Auditor-General slams Vic Govt data security flaws

The Victorian Auditor-General has observed “fundamental flaws” within the Victorian Government’s handling of IT security.

In a report entitled Maintaining the Integrity and Confidentiality of Personal Information, the Auditor-General said information from within three Victorian Government departments, including the Premier's, had been stored on portable storage devices, CDs and DVDs that were vulnerable to loss and in easily-read formats.

Personal information was also exchanged via personal email accounts, some of which were "particularly vulnerable" to unauthorised access, the Auditor General said.

“While we examined only three departments, the ability to penetrate databases, the consistency of our findings and the lack of effective oversight and coordination of information security practices strongly indicate that this phenomenon is widespread,” the Auditor-General said in the report.

“Extracts or whole copies of personal information from the selected databases were stored in unsecured shared drives on departmental networks accessible by unauthorised staff.”

Poor password management, poor physical security of servers (one had been stored behind a front reception desk), no mandatory use of antivirus software for remote access and 'protected' data held off-site in a home office had all contributted to the security failings.

The report concluded that the confidentiality of personal information collected and used by the public sector could be, and had been, "easily compromised".

It said that the issues had arisen partly because information security policy, standards and guidance for the sector were incomplete and "too narrowly focused on ICT security".

"Neither the Department of Treasury and Finance nor the Department of Premier and Cabinet have addressed all aspects of information security following the disbanding of the Office of the Chief Information Officer and its supporting committees in 2006," it said.

"In the absence of strong and consistent central leadership and effective oversight, the importance of protecting personal information has not been properly understood by the sector."

Victorian Premier, John Brumby, said the report sent a "very strong signal" to all departmental and agency heads about the "importance" of the issue.

"The Auditor-General has highlighted these concerns, and we are acting on them," he said.