Text · page 5 of 12
Access to the Network and Financial Application Was Not Properly Restricted Although District officials restricted access to the student information application, they did not adequately secure access to the network and financial application. The District has written procedures for granting, changing and disabling user permissions to the network and applications. According these procedures, the Director has the authority to grant or change user permissions and should review access rights and permissions at least annually in September and October. Generic Network User Accounts – During our review of all 2,243 network accounts, we found 338 generic network user accounts that had varied purposes ranging from administrative functions such as building controls, instructional purposes such as accounts for students to share and accounts used to access servers and configure web filtering settings. Because there was such a large number of generic accounts, officials could have difficulty managing them and identifying their uses to determine their necessity. The Director deleted 65 and disabled 41 generic network user accounts after we brought this to her attention because the accounts were no longer necessary.4 She told us that the District usually reviewed network accounts during the summer, but during the COVID-19 pandemic, her priority had been to provide support for remote and hybrid-learning. However, we found 21 generic network user accounts had a last logon date prior to July 2019 and had not been disabled prior to the pandemic during the summer of 2019. Because the Director was not implementing District procedures to review generic accounts, the District is exposed to a greater risk that personal, private and sensitive information (PPSI)5 could be changed intentionally or unintentionally or be used inappropriately, and officials may not be able to identify who performed the unauthorized activities. Unneeded Application User Accounts and Permissions – During our review of all 85 user accounts in the District’s financial application, we found six unnecessary BOCES6 support service user accounts which were disabled after we informed District officials. Unnecessary user accounts that have not been disabled could potentially be used by former employees or others for malicious purposes. 4 The remaining shared accounts were necessary for District operations and being used by various software applications. 5 PPSI is any information to which unauthorized access, disclosure, modification, destruction or use – or disruption of access or use – could have or cause a severe impact on critical functions, employees, customers, third parties or other individuals or entities. 6 Board of Cooperative Educational Services Of f ic e of t he New York State Comptroller 3