2021 May 20 - Follow-Up Report: County of Hawaii Information Technology Asset Management

Home

Hardware and Software Inventory Management Recommendation # 5. Centralized Management System Status: Implemented We recommend DIT track users in a centralized database. Not tracking users in a centralized database may increase the County's security exposure since DIT may not be able to determine if computers are in use or locate assets. In addition, DIT may have difficulty holding employees accountable for the protection of assets and inappropriate activities. Unused computers are candidates for redeployment and may unnecessarily consume software licenses. From a software compliance perspective, software end-user licensing agreements can be tied to users instead of computers, and DIT may not be able to determine the appropriate license counts without knowing the assigned users. The fixed assets inventory system is not accessible to DIT and the automated network and software inventory system is not used to track the user. Auditee Action: We observed Lansweeper, an automated software program used to monitor asset data information, network security, software updates, and patches for: 1,408 users 1,449 devices Flagging computers/devices not seen in the network in the last 30/60/90 days Flagging users’ access upon separation from the County every two weeks Flagging and redeploying local or cloud-based software licenses (Microsoft/Adobe) when computers become inoperable, or user separates from the County Blocking at-risk devices from the network Pushing out security updates and patches Restricting most user’s administrative rights. Reporting discrepancies to department IT liaisons IT Asset Management Follow-up Audit Status of Recommendations page 6