THE CYBER SECURITY ENVIRONMENT IN LITHUANIA
were achieved, how public establishments ensure cyber security, and whether technical and organisational measures for cyber security are being applied properly. ... The purpose of the audit was to assess whether cyber security is being ensured in Lithuania. In view of this goal, we assessed whether: (1) an effective cyber security system has been set up; (2 ... ) cyber security is ensured in public establishments. During the audit, the SAI Lithuania analysed current regulation, strategic planning and management practices in the field of cyber security ... ... Cyber-security is much more than preventing incidents ... attention has been paid to development, legislation, improvement of organisational structure, etc. in this field. ... SAI Lithuania determined that the issue of ensuring and increasing cyber security and resilience has not been effectively addressed at the national level. The focus has primarily been on reacting ... to and preventing incidents in cyber space, which means that traditional issues related to electronic information security (confidentiality, integrity, accessibility) have been neglected, and from 2015, not enough
Full description

Activities of the state in implementing the e-health system - Do the state, doctors and patients benefit from ehealth?
. E-health solutions also save patients time. <br/> The purpose of the audit was to assess whether the objectives set to e-Health – higher quality of the health service and more efficient organisation ... Estonia’s population is aging and the share of elderly people is increasing, as fewer children are being born and people are living longer. This creates a constantly growing need for health ... and social services and patients are also becoming more and more demanding about the volume and quality of the services provided. The more extensive and systematic implementation of e-health solutions helps ... ... Why state, doctors and patients do not benefit from e-Health as much as they could? ... efficient organisation of health care. As SAI Estonia found out, wide range problems started from two basic points: lack of strategic manager and unrealisitc schedule. ... The report reviews whether the objectives set to the e-Health – ambitious multiyear program of Estonian Government - have been achieved. They are: higher quality of the health service and more
Full description

Management of Information Resources of the Ministry of the Interior
of the audit was to assess the management of information resources in the Ministry of the Interior. We assessed how the Ministry ensures planning and organisation, monitoring, assessment and coordination ... Many activities of the Ministry of the Interior require the use of information resources that are of great significance to the entire State, such as the state and departmental registers, and public ... information systems. Whereas the Ministry has failed to implement some of the public audit recommendations of 2007 and 2010,6 we analysed, whether there have been any positive changes in the field of IT ... ... Process maturity examination can help in IT audit ... Main risk areas in case of this audit were strategic and organisational - Ministry’s weak ownership of IT resources, insufficient audit and internal control function. SAI Lithuania auditors found ... also flaws in change management and security processes. But the finding, which gave them the key to the root cause of problems, was connected with maturity assessment of the auditee's IT processes.
Full description

State funds spent on development, operation and using of data centres services
organisational units of the state on buying hosting, server-housing and other related services. The audited period was between 2010 and 2014; where relevant, the preceding period was also scrutinised. Audited ... The aim of the audit was to scrutinise the management of funds spent on building and operating the national data centre (hereinafter “STC1 data centre”), including the expenditure of selected ... entities: Ministry of the Interior (“MoI”); Ministry of Finance (“MoF”); STÁTNÍ TISKÁRNA CENIN, state firm (state banknote printing firm, hereinafter “STC” or “the state firm”). The audit was conducted ... ... Risks steming from uncoordinated strategy ... SAI of Czech Republic analysed consequences of failures in strategic IT management at the state level. Lack of coordination and implementation rules reduced practical role of the ministry whose task ... was to guard high quality standards for all crucial IT systems in the state administration. Next consecquences were (among others) risk of uneconomical results of large IT investment and risk of inefficient ... supply of services, as well as opposite results of workforce reduction.
Full description

Report on the problems connected with the development and implementation of the digitally based Shared Medication Record
The purpose of the examination was to assess whether the department of the Danish Ministry of Health, the Danish National eHealth Authority (NHA) and the five regions that are responsible ... for the hospitals have made an adequate effort to develop and implement the Shared Medication Record (SMR). With the SMR, data on the citizens’ medication can be shared across hospitals, general practitioners, etc ... . and relevant health staff and the patients have direct digital access to updated medical data round the clock. The report answers the following questions: 1) Has the Ministry of Health and the NHA provided ... ... Involvement of key participants necessary from the very beginning ... and processes leading to implementation problems, governance not involving key players, and IT security organisation. ... Digitally based Shared Medication Record is basis of the complex healthcare system. Rigsrevisionen analysed unsolved issues related to unclear business case, insufficient analysis of work flows
Full description

VETERANS’ HEALTH CARE - Preliminary Observations on VHA’s Claims Processing Delays and Efforts to Improve the Timeliness of Payments to Community Providers
Due to increases in expenditures and utilization of VA care in the community services in recent years, VHA has had difficulty processing claims in a timely manner. In planning to consolidate its ... existing VA care in the community programs, as required by law, the agency said it will examine strategies for improving the timeliness and accuracy of its payments to community providers.<br ... /> This statement, which is based on ongoing work, summarizes GAO’s preliminary observations about (1) VHA’s, Medicare’s, and TRICARE’s claims processing timeliness in fiscal year 2015; (2) factors that have impeded ... Data processing hold back by technology limitation, workload and administrative burden ... be failing not only because of technology, but also because of work-process design, staff and organisation. ... US GAO analyzed all factors of slower processing and user unfriendliness that occur sometimes to the veterans healthcare. The main focus is data processing - and it has been proved that it can
Full description

Management and implementation of 1BestariNet
1BestariNet Service Project (1BestariNet) is an initiative undertaken by the Malaysian Ministry of Education (MOE) to replace and enhance ICT connectivity in schools. It is an enhancement ... to the SchoolNet service which terminated on 31 December 2010 with emphasis on end-to-end solutions (E2E) network services together with Virtual Learning Environment (VLE). Under this project, 10,000 primary ... and secondary public schools in Malaysia are equipped with high-speed 4G Internet access and a virtual learning platform, providing high-speed internet connectivity and access to a world-class Integrated Learning ... ... To answer big risks in IT systems development you need all levels of organisation ... Audit of 1BestariNet is presented by the Malaysian National Audit Department together with other IT projects reviewed. A result is this concise and instructive list of lessons learnt and failures ... to be avoided. To maximize performance and minimize vendor lock-in you need a lot of concerted effort by top and line management, as well as users ready to work with new tools.
Full description

Cyber Attacks: Securing Agencies’ICT Systems
of sensitive personal information. Unauthorised access through electronic means, also known as cyber intrusions, can result from the actions of outside individuals or organisations. Individuals operating from ... Cyber crime is an international problem, and it is estimated that in 2012, 5.4 million Australians fell victim to such crimes, with an estimated cost to the economy of $1.65 billion ... . In the government sector, the Australian Signals Directorate (ASD)3 has estimated that between January and December 2012, there were over 1790 security incidents against Australian Government agencies. Of these, 685 ... ... Cyber-security strategy needs consistent implementation and periodic reviews ... List of 35 mitigation controls against cyber intrusions are a basic tool of information security strategy of the Australian Government. Top four are: 1. application whitelisting, 2. patching ... application, 3. patching operating systems, 4. minimising administrative privileges. Analysis by the ANAO helps to fill gaps and to direct next steps.
Full description

Managing the risk of legacy ICT to public service delivery
The cross-government report describes the case studies from four public services (state pension, Value Added Tax collection, prescription payment and consumer credit licensing services) selected ... to illustrate the range of approaches that small and large government bodies are taking to address the issues arising from legacy ICT (defined as "systems and applications that have been operationally embedded ... within a business function but superseded by newer and more effective technologies or changed business needs"). ... Possible approaches to the problem of 'legacy ICT' ... UK’s government experience in managing the risks connected to legacy ICT provides valuable insight for others facing the same problem and are considering transforming their services.
Full description

Report to the Public AccountsCommittee on mitigation of cyber attacks
This report concerns the action taken by Danish government bodies to prevent cyber attacks. Behaving sensibly in cyberspace to avoid attacks is important, but should be supplemented by technical ... security controls that can increase security and mitigate cyber attacks. International studies have concluded that three central security controls can prevent the majority of the currently known types ... of attacks: - technical restriction of download of programmes; - limited use of local administrators; - systematic software updates. Rigsrevisionen has assessed whether the government bodies in the study ... Three basic security measures are often neglected ... Government agencies are open for cyber attacks because they often forget to respect three basic IT security measures. The three measures are: 1. technical restriction on programs downloading; 2 ... . limited use of local administrators rights; 3. systematic software updates.
Full description