MEETING OF COUNCIL - Town of Cambridge

COUNCIL MINUTES
TUESDAY 27 NOVEMBER 2012
• Information stored on the servers are properly backed up on an hourly basis to
ensure full data protection;
• Antivirus software is active and current;
• Internet user access is regularly monitored and website activity reported to
management
• Staff passwords are regularly changed;
• Proper policies are in place regarding password security;
• Information processed via the Retail Management System, Booking System and
WageEasy payroll system at the golf course is being protected and backed up
through Clublinks;
• Out centres are aware of saving and storing operational and sensitive data on the
main server drives to ensure backup via the Town's main servers. No instances of
such data being stored on local or "C" hard drives were found.
However, it was recommended that the Town’s existing processes be improved by
incorporating the following:
1. Staff access control procedures:
The process for ensuring authorised persons only continue to have access to the
Town’s network and key systems requires improvement. Adequate processes to be
put in place to ensure staff who no longer require access due to terminations, have
their access levels altered, suspended or removed on a timely basis.
Management Comment
In response to the finding, the existing procedure has been revised. A form was in
place and administered by HR, which has now been amended and is required to be
completed for access to the Towns I.T. network or systems by new employees or
contractors, staff changing positions or roles, staff requiring suspension, due to leave
arrangements and staff terminating. Permanent users are authorised by managers to
access remotely for up to 12 months whilst casual users are authorised for limited
periods.
2. External Users Access and Remote Access to the Network:
The Town's main business system supplier (Technology One) has administrator level
access and remote access to the Town’s network on a full time basis. This means that
the Technology One operators have full 24/7 access to the Town’s financial data on a
continuous basis and also access to process financial data. We have recommended
that the Town investigate whether this access level is appropriate and ensure approval
processes over such access is better monitored and controlled.
H:\CEO\GOV\COUNCIL MINUTES\12 MINUTES\NOVEMBER 2012\D AU.DOCX 208