Earlier this month, hackers launched what Cobb spokesperson Ross Cavitt called "a sophisticated phishing attack" on county email addresses. While Cavitt said no county data was compromised, spam emails were sent out from the cobbcounty.org domain and the county's email servers were disrupted for several days. Cobb Police is not investigating the incident.
The phishing attack follows an attack on the Cobb County School District in February, which was used to send out false emergency alerts.
Cavitt added county staff had to work 24 hours a day for several days after the attack to monitor the email servers. Information Services Director Kimberly Lemley told commissioners at their work session Monday that in the wake of the attack, the county needs to hire four additional cybersecurity positions to protect its digital infrastructure.
Funding for the new positions would be appropriated from the county's fund balance, or leftover previously budgeted money, a decision Commissioner Keli Gambrill said concerned her. Historically, the county has avoided using 'one time money for recurring expenses,' though commissioners have already approved such expenditures for staffing needs on several occasions this year.
Gambrill conceded, however, the need to beef up the county's cybersecurity. Other commissioners said the risk of not taking action far outweighed the cost.
"We're going to be vulnerable as a county far beyond this amount that we're going to expend," said Chairwoman Lisa Cupid.
"Given that we could not have foreseen what just took place as a result of the phishing that we've already experienced ... if we were to be breached, this is but a fraction of what it would probably cost to pay someone to get our data back," County Manager Jackie McMorris added.
"What just happened, to me, creates an emergency situation that makes us more vulnerable, and I think it needs to be presented that way," said Commissioner JoAnn Birrell. "In this situation, I don't know what other choice we have."
The $46,389.25 cost of the four employees would only fund the positions through the end of the fiscal year, which runs through the end of September. Commissioner Jerica Richardson called the spending "a penny" on the relative scale of cybersecurity investment, and Lemley said the county could struggle to fill the positions before October given the current demand for cybersecurity professionals.
Cupid picked up on a segue to another agenda item—a request for proposals (RFP) for a compensation study of county employees.
"That brings us to our next matter, of how we can pay for the things we need to help us run the county," she said.
Cobb County previously contracted such a study in 2014 with the Archer Group consulting firm, which has also contracted with cities and counties around the metro area. In 2016, Archer came back to the county and recommended raises and reclassifications for around 45% of the county's employees. The Board of Commissioners, under the leadership of then-Chairman Mike Boyce, approved the implementation of those findings in February 2017.
The study seems to have not had the desired effect, as the county is "continuing to experience increased turnover," McMorris wrote. Human Resources Director Tony Hagler previously told commissioners at their January retreat Cobb has a turnover rate of 9% among employees on the county's traditional pension plan. and 13% among those on its less generous "hybrid plan."
Hagler recently conducted a sample study of 57 employees, comparing them with similar positions in Gwinnett, DeKalb, and Fulton counties, and found Cobb was paying 8.41% less on average.
©2021 Marietta Daily Journal, Distributed by Tribune Content Agency, LLC.
