COM 0939.000 2008-2010 - Laserfiche WebLink

Home

COUNTY OF HAWAII STATE OF HAWAII Status of Prior Year Findings and Recommendations Fiscal year ended June 30, 2009 • Passwords — The following password parameters should be implemented for the IAS application: _ Minimum password length of at least six characters Increased complexity of passwords, including the use of alphanumeric and special characters Mandatory password changes every 60 to 90 days Auto lock -out after three failed log -in attempts (system administrator intervention should be required to unlock the account) • User Access — Segregation of duty controls should be implemented so that functional users also do not have administrator access. • Review of User Access — Management should conduct periodic reviews of user profiles and templates, as well as user access to key IT applications. • Physical Access — The server room hosting the IAS application should remain locked at all times and only be unlocked when access to the server room is necessary. Also, management may consider implementing a physical access mechanism that requires a log -on to enhance monitoring and detective controls. We did not identify a material impact to the financial reporting process as a result of these issues; however, the County and the Department of Data Systems can take steps toward enhancing and improving their IT general controls by incorporating the recommendations listed above. Status In response to the issues noted above, the Department of Data Systems has responded as follows: • Information Security Policy — An Information Security Policy Committee has been created to develop guidelines that will ultimately be used for preparing an information security policy for the County. • Passwords — The IAS application does not currently have a feature that would make the recommended changes to the password requirements. The Department of Data Systems will continue to work with their vendor to determine if it would be possible to add this functionality to their software. • User Access — Access is inherently limited due to the small number of personnel. However, access will be monitored to ensure that proper segregation of duties is maintained. • Review of User Access — Management is currently conducting periodic reviews of user profiles and templates on a limited basis. The Department of Data Systems will work on implementing these reviews on a wider scale. • Physical Access — The server was moved and is now locked in a server room. 5