Judiciary Judicial Information Systems

Transcription

1 Audit Report Judiciary Judicial Information Systems February 2005 OFFICE OF LEGISLATIVE AUDITS DEPARTMENT OF LEGISLATIVE SERVICES MARYLAND GENERAL ASSEMBLY

2 This report and any related follow-up correspondence are available to the public. Alternate formats may also be requested by contacting the Office of Legislative Audits as indicated at the bottom of the next page or through the Maryland Relay Service at Please address specific inquiries regarding this report to the Audit Manager listed on the inside back cover by telephone at (410) Electronic copies of our audit reports can be viewed or downloaded from the Internet via The Department of Legislative Services Office of the Executive Director, 90 State Circle, Annapolis, Maryland can also assist you in obtaining copies of our reports and related correspondence. The Department may be contacted by telephone at (410) or (301)

3 February 10, 2005 Delegate Charles E. Barkley, Co-Chair, Joint Audit Committee Senator Nathaniel J. McFadden, Co-Chair, Joint Audit Committee Members of Joint Audit Committee Annapolis, Maryland Ladies and Gentlemen: We have audited the Judicial Information Systems of the Judiciary. Our audit included an internal control review of the Systems data center and the network administered by Systems that supports the Judiciary and Courts of Maryland. Our audit disclosed that proper internal control had not been established over several significant areas. For example, the Systems internal network was not adequately protected from untrusted networks. Furthermore, the Systems lacked assurance that critical production data files and security and operating systems were adequately protected. Security event reporting for certain critical systems was incomplete and not reviewed by appropriate personnel. In addition, the Systems did not have a comprehensive information security program to ensure that adequate computer security existed and did not have a current and complete disaster recovery plan designed to minimize disruption of computer processing and network services in the event of a disaster. Respectfully submitted, Bruce A. Myers, CPA Legislative Auditor

4 2

5 Table of Contents Executive Summary 5 Background Information 7 Agency Responsibilities and Description 7 Current Status of Findings From Preceding Audit Report 8 Findings and Recommendations 9 Network Security and Control Finding 1 The Internal Computer Network Was Not Sufficiently 9 Secured From Untrusted Networks Finding 2 Maintenance and Administration of the Firewall 10 Was Not Adequate * Finding 3 The Communication Server Was Not Configured 10 to Protect the Internal Network Finding 4 Security Measures to Protect Critical Network Servers 11 Were Insufficient Data Center Information System Security and Control Finding 5 Access and Recordation Controls Over Critical 11 Data and System Files Were Inadequate * Finding 6 Necessary Controls Did Not Exist Over Critical 12 Segments of the Operating System Software * Finding 7 Security Event Reviews and Related Reporting Were 13 Not Adequate * Finding 8 Necessary Access Controls Did Not Exist Over Critical 14 Transactions, Programs and Data Files Involving Court Case, Warrant and Traffic Citation Data * Finding 9 Password Controls for the Uniform Court System 14 Were Not Adequate * Denotes item repeated in full or part from preceding audit report. 3

6 Information Technology Operations * Finding 10 A Comprehensive Information Systems Security Program 15 and a Sufficient Disaster Recovery Plan Did Not Exist * Finding 11 Program Change Controls Were Not Adequate 16 Audit Scope, Objectives, and Methodology 17 Agency Response Appendix * Denotes item repeated in full or part from preceding audit report. 4

7 Executive Summary Legislative Audit Report on Judicial Information Systems of the Judiciary February 2005 Proper security measures had not been established to protect the Systems internal network from untrusted third party networks including the Internet and the Systems did not adequately monitor the output of its intrusion detection system or update the system. The Systems should establish adequate controls over third party network connections and its intrusion detection system. The Systems communication server was vulnerable to unauthorized access and modification which could result in deletion of, or changes to, critical data files. Adequate password and account lockout provisions should be established for the communications server and authenticated users should be limited to tasks commensurate with their job responsibilities. Numerous employee user accounts could use four system-oriented accounts which allowed these users unnecessary and unrecorded modification access to data and system files. The Systems should discontinue use of these system-oriented accounts. Mainframe security controls could be bypassed because certain objects with special system privileges were not properly controlled and because supervisory personnel did not review and approve all modifications of key system files. Unnecessary object names with special privileges should be removed and modification access to critical privileged operating system files should be limited to individuals who require such access. Furthermore, Systems management should conduct and document reviews of all changes to critical operating system files. Access to key transactions, programs, and data files involving court cases, warrants, and traffic citations was not properly restricted; and related security reporting and reviews were not adequate. 5

8 Adequate access controls should be established over Systems transactions, programs, and data files and proper security event reporting and reviews should be performed. A comprehensive information security program and a current and complete disaster recovery plan did not exist. In addition, controls over changes to computer programs were not adequate. A comprehensive information security program and a current and complete disaster recovery plan should be developed. In addition, the Systems should establish procedures to ensure that only authorized and properly tested programs are placed into production. 6

9 Background Information Agency Responsibilities and Description The Judiciary operates the Judicial Information Systems on behalf of the State court systems. The Systems staff develops and maintains State court system applications, operates a statewide computer network, and is responsible for data center disaster recovery capabilities. Traffic case dispositions and court case data processed by the Systems are supplied to computer systems maintained by the Motor Vehicle Administration and the Department of Public Safety and Correctional Services, respectively. The Systems fiscal year 2004 operating budget totaled approximately $19.6 million. The Systems operates a mainframe computer for court applications (such as, district court case management) and two minicomputers that support the Maryland Automated Traffic System (Traffic Citations) and disbursement processing. In addition, there are nine minicomputers which support the Uniform Court System (UCS). The Systems serves three groups of users: public customers, Judicial Data Center personnel, and remote Court users. The Systems also operates a Wide Area Network (WAN) which connects users to the various component units of the Judiciary including the Administrative Office of the Courts, the District Courts, the Circuit Courts, and the Court Commissioners Offices. The WAN is used to connect the remote court locations to the UCS which provides court case management to 20 Circuit Courts and one District Court. The UCS supports case initiation, scheduling, disposition, expungement, and other record keeping. Systems staff connect across the WAN and maintain the regional UCS minicomputers and update the application software. Additionally, the WAN transmits communications from remote court offices to the Systems mainframe applications. Furthermore, 77 local area networks, across all remote court locations, can access the UCS and access external agencies through the Internet. Internet transmissions are controlled by the Systems central Internet firewall. Separately, the Systems also operates a server inside its network which supports public user dialup inquiries to court information from approximately 5,000 paying customers. 7

10 See below for a graphic depiction of the Systems and its components. Overview of the Systems Networking Environment The Systems operates a network that includes numerous servers, minicomputers, a mainframe computer, and connectivity to the Administrative Office of the Courts, the District Courts, the Circuit Courts, the Court Commissioners Offices, and the Internet Current Status of Findings From Preceding Audit Report We reviewed the current status of the ten findings included in our preceding audit report dated April 20, We determined that the Systems satisfactorily addressed two of these findings. The remaining eight findings are repeated in this report, two of which have been combined into one finding. In its response to our preceding audit report, the Systems generally agreed to implement the recommendations from that report. 8

11 Findings and Recommendations Network Security and Control Background Accepted security principles require organizations to ensure that the information they maintain is accessed by the appropriate persons and for authorized use only. To accomplish this, the Systems computer systems contain security software which is capable of restricting access to system, security and data files, online transactions, and programs. The related software can also provide a record of all file, transaction, and program modification accesses, and all unauthorized attempted accesses to the computer system. For example, individuals are allowed by the security systems to sign onto various computer processing applications to update critical data files. Unauthorized requests are denied access by the security software. Furthermore, the Systems computer network devices can be configured to provide network security for network users. Finding 1 The internal computer network was not sufficiently secured from untrusted networks and monitoring of network traffic was not adequate. Analysis Adequate security measures had not been established to protect the Systems internal network from untrusted third party contractor networks, State and local governmental networks, and the Internet. The connections from the Systems internal network to nine untrusted networks were not adequately secured, thereby exposing the internal network to security risks from these other networks. Furthermore, the Systems network firewall allowed various insecure Internet connections to portions of the Systems network, thereby potentially placing various network devices at risk. In addition, the firewall allowed internal network users complete and unfiltered outbound access to the Internet, which increased the risks of certain types of network attacks associated with returning data traffic. Additionally, the Systems did not effectively update or monitor the output of the intrusion detection system installed on its network. Intrusion detection systems gather and analyze network traffic to identify potential network security breaches and attacks and alert network administrators to these situations. 9

12 Recommendation 1 We recommend that adequate controls be established over third party network connections and intrusion detection systems. We made detailed recommendations to the Systems which, if implemented, should provide for adequate security over the third party connections and intrusion detection systems. Finding 2 Maintenance and administration of the Systems firewall was not adequate. Analysis The Systems firewall software was outdated, and therefore did not contain the most up-to-date security features. Accordingly, the firewall was vulnerable to security exploits that were addressed in the newer software releases. Also, remote connections, for administration of the firewall, could be attempted using insecure connection protocols from any workstation. As a result, administration of the firewall could be compromised resulting in unauthorized access into the Systems network. Recommendation 2 We recommend that the Systems, on an on-going basis, update the firewall operating system to the most current version available from the firewall vendor. We also recommend that the Systems limit connections to the firewall to network administrators using only secure connection protocols. Finding 3 The Systems communications server was not adequately configured to protect the internal network from unauthorized modification. Analysis The Systems communication server was not adequately configured to protect the internal network. Specifically, the Systems communication server had weak or non-existent password and account lockout provisions for server users. In addition, authenticated users to the server were not limited to performing only designated tasks as specified by Systems management. As a result, users on this server could attempt to exploit these weaknesses for the purposes of obtaining unauthorized access to internal network data. The communications server was used by over 1,200 internal personnel to connect to the Systems internal network including the Systems mainframe computer. Similar conditions were commented upon in our prior audit report. 10

13 Recommendation 3 We again recommend that the Systems establish adequate password and account lockout provisions for its communication server and limit authenticated users to tasks commensurate with their job requirements. Finding 4 Security measures to protect critical network servers were insufficient. Analysis Adequate security measures did not exist for two important network servers to protect those servers applications from external and internal exposures, such as from the Internet. We performed vulnerability scans of these two servers, and detected 19 instances of the top 10 most exploited computer network vulnerabilities as reported by a nationally recognized cooperative research and educational organization. For example, we noted that on both servers, the Systems was using an outdated version of the software that directs traffic to websites, which is vulnerable to attack. As a result of these network vulnerabilities, these servers were not adequately secured from exposures that could result in the loss of data integrity, the interruption of key services, and the improper use of these servers. Recommendation 4 We recommend that the Systems independently assess the reported risks to its critical computer network servers and implement appropriate security measures. In this regard, we made detailed recommendations to the Systems which, if implemented, should help provide adequate security over these servers. Data Center Information System Security and Control Finding 5 Access and recordation controls over critical data and system files were inadequate. Analysis Inadequate access and recordation controls existed for 4 system-oriented accounts that 36 Systems employee user accounts could use. The Systems used a feature of the security software which allows an individual user account to operate under the identity of another account (hereafter called an assumed account) to gain greater access privileges for system operations purposes. However, activity performed 11

14 under the four assumed accounts was not logged, leaving no accountability of processing performed by any individuals using the assumed accounts. Even with logging enabled, activities reported would only be identifiable to the level of the assumed account used and not to an individual employee account. Also, use of three of the assumed accounts bypassed the security software s controls which led to pervasive access control weaknesses involving the security system, the operating system, and the telecommunications and database software operated on the mainframe computer. Recommendation 5 We recommend that the Systems discontinue use of the assumed accounts on its system. Finding 6 Mainframe system security could be bypassed because necessary controls did not exist over critical segments of the operating system software. Analysis Controls over certain critical segments of the mainframe operating system software were inadequate, allowing normal security controls to be bypassed: All changes to critical operating system files made by system programmers were not subject to review and approval by supervisory personnel. Systems personnel advised us they reviewed changes to critical operating system files on a periodic basis. Such periodic reviews would not include all changes made to critical system files by system programmers. This condition could ultimately result in unauthorized or erroneous changes to mainframe data files (for example, court case records). A similar condition has been commented upon in several preceding audit reports. Access rules over numerous operating system files with special operating system privileges were inadequate. For example, improper modifications could be made to many of these files by numerous system users without detection by management. Various library names, system commands, and program names were defined to the system with special privileges capable of bypassing security controls, but the associated libraries, commands, and programs did not exist. As a result, libraries, commands or programs using these names could be created that would not be subject to normal security system controls. A similar condition was commented upon in our prior audit report. 12

15 Recommendation 6 We again recommend that the Systems management conduct and document reviews of all changes to critical operating system files. We also recommend that the Systems restrict modification access to critical, privileged operating system files to individuals who require such modification access, and that such modification accesses be recorded, reviewed, investigated, and documented as necessary. Finally, we again recommend that the Systems eliminate unnecessary library, command and program names that could be used to bypass normal security system controls. Finding 7 Security event reviews and related reporting were not adequate. Analysis Security event reporting on the mainframe computer system and a critical minicomputer system processing traffic citation information was incomplete and not reviewed by appropriate personnel: Security event activities for both the mainframe and minicomputer system were not reported for all 24 hours of each day. For example, security reports for the minicomputer system only included events for 8 hours of each day. As a result, security activity occurring during other hours, such as access violations and logged modification access, remained unreported. Furthermore, critical security system changes (for example involving userids and security data rules) were either not reported or they were reported and not reviewed. Accordingly, there was no assurance that the changes made to the security system were accurate and proper. Although the mainframe system security officer reviewed security reports, potential problems were not referred to knowledgeable personnel for investigation. Specifically, we were advised that supervisory personnel responsible for the Systems applications and operations did not review or investigate recorded security violations or logged accesses to critical files, utilities, libraries, and screens. A similar condition was noted in our three preceding audit reports. Recommendation 7 We recommend that security event reporting be configured to cover all time periods and that reports of critical changes to security system settings be generated and reviewed by security personnel independent of the security officers. We also again recommend that security event reports be reviewed 13

16 and investigated by supervisory personnel responsible for applications and operations. Finally, we again recommend that all security report reviews be documented and retained. Finding 8 Controls were not established to properly restrict access to critical transactions, programs, and data files involving court case, warrant, and traffic citation data. Analysis The Systems did not adequately control access to critical transactions, programs, and data files for separate applications involving court case, warrant, and traffic citation data. For example, 31 user accounts had been granted unnecessary and unlogged modification access to the District Court Warrant System. In addition, 40 user accounts had unnecessary access to the Uniform Court System s security files which allowed these users to change their security profiles and obtain modification access to production data. Furthermore, 131 user accounts had unnecessary modification access to critical Uniform Court System database records through a database utility program. The inadequate access controls over transactions, programs, and data files could allow court case, warrant, and traffic citation data to be improperly modified or deleted. A similar condition was commented upon in our prior audit report. Recommendation 8 We again recommend that adequate access controls be established over Systems transactions, programs, and data files. We made detailed recommendations to the Systems, which if implemented, should provide for adequate access controls over transactions, programs, and data files. Finding 9 Password controls for the Systems Uniform Court System computer system were inadequate. Analysis Password rules concerning length, usable periods, reuse, and allowed characters need to be strengthened on the Uniform Court System server. For example, minimum password length and password reuse limits were not adequate to 14

17 provide for effective security and control. Passwords serve to authenticate system users who are then connected under a user account and granted access according to security software settings. A similar condition was noted in our prior audit report. Recommendation 9 We again recommend that password controls be strengthened by increasing the minimum password length, restricting the reuse of prior passwords, establishing password lifetimes and requiring the use of multiple types of characters in each password. Information Technology Operations Finding 10 A comprehensive information systems security program and a current and complete disaster recovery plan did not exist. Analysis The Systems programs and plans did not adequately address critical issues involving information systems security and computer operations disaster recovery: The Systems did not have a comprehensive information security program to ensure that proper computer security existed. The Systems did not have a current and complete disaster recovery plan relating to the Systems headquarters or remote locations that operate the Uniform Court System. For example, the plan did not provide an alternate site and there were no provisions for restoration of network connectivity in the event of a significant disaster. In addition, the plan did not include a schedule of prioritized critical applications for recovery. A similar situation was noted in our prior audit report. Recommendation 10 We recommend that the Systems prepare an information systems security program to address all critical security issues involved with its information systems. We also again recommend that a complete disaster recovery plan be developed to support the current information systems environment, including designation of an alternate site, procedures for fully restoring network operations, and prioritization of applications in the event of a disaster. 15

18 Finding 11 Program change controls were not adequate. Analysis Adequate control procedures did not exist to ensure that only management authorized and properly tested computer programs have been placed into production. Specifically, computer programmers could modify programs and bypass the supervisory review process. In addition, there was no documentation supporting reviews of program changes by quality assurance personnel. Similar conditions were commented upon in our prior audit report. Finally, a comparison of programs actually moved to production to approved program changes was not performed. As a result, there was a lack of assurance that only management authorized and properly tested computer programs have been placed into production. Recommendation 11 We again recommend that the Systems establish procedures to ensure that only management authorized and properly tested computer programs are placed into production. 16

19 Audit Scope, Objectives, and Methodology We have audited the Judicial Information Systems operated by the Judiciary. Fieldwork associated with our review of the Systems was conducted during the period from October 2003 to April Additionally, fieldwork associated with our review of the network was conducted during the period from July 2004 to September The audit was conducted in accordance with generally accepted government auditing standards. As prescribed by the State Government Article, Section of the Annotated Code of Maryland, the objectives of this audit were to examine the Systems internal control over its data center and network and to evaluate its compliance with applicable State laws, rules, and regulations for the computer systems that support the State courts and related agencies of the Judiciary. The Systems fiscal operations are audited separately. The latest report which covered the Systems fiscal operations was issued on April 4, We also determined the current status of the findings contained in our preceding audit report on the Systems. In planning and conducting our audit, we focused on the major areas of operations based on assessments of materiality and risk. Our audit procedures included inquiries of appropriate personnel, inspection of documents and records, and observation of the Systems operations. We also tested transactions and performed other auditing procedures that we considered necessary to achieve our objectives. Data provided in this report for background or informational purposes were deemed reasonable, but were not independently verified. The Systems management is responsible for establishing and maintaining effective internal control. Internal control is a process designed to provide reasonable assurance that objectives pertaining to the reliability of financial records, effectiveness and efficiency of operations including safeguarding of assets, and compliance with applicable laws, rules, and regulations are achieved. Because of inherent limitations in internal control, errors or fraud may nevertheless occur and not be detected. Also, projections of any evaluation of internal control to future periods are subject to the risk that conditions may change or compliance with policies and procedures may deteriorate. 17

20 Our reports are designed to assist the Maryland General Assembly in exercising its legislative oversight function and to provide constructive recommendations for improving State operations. As a result, our reports generally do not address activities we reviewed that are functioning properly. This report includes conditions that we consider to be significant deficiencies in the design or operation of internal control that could adversely affect the Systems ability to maintain reliable financial records, operate effectively and efficiently and/or comply with applicable laws, rules, and regulations. Our audit did not disclose any significant instances of noncompliance with applicable laws, rules, or regulations. Other less significant findings were communicated to the Systems that did not warrant inclusion in this report. The Judiciary s response, on behalf of the Systems, to our findings and recommendations, is included as an appendix to this report. As prescribed in the State Government Article, Section of the Annotated Code of Maryland, we will advise the Judiciary regarding the results of our review of its response. 18

21

22 In addition, JIS recently implemented an access control list on outbound Internet traffic from the Judiciary network that prevents the establishment of TCP and UDP connections to port numbers beyond the well-known range. Finding 2: We concur with this recommendation. JIS is presently configuring and testing the most current version of a higher end firewall from our current vendor to replace the current firewall. In addition to controlling access to and from the Internet the new Firewall will be used to control Virtual Private Network (VPN) access from the Internet to the Judiciary s network. It is estimated that this effort will take from three to six months to complete. In the interim, remote access to the firewall from the internal network will be further restricted as recommended. The nine external network connections in question will be consolidated into two, each of which will be controlled by a Cisco PIX Firewall with appropriate access control lists and logging enabled. One connection will be located in Room 405 of the Mitchell Courthouse. The other will be to the Statewide Government Intranet (SwGI), currently planned for Pod A of the DNR building in Annapolis. Both connections will likely take a minimum of from six months to a year to complete. The SwGI connection is in the early phases of being established and will require the Office of the Public Defender, and the Departments of Public Safety, Human Resources, Juvenile Justice, and Transportation to make similar changes on their ends of these connections. An additional benefit of the SwGI connection will be the elimination of four leased Frame Relay connections. Finding 3: We concur with this recommendation and have identified the 1,200 users noted in the analysis. To date we have eliminated all but sixty (60) user acids that are still under review for justified access. A final determination on these sixty individuals will be completed by February Finding 4: We concur with this recommendation. The primary points in this recommendation were: 1) that we replace our current Web Server software with something newer and therefore presumably more secure, and 2) that some access ports currently open to the web and elicense servers be eliminated. Replacing the Web Server software will occur in conjunction with the Application Server work that is currently underway. The unused access ports will be eliminated as part of the firewall upgrade. Page 2

23 Data Center Information System Security and Control Finding 5: We concur with this recommendation and have put procedures in place for oversight, review, approval and retention of all system access. Specifically, the analysis addresses the issue of jobs being submitted through the use of an assumed account and the system not recording who took the action. JIS has developed and implemented an audit feature for use of the assumed account to identify individual acids for job submissions by requiring individuals to log into the assumed account by their acid logon. Individuals logged onto our job scheduling software are already tracked by their respective acid if a job re-run needs to be submitted a second time. Additionally, we are currently testing program-pathing. Program-pathing will restrict those employees granted access to the acid assumed account to only be able to submit jobs on its behalf through the job scheduling software product. If successful in our testing, this will eliminate the auditors fear of job submissions performed outside of job scheduling software. This testing will be completed by the end of February. Finding 6: We concur in part with this recommendation and have initiated the following actions: All system changes will be recorded using our logging program for review, validation, approval, and retained for future audits. Access to all systems files has been restricted to Tech Support personnel only. JIS is currently in the process of deleting rules for products and data sets not currently in use. After the deletion of these rules, JIS will proceed with a review of the update access rules to all datasets defined with security privileges. Our third step will be to address the transactions and their access privileges making whatever changes are necessary. These steps will be completed by end of March. Overall, we will be addressing the rules definitions within a system product review. This review will begin as a template for software products as they are installed or as vendor software release upgrades are provided. It will also include a review process during the first software maintenance update for completeness. The templates will specifically address the security points of concern and corrective actions will be taken to resolve any discrepancies. Regarding the recommendation to remove unnecessary system files, it is JIS s technical viewpoint that removing vendor system files without the knowledge and consent of the Vendor Operating System software manufacturers is a greater risk to the Judiciary. Doing so might well jeopardize our Vendor support for the Operating system itself. Page 3

24 Finding 7: We concur with both points noted in the analysis and have taken the following corrective actions: All security events logging is done on a 24-hour basis each day with all changes recorded on the respective system s log. These logs and security violation reports will be reviewed, approved and retained for future audits by the Data Center Senior Manager on a regular schedule. Finding 8: We concur with this recommendation and JIS has initiated the following: A procedure has been implemented to allow JIS to review user acids with update access by identifying their logon prefix. In addition, programs are being rewritten to look at the users logon versus their terminal id to determine their level of access. Those not meeting the established criteria for update access will be denied access to make changes. This last change will be in place by March 31, Finding 9: JIS has responded with improvements to password controls as a result of the prior audit but the UCS platform s logon process is relatively complex and limiting. JIS has been investigating the possibility of having the operating system logon pass-through to the UCS application logon using the parameters noted in the recommendation. The amount of program changes, however, on both the operating system and UCS side, still need to be determined before we can comply fully with the recommendation. In addition to the changes noted here, JIS will be required to setup a training curriculum for the end users for this logon change if it is accepted. A decision on the feasibility of complying with the recommendation will be completed by the end of February. Finding 10: We concur with both points of the recommendation and the following project plans have been put into place to address these issues. 1) A system security program, based on the State s Security Standards and Procedures and COBIT, will be documented and completed by February ) The Judiciary is actively seeking a Hot Site and is in the process of updating its disaster recovery plan. Page 4

25

26 AUDIT TEAM Stephen P. Jersey, CPA, CISA Information Systems Audit Manager Richard L. Carter, CISA R. Brendan Coffey, CPA Albert E. Schmidt, CPA Information Systems Senior Auditors Amanda L. Trythall Staff Auditor