Kansas City Auditor's Office Makes Recommendations To Enhance Security Of The City's Network

From the City of Kansas City:

May 27, 2021

The City Auditor’s Office released an audit evaluating whether computer network accounts to the city’s information technology network are current. The Information Technology Division (ITD) is responsible for the security of most of the city’s network of computers and peripheral devices.

Why is network access and security important? Network accounts that are no longer needed but remain enabled are a security risk to the city. Access by unauthorized users could result in loss of data, disruption of city business, and disclosure of sensitive information.

Auditors concluded network accounts for some terminated employees have not been disabled. ITD reported these accounts were still enabled because they had not been notified by these employees’ departments. The audit also found that while many employee accounts are disabled soon after employees leave city employment, the process to disable the accounts, takes an average of 11 business days. City policy only notes that access changes or removals must be submitted timely rather than specifying a time frame for notification and disabling network access.

To enhance security of the city’s network, we made recommendations directed towards reducing the risk of terminated employee accounts being exploited for malicious purposes.

View the public report on our Recent Reports page. The audit is scheduled to be presented at the Council Business Session at 2 p.m. on Thursday, May 27, 2021.

Did you know you can submit audit ideas to the city auditor? This audit was inspired by suggestions made by the public.

This press release was produced by the City of Kansas City. The views expressed here are the author’s own.