COM 0939.000 2008-2010 - Laserfiche WebLink

Home

COUNTY OF HAWAII STATE OF HAWAII Status of Prior Year Findings and Recommendations Fiscal year ended June 30, 2009 ACCESS TO PROGRAMS AND DATA We noted the following issues related to information technology (IT) general controls regarding access to programs and data: • Information Security Policy — A County -wide information security policy has not been documented, approved by management, and communicated throughout the organization. As a result, IT procedures may be performed inconsistently and users will be less likely to adhere to appropriate IT practices. • Passwords — Network password parameters for the IAS application do not require complexity. Ineffective password settings increase the risk of unauthorized access to the system and could ultimately compromise the integrity of the data, affecting the financial reporting and business decisions based on this data. • User Access — Functional users of key IT applications were noted as also having administrator access. Functional users that have the ability to perform security administration functions, such as provisioning of user access, may be able to override segregation of duty controls within the application. • Review of User Access — A periodic review of active users and user access rights to identify and remove inappropriate system access for key IT applications is not performed. Further, a periodic review of functional roles within the County to identify process changes and potential segregation of duty conflicts is not performed. User reviews should be performed periodically by the Department of Data Systems to help ensure that all users in the system are appropriate and that job transfers and employee terminations have been appropriately updated in the system. • Physical Access — Physical access to the server room hosting the IAS application is not restricted at all times. The physical access control mechanisms currently in place do not enable the appropriate County employees to monitor access to the server room. Recommendation We recommend that the Department of Data Systems take the following steps in addressing the issues noted above, as follows: • Information Security Policy — Management should document, approve, and communicate a formal information security policy. The policy should be reviewed by management on an annual basis and evidenced via sign -off of the reviewer(s). 4 (Continued)