Golden West addresses IT audit

Alexis Barker
NLJ reporter
 
“Scary” is what Commissioner Ed Wagoner called the results of Weston County’s IT audit. Colorado-based Pro River Technology performed the audit in late 2018 at the request of Weston County Commissioners. The audit found that the county needs a security overhaul. 
According to the company’s report, as far as the network goes, Weston County scored 90 percent on the risk assessment, 1 percent being the best and 100 percent being the worst. In terms of security, the county scored 75 percent on the risk assessment, with 100 percent being the least secure. 
The first step after the audit, according to Commissioner Tracy Hunt, was to hear from the other side and that is just what the county did on Jan. 8 during a meeting with Golden West Technologies and Internet Solutions, which provides the county’s current technology support. Questions addressing issues and concerns raised by the audit were prepared for the Rapid City-based company before the meeting, according to Mark Parette a Golden West business technology specialist. 
“We have answered the questions the best we could based on what was provided to us,” said Parette. 
None of those answers or questions were discussed or provided to those in attendance of the meeting that day. 
Parette addressed specifically the claim that 85 percent of the county’s network use was being used to access sites including Facebook, YouTube and Gmail. He stated that some of this is “speculation” and that the reports produced during an IT audit can sometimes produce “false positives.” 
“I can’t imagine only 15 percent of the workforce is getting work done,” Parette said, saying that things must be examined at the “granular” level. 
Parette said that he was concerned with the lack of granular detail in the report he was provided for review. The report was a seven-page summary of the 100-plus-pages report given to the county. 
“Getting down to the granular detail for everyone takes a lot of time, to get down to what each individual user is actually doing and what those details mean,” Parette said. 
Treasurer Susie Overman clarified that Facebook is occasionally used to conduct county business by individuals in her office.
“We use it to contact and locate people, as far as taxes go. We actually use it as a tool,” Overman explained to the commissioners.
Parette also suggested that the audit should have been prepared by a third-party company that was not potentially after the county’s business. He said that Pro River Technology could have an “interest in gaining this account” and that, therefore, its opinion may be biased. 
According to Parette, meetings were also held with county employees, to which he claimed elected officials and department heads were invited, to discuss the county’s technology and that some of the issues raised in the audit had been addressed by Golden West, including the sticky notes with passwords in different locations at the courthouse. 
“There has been a little resistance on some changes. We have slowly implemented longer characters for user names and passwords, things that make the network more secure,” Parette said
Parette also said that new “solutions” are needed to combat the issue of ever-changing viruses. 
“It takes a team to implement some of these changes, and sometimes you have to come to the board level to understand. I want you to understand why these changes are important, the next steps and what needs to happen and how to implement, also what is stopping us from implementing some solutions,” Parette said. 
Commissioner Marty Ertman asked how many meetings Parette and Golden West had with Weston County employees. Parette said that the meetings have been with different people over the years, whoever showed up at the time, and that there were several meetings over the years. Assessor Tina Conklin noted that it is hard to attend meetings that people are not made aware of. 
“I don’t think that was done intentionally. I didn’t know to invite all of you guys and in the future I will do that,” said Brooke Weigel, the county’s administrative assistant. 
Parette added that reports were provided to the county addressing hardware summaries and ticket reports. Those reports, according to Ertman, must not have been shared with the commissioners.
“What I can do is provide you with time logs and service orders that are open. I have shared those in the past with the county. I can also get invoices and other pieces for you to review. … We didn’t provide them with that. They (Pro River Technology) requested to have access to the entire network and that isn’t feasible at all,” Parette said. 
Chairman Tony Barton acknowledged that the situation makes sense and that Pro River Technology may not have had every fact. 
“I see a big challenge in doing an audit on a secure system like that,” Barton said. 
“I am not so naive to believe the report is not biased,” Barton said. “It does raise some concerns, some on our end and some on yours. We need to get a data policy that everyone follows.” 
Commissioner Nathan Todd asked Parette whether he had a “rebuttal for everything” or if Golden West and Parette could acknowledge that mistakes were made. His question went unanswered. 
“There has to be a mutual handshake to keep the county technology secure, and we have to have a buy-in from everyone,” Parette said. “It is about keeping the county safe and the best business practices to implement that.” 
On Jan. 15, during their regular meeting, the commissioners directed Weigel to move forward with preparing a request for proposal from both Pro River Technology and Golden West for IT support.