Host: Stephan Currie Guest: Curtis Pennala of Karhu Cyber Topic: A cybersecurity firm details a 2024 “horror story” involving a Michigan county and the lessons all counties can derive from it in a new episode of Podcast 83. Karhu Cyber, a veteran-led firm, is now operating in more than 25 percent of Michigan counties, said its CEO, Curtis Pennala. “We've seen kind of the full gamut of county government's cybersecurity posture … all the way up to some of the bigger ones who have internal cybersecurity teams and a large, robust IT team, and all the way down to the smaller counties where they don't actually have any internal IT resources or they're contracting the local IT provider, who may not have other, municipal experience and doesn't really understand the risk profile,” said Pennala, who developed his cybersecurity skills during a seven-year stint with the U.S. Navy. “So, some of the horror stories … the worst one that we did was when we actually onboarded with a client back in the fall of 2024, and then, during onboarding, they got hit with a pretty significant data breach,” he continued. “We had some of their security controls, in this case. Their firewall was … an eight-year-old firewall, which is at least three to four years out of date, depending on the firewall. … And what that was doing is it was publicly advertising basically a login portal, and it allowed the threat actor to kind of walk in the front door, if you will. So, that resulted in a pretty significant outage for the county.” To address the ever-evolving threats online, Pennala said: “The information I would like to bring to (county) decision makers, and I consistently have those conversations, is, get a third-party assessment so you can understand, because if you talk to your internal IT team, and they say, ‘Yeah, we're good, we got endpoint security. We got, you know, this, you know, MFA, what have you.’ All of that's good, but it's not proven until it's tested. “So, let's run it through a test,” he continued. “It's not an adversarial mindset; it's a collaborative thing. Let's work with your team, and let's assess this environment in not a checkbox fashion.” See video versions of all Podcast 83 episodes on YouTube at https://www.youtube.com/@michiganassociationofcount2606 Visit the Podcast 83 page at www.micounties.org