2014-COH - Single Audit of Federal Financial Assistance Programs

Home

County of Hawaii, State of Hawaii SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Fiscal Year Ended June 30, 2014 SECTION II - FINANCIAL STATEMENT FINDINGS Ref. No. Internal Control Findings 2014-001 Logical Access & Access Security - Significant Deficiency Condition: During our audit, we noted that the County had several internal control deficiencies related to logical access and access security including: • Inadequate password parameters and security settings for IAS and ReCo, combined with network domain password security settings pertaining to minimum password age and lockout parameters that could be further strengthened. • The County did not have any formally documented security administration policies and procedures. Criteria: Access to programs and data are appropriately controlled to prevent unauthorized use, modification, damage or loss of data. A control process exists and is followed to periodically review and confirm user access rights in a timely manner. Procedures exist and are followed to maintain the effectiveness of user authentication and access mechanisms such as password length, password history, and lockout for failed attempts. An information security policy exists and has been approved by an appropriate level of management. A framework of security standards has been developed that supports the objectives of the security policy. Cause: The County has not formally documented all of the Logical Access & Access Security controls nor effectively designed all of these controls. The IAS and ReCo systems do not have the functionality to support adequate password parameters and security settings. Effect: Unauthorized logical access to these systems could result in the destruction of data, unauthorized transactions being made, transactions being inaccurately recorded, or internal controls being circumvented. 25