116
results found in
11 ms
Page 1
of 12
Management of IT security in systems outsourced to external suppliers
Security to be improved in IT processes outsourced to external suppliers When IT processes are outsourced to external suppliers, the authorities no longer have direct control of the IT security, but remain responsible for managing the security of the IT. Authorities that fail to manage IT security actively based on risk assessments, and omit to monitor the implementation of these requirements, will not be able to determine if the level of IT security in the outsourced systems safeguards their systems and data. This is how the conclusion of the Rigsrevisionen starts. The Danish auditors noticed improvement in the audited entities, but they add that tha majority of the auditees: can refine their requirements for and follow-up on access control and logging practices
Full description
Security to be improved in IT processes outsourced to external suppliers When IT processes are outsourced to external suppliers, the authorities no longer have direct control of the IT security, but remain responsible for managing the security of the IT. Authorities that fail to manage IT security actively based on risk assessments, and omit to monitor the implementation of these requirements, will not be able to determine if the level of IT security in the outsourced systems safeguards their systems and data. This is how the conclusion of the Rigsrevisionen starts. The Danish auditors noticed improvement in the audited entities, but they add that tha majority of the auditees: can refine their requirements for and follow-up on access control and logging practices
Full description
National Audit Office of Denmark
, issued in 2016
Risk cases: 3
The protection of IT systems and health data in three Danish regions
Security to be improved in IT systems with health data It is Rigsrevisionen’s assessment that the three regions are not protecting the access to IT systems and health data in a satisfactory manner. As a consequence, unauthorised persons might gain access to sensitive and confidential personal data, which could affect there liability and availability of important health data used in the treatment of hospital patients. Based on the results of the study and the current threat scenario, Rigsrevisionen finds that basic security measures against cyber attacks and protection of access to IT systems and health data should be a top priority for Denmark’s five regions. Basic security measures in combination with management and control of user privileges can reduce the risk of compromising the regions’ IT systems and data considerably.
Full description
Security to be improved in IT systems with health data It is Rigsrevisionen’s assessment that the three regions are not protecting the access to IT systems and health data in a satisfactory manner. As a consequence, unauthorised persons might gain access to sensitive and confidential personal data, which could affect there liability and availability of important health data used in the treatment of hospital patients. Based on the results of the study and the current threat scenario, Rigsrevisionen finds that basic security measures against cyber attacks and protection of access to IT systems and health data should be a top priority for Denmark’s five regions. Basic security measures in combination with management and control of user privileges can reduce the risk of compromising the regions’ IT systems and data considerably.
Full description
National Audit Office of Denmark
, issued in 2018
Risk cases: 3
IT Police Systems
Implementation by the Polish Police of two IT projects (E-police station and Command Support System - CSS) was audited. Both systems were to relieve the Police officers and increase the quality ... and effectiveness of their work. Audit explained the reason of failure in the case of E-police station project and success in the case of CSS. Although some irregularities occurred in both cases, careful planning ... and organization of the project turned out to make the difference. Accordance with the public procurement law was not part of the audit as a separate investigation in that matter was carried by respective Polish ... ... A textbook example of how not to implement the IT projects ... Polish NIK compared the implementation of two flagship IT projects of the Police HQ: successful 'Command Support System' and problematic 'E-police station'. List of interesting problems appeared...
Full description
Implementation by the Polish Police of two IT projects (E-police station and Command Support System - CSS) was audited. Both systems were to relieve the Police officers and increase the quality ... and effectiveness of their work. Audit explained the reason of failure in the case of E-police station project and success in the case of CSS. Although some irregularities occurred in both cases, careful planning ... and organization of the project turned out to make the difference. Accordance with the public procurement law was not part of the audit as a separate investigation in that matter was carried by respective Polish ... ... A textbook example of how not to implement the IT projects ... Polish NIK compared the implementation of two flagship IT projects of the Police HQ: successful 'Command Support System' and problematic 'E-police station'. List of interesting problems appeared...
Full description
Supreme Audit Office of Poland
, issued in 2013
Risk cases: 5
The implementation of national IT projects in social and health care
IT management expenditure in public administration totalled about 2.1 billion euros in 2009. IT management expenditure by local authorities and federations of municipalities in the field of health ... care totalled about 270 million euros ino 2009. Health care's share of IT management expenditure in public administration thus amounted to about 13 per cent in 2009. ... ... IT-centred manner of project implementation can harm IT investments' results ... SAI Finland perfomed a vast review of IT projects in health and social protection. Many interesting findings cover structural problems, as 'Many separate systems with no future' and characteristics ... of poor governance, as 'No cost monitoring - unclear objectives - arguable usefulness'.
Full description
IT management expenditure in public administration totalled about 2.1 billion euros in 2009. IT management expenditure by local authorities and federations of municipalities in the field of health ... care totalled about 270 million euros ino 2009. Health care's share of IT management expenditure in public administration thus amounted to about 13 per cent in 2009. ... ... IT-centred manner of project implementation can harm IT investments' results ... SAI Finland perfomed a vast review of IT projects in health and social protection. Many interesting findings cover structural problems, as 'Many separate systems with no future' and characteristics ... of poor governance, as 'No cost monitoring - unclear objectives - arguable usefulness'.
Full description
National Audit Office of Finland
, issued in 2011
Risk cases: 3
IT strategy of Swiss Federal Institute of Technology
The SFAO conducted an IT audit in 2009, in order to evaluate goal achievement and cost effectiveness of information and communication technology by Swiss Federal Institute of Technology (ETH Zurich ... ). [p. 11] ... Performance audit of IT strategy in research area ... Interesting problems of IT strategy implementation - including that of organizational authonomy skope.
Full description
The SFAO conducted an IT audit in 2009, in order to evaluate goal achievement and cost effectiveness of information and communication technology by Swiss Federal Institute of Technology (ETH Zurich ... ). [p. 11] ... Performance audit of IT strategy in research area ... Interesting problems of IT strategy implementation - including that of organizational authonomy skope.
Full description
Swiss Federal Audit Office
, issued in 2010
Risk cases: 1
State aid for IT projects in social and health care
information system services (KanTa project) or the National Project for Social Services IT (Tikesos project). Financing has been provided by the Ministry of Social Affairs and H ealth, the Finnish Funding ... to enterprises by Tekes or financing granted by the Finnish Innovation Fund (Sitra) for IT projects in social and health care. ... In 2000-2009 about 180 million euros in national and European Union funds went to finance information technology projects in social and health care, not including the costs of developing national ... Difficult coordination of IT projects ... Finish Audit Office analyzed results of poor cooperation between authorities on national and local level in social and health care projects: difficult integration of information systems and poor ... coordination of the financing information technology projects, including double financing.
Full description
information system services (KanTa project) or the National Project for Social Services IT (Tikesos project). Financing has been provided by the Ministry of Social Affairs and H ealth, the Finnish Funding ... to enterprises by Tekes or financing granted by the Finnish Innovation Fund (Sitra) for IT projects in social and health care. ... In 2000-2009 about 180 million euros in national and European Union funds went to finance information technology projects in social and health care, not including the costs of developing national ... Difficult coordination of IT projects ... Finish Audit Office analyzed results of poor cooperation between authorities on national and local level in social and health care projects: difficult integration of information systems and poor ... coordination of the financing information technology projects, including double financing.
Full description
National Audit Office of Finland
, issued in 2011
Risk cases: 3
Insufficient monitoring of consultancy work in large-scale IT projects
Insufficient monitoring of consultancy work in large-scale IT projects The German Federal Ministry of the Interior did not sufficiently plan, monitor and control consultancy work in two large-scale IT projects, not being thus able to evaluate the amount of work done and pay accordingly. It was recommended by SAI the establishment of a quality management system and its application mandatory for large-scale IT projects
Full description
Insufficient monitoring of consultancy work in large-scale IT projects The German Federal Ministry of the Interior did not sufficiently plan, monitor and control consultancy work in two large-scale IT projects, not being thus able to evaluate the amount of work done and pay accordingly. It was recommended by SAI the establishment of a quality management system and its application mandatory for large-scale IT projects
Full description
Bundesrechnungshof
, issued in 2017
Risk cases: 1
Steps Needed to Identify Acquisition Training Needs for Non-Acquisition Personnel
Non-Acquisition staff can be crucial for acquisition Despite from hundreds of billions of dollars spent annually to acquire products and services, the US Department of Defense does not full information about staff to be trained. The information is needed about the non-acquisition staff, who can play crucial role in particular acquisitions. As GAO underlines, their identification is necessary to fully understand the training needs and... budget.
Full description
Non-Acquisition staff can be crucial for acquisition Despite from hundreds of billions of dollars spent annually to acquire products and services, the US Department of Defense does not full information about staff to be trained. The information is needed about the non-acquisition staff, who can play crucial role in particular acquisitions. As GAO underlines, their identification is necessary to fully understand the training needs and... budget.
Full description
US Government Accountability Office
, issued in 2019
Risk cases: 4
The Board of Audit and Inspection (BAI) conducted an audit on the information systems in the area of service delivery to improve the system’s efficiency and convenience.
Korea was recognized as an Information Technology (IT) powerhouse by the international community of the UN in 2010. Such an achievement is attributable to the significant investments that the Korean ... for citizens in the welfare and employment sectors by utilizing the renewed information infrastructure.<br/> However, the information system of some government ministries proved to have overlapping functions ... and there was a noticeable lack of connectivity between them. Errors and omitted data by the administrators were discovered as well, leading to the citizens losing faith in the system. ... Enormous IT investments require tremendous coordination ... Korean government is investing 1 trillion won in e-government projectsevery year. Thus, the country has earned a reputation for the IT powerhouse. Apart from undeniable advantages, the huge scale ... and the speed, the information technologies are implemented with, cause some problems to be tackled. The SAI Korea turns special atention to two of them: overlapping functionalities and interconnectivity issues.
Full description
Korea was recognized as an Information Technology (IT) powerhouse by the international community of the UN in 2010. Such an achievement is attributable to the significant investments that the Korean ... for citizens in the welfare and employment sectors by utilizing the renewed information infrastructure.<br/> However, the information system of some government ministries proved to have overlapping functions ... and there was a noticeable lack of connectivity between them. Errors and omitted data by the administrators were discovered as well, leading to the citizens losing faith in the system. ... Enormous IT investments require tremendous coordination ... Korean government is investing 1 trillion won in e-government projectsevery year. Thus, the country has earned a reputation for the IT powerhouse. Apart from undeniable advantages, the huge scale ... and the speed, the information technologies are implemented with, cause some problems to be tackled. The SAI Korea turns special atention to two of them: overlapping functionalities and interconnectivity issues.
Full description
Board of Audit and Inspection of Korea
, issued in 2011
Risk cases: 3
Cyber Attacks: Securing Agencies’ICT Systems
Cyber crime is an international problem, and it is estimated that in 2012, 5.4 million Australians fell victim to such crimes, with an estimated cost to the economy of $1.65 billion ... were considered serious enough to warrant a Cyber Security Operations Centre response. <br/> The protection of Australian Government systems and information from unauthorised access and use is a key ... posture of the selected agencies, based on their implementation of the four mandated mitigation strategies and IT general controls. In the government sector, the Australian Signals Directorate (ASD) has ... ... Cyber-security strategy needs consistent implementation and periodic reviews ... application, 3. patching operating systems, 4. minimising administrative privileges. Analysis by the ANAO helps to fill gaps and to direct next steps. ... List of 35 mitigation controls against cyber intrusions are a basic tool of information security strategy of the Australian Government. Top four are: 1. application whitelisting, 2. patching
Full description
Cyber crime is an international problem, and it is estimated that in 2012, 5.4 million Australians fell victim to such crimes, with an estimated cost to the economy of $1.65 billion ... were considered serious enough to warrant a Cyber Security Operations Centre response. <br/> The protection of Australian Government systems and information from unauthorised access and use is a key ... posture of the selected agencies, based on their implementation of the four mandated mitigation strategies and IT general controls. In the government sector, the Australian Signals Directorate (ASD) has ... ... Cyber-security strategy needs consistent implementation and periodic reviews ... application, 3. patching operating systems, 4. minimising administrative privileges. Analysis by the ANAO helps to fill gaps and to direct next steps. ... List of 35 mitigation controls against cyber intrusions are a basic tool of information security strategy of the Australian Government. Top four are: 1. application whitelisting, 2. patching
Full description
The Australian National Audit Office
, issued in 2014
Risk cases: 3