Appendices - Department of Business - Northern Territory Government

appendicesAPPENDIX IIAudit Audit Outcome or Recommendation Summary ActionmyHR Web Application Security AssessmentAlthough the tests conducted in this assignmentdid not prove that information within myHR couldbe easily breached, a number of opportunitieswere identified to improve security controls over themyHR application:• production data used in development and testenvironments• information in myHR has not been classifiedaccording to government requirements• general security observations – special charactersare accepted in scripts• lack of myHR data encryption• excessive user logon attempts are possible via theweb (http) logon process• myHR server house-keeping is required.All required actions have been completed.It was noted that the security vulnerability andpenetration testing of myHR did not succeed inbreaching myHR controls:• system controls for training and test environmentsof PIPS and myHR implemented and scheduledfor review quarterly• no action is required –myHR is a user interfacefor the Nomad system (PIPS) and only displaysinformation that is part of this system. RecordsManagement Standards are applied to allpersonnel files• finding is incorrect as myHR does not allowprogram commands using special characters• myHR sits behind the WAN and is protectedby security protocols used for all governmentapplications. Consideration of suggestedencryption will be included in any modificationof myHR• third party password application is no longerrequired due to migration of myHR to a singleWindows 2003 server• myHR is fully hosted by Data Centre Servicesand subject to standard housekeeping forhosted servers.Department of Business and Employment Annual Report 2009–10185