2014-COH - Single Audit of Federal Financial Assistance Programs

Home

County of Hawaii, State of Hawaii SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Fiscal Year Ended June 30, 2014 SECTION II - FINANCIAL STATEMENT FINDINGS (Continued) Ref. No. Internal Control Findings 2014-002 Physical Security - Significant Deficiency Condition: The servers for the Eden and IAS systems are located in a room at the Civil Defense Center (Center). During our visit to the Center, we noted the following conditions: Security over the servers is compromised as the door to the room housing these servers is left open due to cooling concerns. Anyone with access to the Civil Defense Center could potentially access the server room. A fire suppression system was not installed. Criteria: Physical access to servers and other sensitive areas is appropriately restricted to authorized personnel. Devices are used to secure sensitive equipment and storage media from the risk of damage from fire. Cause: The County has not formally documented policies and procedures over the physical security of IT systems at the Center nor effectively designed these controls. Effect: Unauthorized access to the server room could result in unauthorized use, modification, damage or loss of data. The absence of a five suppression system could increase the likelihood of the loss or destruction of data due to fire. Recommendation We recommend that the County develop formal policies over the physical security of IT systems at the Center and to implement them. The server room should be locked and access to keys or codes should be limited to authorized personnel. A fire suppression system should be installed to prevent or limit the loss of data from fire. 27