Text · page 5 of 15
a greater risk that personal, private and sensitive information (PPSI)1 could be changed intentionally or unintentionally or be used inappropriately, and officials may not be able to identify who performed the unauthorized activities. Unneeded Network User Accounts – We identified 22 enabled network user accounts that as of March 31, 2021 had not been used in the last six months and were not associated with current active employees and therefore, were unneeded and should be disabled. We also identified four enabled network user accounts that had been used within six months but were no longer associated with current active employees and therefore unneeded. Two of the four accounts were previous City Clerk accounts being used by the current City Clerk. This occurred because City officials had not established a process or written procedures for revoking network access immediately upon termination or resignation of an employee. The Specialist confirmed that these network user accounts were assigned to former employees that had not been disabled from the network access upon resignation. At the time we conducted our audit testing, the Specialist had been in his position for approximately six months and much of his initial duties focused on supporting the City’s efforts to continue operating remotely during the COVID pandemic, assisting with a major software change and updating user operating systems. As a result, he indicated to us that he had not had an opportunity to review network user accounts. When officials do not ensure unneeded network user accounts are disabled, there is a greater risk that these user accounts could potentially be used by former employees or others for malicious purposes. Revoking access to employees who leave service helps to ensure that their network user accounts are not accessible to alter, delete or otherwise damage data or programs. Why Should a City Have Written IT Policies and Security Awareness Training? A well-informed work force is essential to helping to secure a network from unauthorized access or disruptions. Written IT security policies define a city council’s expectations for appropriate user behavior, describe the tools and procedures needed to protect network resources (e.g., data, files) and explain the consequences of policy violations. A city council should provide important oversight and leadership by establishing written policies that take into account people, processes and technology. While IT security policies will not guarantee the safety of the network, a lack of appropriate policies significantly increases 1 Personal, private and sensitive information (PPSI) is any information to which unauthorized access, disclosure, modification, destruction – or disruption of access or use – could have or cause a severe impact to critical functions, employees, customers, third parties, or other individuals or entities. Of f ic e of t he New York State Comptroller 3