Sent: Thursday, March 30, 2017 3:24:26 PM (UTC-05:00) Eastern Time (US & Canada) Subject: Security Concerns Ihave some very real concems with the legitimacy of this company in regards to the security needs of the State Board of Elections. Their core business model is offering “education” and “remediation” services to their three primary markets; insurance, financial services and employee benefits industries. See below a screenshot of the core mission statement from the front page of their own website. Note the two key services, “proactive education and breach remediation support”. Please take a moment to read at least the first three paragraphs from the Insurance Journal online article from January 11, 2017: http://www. insurancejournal.com/news/national/2017/01/11/438608.htm While the services Cyberscout offers may be useful in some situations, | hope that the SBE Board understands that they do not offer any intrusion monitoring software or hardware solutions at all. In fact, they don't offer any security devices or real-world experience of any type. What they offer is advice and moral support. Perhaps this is what the Board feels we need? Although we weren't consulted on this matter, | want to point out that we have previously recommended working with one of a select few companies that have years of real-world data security experience. These companies offer hardware and software security solutions such as Web Application Firewalls, Penetration Testing and Security Incident and Event Manager (SIEM) systems. As you know, | have been working with the highly respected and experienced security company, Trustwave, on determining the best protection model for the Voter Registration Database. | have worked directly with their security engineers to craft two custom solution paths and the bids for those solutions have been received. Also, in an effort to best use the resources provided by COT, we have been working directly with David Carter, CISO of KY. He has committed to continuing to work with us to customize a DMZ within the new Palo Alto firewall structure. In summary, while we may need and benefit from the services of a company such as Cyberscout, | want to be perfectly clear that contracting with them will in no way fulfil the actual security needs of our systems and will in no way mitigate our risk of intrusion. Thank you, Tom Watson and Steve Spisak 502) 573-7100 Senior Software Engineers Kentucky State Board of Elections Steve Spisak NOTICE: This electronic mail transmission is for the use of the named individual or entity to which it is directed and may contain information that is privileged or confidential. It is not to be transmitted to or received by anyone other than the named addressee (or a person authorized to deliver it to the named addressee). It is not to be copied or forwarded to any unauthorized persons. If you have received this electronic mail transmission in error, delete it from your system without copying or forwarding it, and notify the sender of the error by replying via email or by calling the Kentucky State Board of Elections at (502) 573-7100, so that our address record can be corrected. ‘misdr000323