Audit finds security holes in ACT finance systems

The Australian Capital Territory's Audit Office has pointed out a number of weaknesses in the security and disaster recovery attributes of the Territory's critical finance systems.

The auditor's findings [PDF] come within a fortnight of the release of an ANAO audit of Federal Government systems which painted much the same picture.

Whilst highlighting significant improvements in some systems, the audit office found weaknesses that "can lead to a higher risk of inappropriate or fraudulent access to computer information systems and unauthorised changes to applications and data."

The auditor found weaknesses in four of the eight key financial systems running the ACT Government - the Territory Revenue System (the IT system used by the Department of Treasury to record taxes, fees and fines), the MAZE schools administration system, Homenet (the IT used to record and manage information on Housing ACT's housing services) and Rego.act (the IT system used to process motor vehicle registrations, drivers' licenses and related infringements).

In particular, the auditor found that security controls around user access for Homenet and Rego.act and backup and recovery procedures for Homenet and Territory Revenue System needed to improve.

It found five users with inappropriate access to the Oracle database holding Homenet data. Housing ACT responded that Homenet 5, introduced in April 2010, would address this issue.

The auditor also noted that audit logs of changes to most of the territory's applications and data were not being reviewed.

"This exposes agencies to a higher risk of inappropriate or fraudulent changes to applications and data," it noted.

It also found The Territory Revenue System did not lock accounts to prevent access after a specified number of logon attempts, and that no mechanism ensured passwords were sufficiently complex to minimise the risk of being compromised.

ACT Treasury agreed with the audit findings and said that it intended to address the identified control weaknesses during an upgrade to the Territory Revenue System in late 2011.