Commonwealth of Virginia Single Audit Report for the Year Ended ...

details of these weaknesses to management in a separate document marked Freedom of Information
Act Exempt under Section 2.2-3705.2 of the Code of Virginia, due to their sensitivity and
description of the security system.
We recommend that ABC utilizes a compliance validation tool to determine an appropriate
baseline for the POS server configuration security settings. Additionally, we recommend that ABC
configure all of their remote store servers in accordance with Center for Internet Security best
practices and the Commonwealth’s Information Security Standard, SEC501-06.
Management Plan for Corrective Action for Alcoholic Beverage Control
ABC plans to address several outstanding issues as part of a current Center for
Internet Security (CIS) remediation project. All issues that will be addressed are
expected to be completed by March 1, 2012. For the remaining issues, ABC has
reviewed the server configuration and has legitimate business need for most of the
requirements that have not been met. For these, ABC will identify risks for the
business owners to accept, document mitigating controls, and file SEC501 exceptions.
The anticipated date for risk documentation and exception filing is March 30, 2012.
Responsible Party: Andrew Hallberg, Information Security Officer
Estimated Completion Date: March 30, 2012
11-12: Improve Database Security
Applicable to: Department of Motor Vehicles
Motor Vehicles does not use minimum database administrator account controls to adequately
detect or prevent possible malicious or unintentional modification or disclosure of sensitive data.
The Commonwealth’s information security standard, SEC 501, and the Center for Internet Security
(CIS) Oracle best practices recommend organizations to use certain account controls to minimize
risks to sensitive data. Since our recommendations include descriptions of security mechanisms,
which are exempt from public disclosure by the Code of Virginia, management received a separate
document containing a detailed description of our recommendation. The following is a public
summary of our findings.
Database administrator accounts are privileged accounts with direct access to the database
and that have rights to add, change, and delete data without restriction normally found in user
applications.
• DMV does not use automated controls to enforce database administrator account
compliance with password policies.
• DMV does not review specific escalated privileges given to database roles.
• DMV does not log and periodically review specific database administrator account
activity.
23