Cleveland’s Cybersecurity under Fire: Ohio Auditor’s Alarming Report Unveiled

Summary of Key Points

• Ohio’s Auditor of State found basic gaps in Cleveland’s cybersecurity practices.
• Multifactor authentication was missing at the Municipal Court and the Department of Public Utilities.
• A security policy existed but was not enforced consistently, and security reports were not reviewed regularly.
• The auditor recommended awareness training for everyone who uses the city network.

What the state auditor found in Cleveland’s systems

The Ohio Auditor of State sent a sharply critical assessment of Cleveland’s cybersecurity practices to Mayor Justin Bibb, City Council and the city’s Audit Committee, News 5 Cleveland reported. The letter said the city had failed to put basic security controls in place. It came after two attacks in a year: one shut down City Hall, and another closed the Cleveland Municipal Court and Housing Court.

Policy on paper, uneven in practice

The auditor wrote that “the City has a formal cyber security policy; however, the enforcement of the policy was not consistent across all City departments.” The letter also found the city was “not reviewing security reports on a regular basis.”

The most pointed finding concerned multifactor authentication (MFA). The Cleveland Municipal Court and the Department of Public Utilities did not have MFA policies in place. MFA requires a second proof of identity beyond a password, and it blocks many account takeovers.

What the auditor wants fixed

To reduce the risk of more attacks, the auditor wrote that “the City should establish a cybersecurity awareness training program for all network users.” Training targets the phishing emails and social engineering that start many breaches.

Enforcing the existing policy across all departments and reviewing security reports on a schedule would close the other gaps the letter describes. Neither requires new technology.

Lessons for other cities

Cleveland’s problems are common in local government. Many cities run on old systems with small IT teams, and attackers know it. Two disruptive incidents in one year show what that costs residents who need courts and city services.

Alex Hamerstone, advisory solutions director at TrustedSec, told News 5: “It really looks like there’s some very basic foundational things that are not in place.” He compared MFA to seatbelts and said the public sector has a higher standard because people cannot choose not to give the government their data.

How the city responded

A city spokesperson said Cleveland is reviewing the report and working with the state to improve its practices. The Municipal Court said it has since rolled out MFA for all court employees.

The fixes the auditor listed are basic and cheap compared with another shutdown. Other cities can run the same checklist now: MFA everywhere, a policy that every department follows, regular review of security logs and training for every user.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.