Audit finds security holes in ACT finance systems

Powered by SC Magazine
 

Recommends stronger passwords, audit trail.

The Australian Capital Territory's Audit Office has pointed out a number of weaknesses in the security and disaster recovery attributes of the Territory's critical finance systems.

The auditor's findings [PDF] come within a fortnight of the release of an ANAO audit of Federal Government systems which painted much the same picture.

Whilst highlighting significant improvements in some systems, the audit office found weaknesses that "can lead to a higher risk of inappropriate or fraudulent access to computer information systems and unauthorised changes to applications and data."

The auditor found weaknesses in four of the eight key financial systems running the ACT Government - the Territory Revenue System (the IT system used by the Department of Treasury to record taxes, fees and fines), the MAZE schools administration system, Homenet (the IT used to record and manage information on Housing ACT's housing services) and Rego.act (the IT system used to process motor vehicle registrations, drivers' licenses and related infringements).

In particular, the auditor found that security controls around user access for Homenet and Rego.act and backup and recovery procedures for Homenet and Territory Revenue System needed to improve.

It found five users with inappropriate access to the Oracle database holding Homenet data. Housing ACT responded that Homenet 5, introduced in April 2010, would address this issue.

The auditor also noted that audit logs of changes to most of the territory's applications and data were not being reviewed.

"This exposes agencies to a higher risk of inappropriate or fraudulent changes to applications and data," it noted.

It also found The Territory Revenue System did not lock accounts to prevent access after a specified number of logon attempts, and that no mechanism ensured passwords were sufficiently complex to minimise the risk of being compromised.

ACT Treasury agreed with the audit findings and said that it intended to address the identified control weaknesses during an upgrade to the Territory Revenue System in late 2011.

Copyright © iTnews.com.au . All rights reserved.


Audit finds security holes in ACT finance systems
 
 
 
Top Stories
The True Cost of BYOD - 2014 survey
Twelve months on from our first study, is BYOD a better proposition?
 
Photos: Unboxing the Magnus supercomputer
Pawsey's biggest beast slots into place.
 
ANZ looks to life beyond the transaction
If digital disruptors think an online payments startup could rock the big four, they’ve missed the point of why people use banks, says Patrick Maes.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  29%
 
Application integration concerns
  3%
 
Security and compliance concerns
  28%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 1079

Vote