Information Systems Audit Report 2020 - Local Government Entities
Information Systems Audit Report 2020 - Local Government Entities
Information Systems
Audit Report 2020 –
Local Government
Entities
Audit team:
Jordan Langford-Smith
Kamran Aslam
Walber Almeida
Karla Cordoba
Fareed Bakhsh
Nomin Chimid-Osor
The Office of the Auditor General acknowledges the traditional custodians throughout
Western Australia and their continuing connection to the land, waters and community. We
pay our respects to all members of the Aboriginal communities and their cultures, and to
Elders both past and present.
WESTERN AUSTRALIAN AUDITOR GENERAL’S REPORT
CAROLINE SPENCER
AUDITOR GENERAL
25 June 2020
Contents
Auditor General’s overview ......................................................................................... 2
Introduction .................................................................................................................. 4
Conclusion ................................................................................................................... 4
Background .................................................................................................................. 4
What we found ............................................................................................................. 5
Recommendations ......................................................................................................10
General computer controls and capability assessment results for local government
entities ...................................................................................................................... 11
Introduction .................................................................................................................12
Conclusion ..................................................................................................................12
Audit focus and scope .................................................................................................13
What we found ............................................................................................................14
Recommendations ......................................................................................................23
Appendix 1 – Better practice guidance to manage technical vulnerabilities ............. 24
Auditor General’s overview
I am pleased to present our first local government Information Systems
Audit report since the proclamation of the Local Government Amendment
(Auditing) Act 2017. The report summarises the results of the 2019 cycle
of information systems audits at 10 local government entities.
Our general computer control audits are a fundamental part of our
financial audits. They help to provide assurance that the financial
information generated by information systems is accurate, reliable and
completely recorded. While local governments will differ in the size and scale, it is critical that
they have effective controls to manage information systems.
The report has 2 parts:
• Information systems – security gap analysis
• General computer controls and capability assessment of local government entities.
The security gap analysis benchmarks the results of local government entities’ security
practices against a globally recognised standard. This standard provides a set of controls
which entities can easily implement to protect critical information from internal and external
threats. The standard provides useful guidance on how entities can address weaknesses
and risks to their information security. My Office performed a similar exercise for State
government entities in our 2013 Information Systems Audit Report.
We found that all 10 local government entities had significant shortcomings in their
information security practices. Entities need to seriously consider these standards and the
recommendations in this report to improve information security practices and protect the
confidentiality, integrity and availability of information and systems.
The second part of this report outlines the results of our general computer controls audits
and capability assessments. Overall, the level of maturity in the reviewed local government
entities was low, with no entity meeting our minimum benchmark across all control
categories.
Local government entities’ information systems are integral for delivering key public services.
However, most of the entities do not have a holistic view of activities that pose risks to their
information systems. Entities should have visibility over their systems and take a strategic
approach to address these risks.
International standards provide a good framework and starting point for entities to develop
and implement sound practices in their operational and strategic security processes. My
Office will continue to monitor and report on general computer controls and capability
assessments of local government entities. We expect to see better results similar to the
improvements made in the State sector in recent years as reported through our regular
information system audit program.
Conclusion
All audited entities had significant gaps in their management of information security when
compared against the standard. We found that entities did not have good practices to
manage information and cyber security. Entities did not have appropriate policies and
processes to identify and guide information security practices and they often lacked ongoing
monitoring processes to detect and respond to threats. These gaps in security controls
seriously undermine the confidentiality, integrity and availability of information held by these
entities.
Background
Local government entities hold information, including confidential information about people
and the community, which is fundamental to their operations and should be protected from
external and internal threats. As IT systems and computing environments become more
interconnected, the amount of information grows, along with the number and diversity of
threats. Effective information security involves managing people, processes and technology
to preserve the confidentiality, integrity and availability of information.
Entities can use the information security standard as a starting point to develop sound
practices, or to assess their current controls. The standard has 14 areas with each area
containing various controls that can be tailored to needs, size and complexity of entities.
In order to determine an overall rating for each area, we:
• determined which controls were applicable
• assessed and gave individual controls a score
• consolidated these scores to calculate an overall result which considered the number of
effective controls in the area
• rated scores above 80 percent to be effective, scores from 61 to 80 percent as partially
effective, and below 61 percent as ineffective.
What we found
All of the audited entities had significant gaps in meeting the good practice standard across
several control areas (Figure 2). Only 4 entities demonstrated that they were effective, or
partially effective in at least 7 of the 14 areas. In order to protect the security of the
information and systems of the audited entities, we have not named them in this report. We
provided each audited entity with a copy of their gap analysis results.
Each entity has unique security requirements based on their business needs. However, the
majority of the entities had not assessed and identified their security requirements.
Generally, security requirements can be identified through:
• assessing risks, taking into account the overall business strategy and objectives
including vulnerabilities and threats to assets
• understanding legal, statutory and contractual requirements that apply to the entity and
its contractors and service providers
Security policies did not provide direction and support for information security
Half of the entities did not have adequate policies outlining their approach for managing
information security objectives. We found that policies did not contain guidance for key
areas, including:
• roles and responsibilities for information security management
• access management
• protection from malware or malicious code
• use of IT assets and technical vulnerability management.
It is critical that entities take a strategic approach to information security by understanding
the risks and implementing appropriate policies for the governance of security.
Additionally, none of the entities had a policy or a management approach on the use of
cryptography controls, with all 10 entities rated as ineffective. A lack of guidance or direction
for cryptography controls increases the risk that the confidentiality and integrity of information
held by these local government entities could be compromised.
We also found 90% of the entities did not have good processes to check compliance with
security requirements. For example, performing periodic internal reviews is a good way to
ensure controls are working as expected. Without processes to detect policy breaches and
non-compliance, entities cannot determine if their controls are operating effectively.
Most entities had business continuity strategies but few had tested these
Three entities in the sample had good practices to manage business continuity and
information security aspects during disaster situations. Four entities had not verified their
capability to recover and ensure security of information during a serious interruption, and
only partially met the standard. It is crucial to have well developed and verified business
continuity and recovery strategies that address the security of information in crisis situations.
The remaining 3 entities had not adequately defined the information security requirements
and plans in a disaster situation and consequently had inadequate business continuity and
recovery strategies. This meant that a disaster or pandemic could disrupt their key services
for prolonged periods and potentially compromise information security.
1
https://www.cyber.gov.au/ism
2
https://www.nist.gov/cyberframework
Source: OAG
Figure 3: GCC categories
Conclusion
All 10 local government entities need to improve their general computer controls. We
reported 150 control weaknesses across the 10 entities, with 13 of these weaknesses rated
Source: OAG
Figure 4: Rating scale and criteria
3
The information within this maturity model assessment is derived from the criteria defined within COBIT 4.1, released in 2007
by ISACA.
Source: OAG
Figure 5: Capability maturity model assessment results
Source: OAG
Figure 6: Distribution of ratings for GCC findings in each control category we reviewed
Information security
Good information security practices are critical to protect the information held in key financial
and operational systems from accidental or deliberate threats and vulnerabilities.
We found that all 10 local government entities need to improve their practices for managing
information security, with no entity meeting our benchmark. We reported 72 issues, nearly
half related to the security of information and systems. It is concerning that 11 were rated as
significant requiring prompt attention, as they seriously exposed the entity’s systems and
information to misuse.
Several entities had not clearly defined roles and responsibilities for information security.
This, coupled with a lack of appropriate policies and practices, meant their approach towards
security was inconsistent and ad-hoc.
A common weakness we found at most entities was a lack of processes to identify and patch
security vulnerabilities in systems and ICT infrastructure. Our vulnerability scans of key entity
systems identified a range of critical and high severity vulnerabilities which had not been
Source: OAG
Figure 7: Poor vulnerability management leaves an entity exposed to cyber attacks
Source: OAG
Figure 8: Lack of controls to manage the rates and infringement system
Source: OAG
Figure 9: Internet accessible systems lack controls
Business continuity
Good continuity planning helps ensure that key business functions and processes are
restored promptly after a disruption. Business continuity and disaster recovery plans should
be regularly tested. This minimises the risk of extended outages which could disrupt the
delivery of important services.
We found that 7 of the 10 audited entities did not have up-to-date business continuity and
disaster recovery arrangements in place. Some plans had not been updated since 2013 and
may not reflect current business practices and IT infrastructure. As a result, in the event of a
disruption or disaster, entities may not be able to restore and continue business processes
and functions.
Weaknesses in business continuity and disaster recovery planning could have a serious
impact on the critical services local government entities deliver to the public. To ensure
business continuity, entities should have an up-to-date business continuity plan, disaster
recovery plan and incident response plan. The business continuity plan defines and
prioritises business critical operations and therefore determines the resourcing and focus
areas of the disaster recovery plan. The incident response plan needs to consider potential
incidents and detail the immediate steps to ensure timely, appropriate and effective
response.
IT operations
Only 2 of the 10 entities had adequately defined their requirements for IT service levels and
allocated sufficient resources to meet these requirements. IT operations include day-to-day
tasks designed to keep services running, while maintaining data integrity and the resiliency of
IT infrastructure. In this area, we tested whether entities had formalised procedures and
monitoring controls to ensure processes were working as intended.
Common weakness we found included:
• a lack of asset registers to track and monitor IT equipment which may lead to assets
being lost or stolen and unintentional disclosure of information
• inadequate processes to ensure compliance with software licensing agreements. This
could result in penalties for breaching licencing arrangements
• a lack of service level agreements with IT vendors and poor contract management
practices leading to inadequate oversight of vendors or paying for services not provided
• inadequate retention and management of event logs. This means entities cannot track
or identify malicious activities, nor they can investigate them
• a lack of access reviews which could result in inappropriate access.
Without appropriate IT strategies and supporting procedures, IT operations may not be able
to respond to business needs and recover from errors or failures.
The following case studies highlight the risk to entities when devices and their events are not
regularly monitored, and assets are not effectively managed.
Source: OAG
Figure 10: Importance of regularly reviewing log events
Source: OAG
Figure 11: Unauthorised disclosure of entity information
Source: OAG
Figure 12: Increased risk of network compromise
Change control
We found that only 2 of 10 entities had appropriate processes to implement changes in their
IT systems and infrastructure. We reviewed whether changes to systems were authorised,
tested, implemented and recorded in line with management’s intentions. Weaknesses we
found included:
• a lack of formal system change management procedures. This increases the risk that
changes, including those that may be harmful to systems and information, could be
implemented without assessment
• no records of changes made to critical systems. This would make it difficult to
investigate incidents that may have been caused by changes.
If changes are not controlled, they can compromise the security and availability of systems.
As a result, systems will not process information as intended and entities’ operations and
services may be disrupted. There is also a greater chance that information will be lost and
access given to unauthorised people.
We expected entities to have formal policies and procedures to ensure changes were risk
assessed, tested, sufficiently documented and authorised prior to being implemented. This
helps to ensure that changes to systems are consistent and reliable.
Physical security
Over half of the entities (6 of 10) did not have appropriate controls to protect their IT systems
and infrastructure against environmental hazards and unauthorised access to server rooms.
This means entities are at increased risk of unauthorised access and failure of information
systems.
The following case study shows issues commonly faced by entities.
Source: OAG
Figure 13: Information systems at risk of disruption
Stocktake of assets Entities should have visibility of all their ICT assets on the
network including servers, workstations, printers, software
applications, IoT and other network devices (switches, routers,
firewalls).
Identify vulnerabilities Regular vulnerability scans must be performed to identify
security weaknesses. Where it is not possible to scan all assets
at once, entities should prioritise and group assets to scan
them in stages.
Scans should be regular (e.g. continuous or monthly) as
extended time gaps between scans leave the systems exposed
for longer periods.
Understand the exposure Each vulnerability poses a threat but some are more severe
than others. Vulnerabilities generally have a severity rating
based on impact and how easily they can be exploited.
Entities should perform risk assessments to understand the
exposure and take appropriate action.
Test and patch Entities should test patches before deploying them to live
vulnerabilities production systems. Ideally vulnerabilities should be patched as
soon as possible, in line with their severity and impact levels.
Entities should define appropriate timeframes to patch
vulnerabilities based on their severity.
4
https://www.cyber.gov.au/publications/assessing-security-vulnerabilities-and-applying-patches
Don’t forget the network Network devices such as firewalls, routers and switches - and
devices – and printers printers - are equally important. Vulnerability management
processes must include them as well. Entities should regularly
update the firmware and software for these devices.
Verify the patches Entities should establish a process to verify that patches have
successfully fixed the vulnerabilities. Some patches may fail to
install or could require further configuration to fully address the
weakness. Running another scan after applying patches can
identify and report such instances.
Source: OAG
Figure 14: Better practice guidance to manage technical vulnerabilities
Report
2019-20 reports Date tabled
number
Western Australian Public Sector Audit Committees –
26 25 June 2020
Better Practice Guide
T: 08 6557 7500
F: 08 6557 7600
E: [email protected]
W: www.audit.wa.gov.au
@OAG_WA