Laserfiche WebLink
COUNTY OF HAWAII <br /> STATE OF HAWAII <br /> Status of Prior Year Findings and Recommendations <br /> For the Fiscal Year ended June 30. ZOOd <br /> UNAUTHORIZED USER ACCESS <br /> Observation <br /> We noted that the listing of users authorized to access the County's various information systems was not <br /> reviewed for appropriateness and updated by County department heads. Maintaining an updated list of authorized <br /> users facilitates the County's efforts to ensure that terminated and/or unauthorized users are denied access to its <br /> information databases. <br /> In addition, during our review of the County's real property tax Windows nehvork, we noted that the account <br /> lockout feature was not utilized. An account lockout setting allows administrators to control the number of <br /> unsuccessful logins that may occur before a user is denied access. By not utilizing this setting, an unauthorized <br /> user is allowed to indefinitely guess a user's password until they gain access to the Windows nehvork. <br /> Recommendation <br /> We recommended that department heads periodically review the listing of users authorized to access the <br /> County's various information systems. Department heads should work with the Department of Data Systems to <br /> ensure the integrity and accuracy of the listing. We also recommended that the County utilize the aecow~t lockout <br /> setting for its real property tax Windows nehvork. Use of this setting will allow system administrators to detect if <br /> an attack is occurring and help prevent unauthorized access into the system. The account lockout settings should <br /> be set to the s}stem until an authorized system administrator resets his/her password. <br /> Status <br /> Department heads are now required to inform the Department of Data Systems when employees are either <br /> terrinated or transferred. The Department of Data Systems will also perform an annual review of the authorized <br /> users, ensuring that the listing remains current. Additionally, a lockout feature was established on the real <br /> property tax Windows network, where the user is locked out after three mtsuccessful login attempts. Also, a <br /> 120-day password expiration was initiated for all users, ensuring that all passwords are changed on a regular <br /> <br /> basis. As efforts have been made to implement the recommendation, the comment is no longer applicable. <br /> 4 <br /> <br />