both is, they’re inherently conflicted,” Walder said. “Some things you can do and you shouldn’t. Some things you should do, but can’t. And the two groups should not be one because they are always in each other’s sandbox and they’re pressured by an outcome rather than pressured by a good decision.”
There is a balancing act between security and ease and access, Antenucci said, adding the split should ensure a strategic streamline.
Geauga County Commissioner Carolyn Brakey asked who would resolve conflict between the two groups.
The ADP board will ultimately answer the question, “Will we do it?” Walder said.
“We’re gonna weigh the risk versus the requirement and determine, are we willing to have our names put on (this) …,” he said.
The board would be the final point of contact in such disputes, Antenucci said, adding DATA, DARC and CARE would answer to him, he would answer to Walder, who would then take items to the board.
CARE is a name Antenucci feels encapsulates the archives and records department.
“We want to make sure people understand archives and records isn’t (a department) stored in the basement like it used to be,” he said. “It’s instead the forefront of caring for the records and historical documents of the county and protecting those for the future, and also complying with the law now.”
The restructuring will bring ADP in line with similar entities, Walder said.
“We’re not creating fire. This has been done. This is being done at county entities right now. We just have never evolved far enough to adopt it,” Walder said.
The growing count of cybersecurity threats has been a factor in the decision, he said, asking DARC Director Zach McLeod about the threat count per week.
McLeod replied a few times a week, he’s blocking local organizations who have been compromised.
Domains get blocked several times a day, but those aren’t always threats, he said.
This is an exponential increase, Walder said, adding the problem is nationwide.
“Without some sort of formal organizational structure to be able to combat it, you force the system back into triage,” he said. “That’s what I don’t want.”
An immediate transition would have no cost impact, Walder said.
The restructuring will be fully implemented over the coming months, with training sessions, policy updates and public engagement initiatives planned to ease the transition, Antenucci said in a March 4 press release.
“Every step we take is aimed at making our service more efficient, secure and responsive to the needs of those we serve in Geauga County,” he said.
Geauga Domain Blocks Painesville Court
The Geauga County Automatic Data Processing board recently blocked Painesville Municipal Court’s domain following a phishing email that appeared to originate from them, ADP Chief Deputy Administrator Frank Antenucci said March 4.
“We received a phishing email that appeared to be from the Painesville Municipal Court, which was reported by one of our stakeholders,” he said in an email to information technology stakeholders. “We have confirmed with the Painesville Municipal Court that they were indeed hacked. Preliminary findings indicate that the breach occurred in October 2024.”
A domain block has been implemented to protect the network from any further threats, he said.
“The domain block on pmcourt[.]com is a necessary measure to ensure the security of our systems. As such, users will not be able to access or receive emails from this domain until further notice,” he said.
Antenucci encouraged county employees to refrain from trying to bypass the block and to contact him directly if they encountered any suspicious activity.
“We are actively monitoring the situation and will provide additional updates as more information becomes available,” he said. “This phishing attack resulted in no malicious impact on Geauga County thanks to the vigilance of a stakeholder employee in Geauga County. We commend this employee for their exemplary actions.”
