The Australian Capital Territory's Audit Office has pointed out a number of weaknesses in the security and disaster recovery attributes of the Territory's critical finance systems.
The auditor's findings [PDF] come within a fortnight of the release of an ANAO audit of Federal Government systems which painted much the same picture.
Whilst highlighting significant improvements in some systems, the audit office found weaknesses that "can lead to a higher risk of inappropriate or fraudulent access to computer information systems and unauthorised changes to applications and data."
The auditor found weaknesses in four of the eight key financial systems running the ACT Government - the Territory Revenue System (the IT system used by the Department of Treasury to record taxes, fees and fines), the MAZE schools administration system, Homenet (the IT used to record and manage information on Housing ACT's housing services) and Rego.act (the IT system used to process motor vehicle registrations, drivers' licenses and related infringements).
In particular, the auditor found that security controls around user access for Homenet and Rego.act and backup and recovery procedures for Homenet and Territory Revenue System needed to improve.
It found five users with inappropriate access to the Oracle database holding Homenet data. Housing ACT responded that Homenet 5, introduced in April 2010, would address this issue.
The auditor also noted that audit logs of changes to most of the territory's applications and data were not being reviewed.
"This exposes agencies to a higher risk of inappropriate or fraudulent changes to applications and data," it noted.
It also found The Territory Revenue System did not lock accounts to prevent access after a specified number of logon attempts, and that no mechanism ensured passwords were sufficiently complex to minimise the risk of being compromised.
ACT Treasury agreed with the audit findings and said that it intended to address the identified control weaknesses during an upgrade to the Territory Revenue System in late 2011.
Copyright © iTnews.com.au . All rights reserved.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED GOES EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @itnews.com.au to your white-listed senders.