Audit finds security holes in ACT finance systems

Powered by SC Magazine
 

Recommends stronger passwords, audit trail.

The Australian Capital Territory's Audit Office has pointed out a number of weaknesses in the security and disaster recovery attributes of the Territory's critical finance systems.

The auditor's findings [PDF] come within a fortnight of the release of an ANAO audit of Federal Government systems which painted much the same picture.

Whilst highlighting significant improvements in some systems, the audit office found weaknesses that "can lead to a higher risk of inappropriate or fraudulent access to computer information systems and unauthorised changes to applications and data."

The auditor found weaknesses in four of the eight key financial systems running the ACT Government - the Territory Revenue System (the IT system used by the Department of Treasury to record taxes, fees and fines), the MAZE schools administration system, Homenet (the IT used to record and manage information on Housing ACT's housing services) and Rego.act (the IT system used to process motor vehicle registrations, drivers' licenses and related infringements).

In particular, the auditor found that security controls around user access for Homenet and Rego.act and backup and recovery procedures for Homenet and Territory Revenue System needed to improve.

It found five users with inappropriate access to the Oracle database holding Homenet data. Housing ACT responded that Homenet 5, introduced in April 2010, would address this issue.

The auditor also noted that audit logs of changes to most of the territory's applications and data were not being reviewed.

"This exposes agencies to a higher risk of inappropriate or fraudulent changes to applications and data," it noted.

It also found The Territory Revenue System did not lock accounts to prevent access after a specified number of logon attempts, and that no mechanism ensured passwords were sufficiently complex to minimise the risk of being compromised.

ACT Treasury agreed with the audit findings and said that it intended to address the identified control weaknesses during an upgrade to the Territory Revenue System in late 2011.

Copyright © iTnews.com.au . All rights reserved.


Audit finds security holes in ACT finance systems
 
 
 
Top Stories
Matching databases to Linux distros
Reviewed: OS-repository DBMSs, MariaDB vs MySQL.
 
Coalition's NBN cost-benefit study finds in favour of MTM
FTTP costs too much, would take too long.
 
Who'd have picked a BlackBerry for the Internet of Things?
[Blog] BlackBerry has a more secure future in the physical world.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  70%
 
Advanced persistent threats
  3%
 
Unpatched or unsupported software vulnerabilities
  12%
 
Denial of service attacks
  6%
 
Insider threats
  10%
TOTAL VOTES: 707

Vote