Subject:Announce on the Resubsidy of the Advice Technology Verse Operations coercion six (6) months ended March 31, 2015.
021463000Date:June 25, 2015
In continuity with the public Audit Cunning coercion the year, the Advice Technology (IT) Verse operations coercion six (6) months ended March 31st, 2015 were reconsiderationed on June 2nd to 13th, 2015 and the announce is hereby presented coercion your consequence.
The audit team middle of:
Samuel Obianke (MIA)-Team Lead
Yahaya Gobir (SOIA)-Member
Yusuf Kabir (SOIA)-Member
The audit extrinsic was to resubsidy the administration of the Commissions ICT adaptedty as courteous-mannered-mannered as lucent handling and log administration acts in assign.
As-well, the competency of Vulnerabilities and Patch administration habits were confirmed. Our motive is to confirm whether curbs to determine distant surety of Commissions ICT adaptedty, postulates completeness and availpower are in assign and are unimpeded chattelsually.
The audit areas understandd: Status of the Commissions ICT (Hardware & Software) Schedule, Onsite, Off-site and Oncontinuity Tailup acts as courteous-mannered-mannered as Lucent handling, Patch Administration, Pace Curb and Log Administration.
As-well, familiar in the resubsidy is the competency of inside curbs and submission with stquenched ICT cunning documents.
Observations / Findings
During the operations resubsidy of the IT verse, the afterciteds were famous:
A.Offsite and oncontinuity tailup administration
The Commission conceals Onsite, Off-site and oncontinuity postulates tail. A disk-to-disk-to-tape tailup manoeuvre is adopted. To determine postulates availability, postulates from disk are copied to tape coercion off-site storage on a eternally argue in continuity with the public tailup cunning. In conjunction, the Commission concealed oncontinuity tailup (Real-Interval Remote Tailup) of some of the postulates ascribable to their criticality to furnish coercion postulates redundancy.
The software (HP Storage Works Tailup Elucidation) exactd coercion tailing up postulates from Disk to Tapes was of-late upgraded to Rendering 8.1 from the cemer rendering 6.1 in a promystify to melioblame converge the postulates tailup shortcoming of the Commission.
In the mode of the reconsideration, it was famous as follows that:
No Tailup Tape was checked extinguished coercion the month of May 2015, argue attributed to the challenges resulting from the upgrade of the Tailup software interval the most late tailup tape at the off-site colonization during the resubsidy bound was that coercion the month of April 2015 which was seizen to the off-site colonization on May 05, 2015. As-well, of sympathy is the continued interval reversion betwixt Tailup Tape Checkextinguished and Sure storage at the Off-Site colonization. This habit may referable answer-coercion unmeasured postulates revival in the occurrence of perspicuousal lucent affecting the Commissions Postulates Centre (Server Ground). Below is a resume of tape move as was contained in the off-site tape move Proceedings. See Appendix I.
Tape Checkextinguished Limit to Offsite Colonization
Approximate IntervalBetwixt Tape Tailup and Sure Storage Offsite
Oct-14 3 November 2014 3
0Nov-14 1 December 2014 1
Dec-14 13 February 2015 44
Jan-15 13 February 2015 13
Feb-15 18 March 2015 18
Mar-15 7 April 2015 7
Table 1: Offsite Tape Checkextinguished Resume
Also, of sympathy is the habit of recycling the Weekly tailup tapes as famous in cemer reconsiderations in the Server Ground pending when the Monthly Unmeasured Tailup is completed anteriorly recolonization to the Off-site storage. Regarding the reality that referable total of the Commissions postulates is tailed up online, future the shortcoming to determine normal and judicious storage of tapes at the Off-site colonization.
It is pure of referablee that the tailup proceedings runningly life implemented does referable answer to admit with the disuniteiality postulates revival intervalframe inveteblame on the Business Impact Analysis coercion postulates revival (Misfortune Revival / Business Continuity Cunning – 2010). It at-last, answers that the tailup and tape checkextinguished proceedings in exact does referable seize into consequence, the RPO (Revival Subject-matter Extrinsic) of some of the postulates generated by the Commission;
Note: RPO is strong inveteblame on the cheerful postulates missing in circumstance of a hostility of operations. It indicates the earliest subject-matter in interval that is cheerful to save the postulates. The RPO chattelsually quantifies the legal sum of postulates missing in circumstance of discontinuance. – ISACA
Though, interval it was famous that the Disk-to-Disk tailup was chattelsually consummated, this at-last, may referable furnish distant surety from misfortune, future the shortcoming coercion daily and weekly tailups on disk to ideally be replicated to a second site;
The IT Verse did referable conceal any coercionm of documentation to empower the Audit team substantiate criterion results coercion Off-site tapes carried extinguished during the resubsidy bound. Future, the resubsidy team canreferable furnish arrogance of unmeasured postulates revival. Aggravate so, a portraiture of the tailup cunning is stagnant referable concealed Off-site;
A resubsidy of the tailup log generated by the running HP Storage Works Tailup Elucidation, Rendering 8.1, inspired some tailup shortcomings from Disk to Tape. In our view, indistant transmute administration curb in the upgrade manner may possess to a argueable bulk contributed to some of the challenges observed in tailup manner to tape. Though, attempt are ongoing by the IT Verse and the vendor, Messrs. Interglobal Limited to consolilimit the posteritys observed;
As-courteous famous was cognizance flexion in the experience of the HP Storage Works Tailup Elucidation. Distant cognizance of the software by the proceedings functionarys is compulsory, if the Commission is to trail the expected advantage from the Investment and aggravate total answer-coercion auspicious tailup to tape.
In resume, referable storing tailup tapes at the offsite colonization on a normal argue could mystify a waste, to auspicious revival in the occurrence that a postulates revival is required. As-well, shortcoming to criterion tailup tapes does referable furnish coercion postulates arrogance.
The Inside Audit verse recommends that:
The IT Verse should determine judicious and normal checkextinguished of tailup tapes to the Off-site storage in continuity with public cunning. As-well, normal criterioning of Off-site tapes should be carried extinguished and results from criterioning distantly documented coercion chronicles aim;
The IT Verse should consummate a SLA with the vendor. As-well, luxuriance shortcomings coercion proceedingsd functionarys is identical recommended coercion optimum advantages of the elucidation to the Commission;
The IT Verse should conceal a portraiture of the public and updated ICT polices at the offsite colonization coercion sure livelihood.
B.ICT HARDWARE AND SOFTWARE Schedule MANAGEMENT
The IT Verse conceals ICT schedule of twain unyieldingware equipment as courteous-mannered-mannered as software contacts coercion the HQ and the Zones. Interval the running attempt by the IT Verse to conceal an up-to-limit schedule was very-much meritorious, other inferior posteritys famous that shortcominged to be addressed understand:
The resubsidy of the software schedule inspired some stoppage in the uplimit of the schedule as famous in the cemer reconsideration. A circumstance in subject-matter is the Upgrade of the stquenched HP Storage Works Tailup Elucidation from 6.1 to 8.1, which is plaintually to be imageed Software Schedule. As-well, the LIRIS (Legal Advice Registry Internet Scheme) which attracts annual fee, payable to the vendor on a quarterly argue were referable uprightly documented. See Appendix II
The ICT Unyieldingware assigned to staffs and Network infrastructure were referable centrally concealed. Interval the ICT Unyieldingware schedule answers aggravate constructive, corresponding canreferable be said of the Network infrastructure schedule with missing requisite advice such as Year deployed and in some circumstances the Serial Estimate, specially coercion the adaptedty at the zonal stations. The team famous that distant documentation was referable carried extinguished at the interval of lapse / deployment;
Inveteblame on the assigned devices schedule resume made adapted, a total of 564 Desktops (inclusive of those assigned to staff and non-staff), 159 Laptops, 280 Printers and 473 UPS were deployed. See Appendix III. This is summarised in the graph below:
Figure 1: Assigned Devices Schedule Resume
The chronicles of the disused scheme furnishd, was referable constructive sufficient which made it somehow unamstrengthen to conciliate the postulates furnishd with the cemer schedule chronicles adapted;
It is pure of referablee, that ascribable to interval labor, the resubsidy team could referable carryextinguished tangible honesty of the ICT adaptedty, future canreferable confirm the exactness of the figures furnishd by the IT Verse.
The Inside Audit Verse recommends that the IT Verse should centralise the administration of total ICT adaptedty in the Commission interval as-well, ensuring judicious and normal uplimit of the ICT adaptedty schedule to determine availpower of up-to-limit schedule at total intervals.
C.TC (TELECOM) ROOMS
The TC Grounds accommodates Network and Communication equipment open opposite Floor1 to Floor 9 in the Commission architecture. The IT Verse seize guardianship of the guides to the TC ground which is paceed by third cunninge from interval to interval, future the shortcoming to determine distant shelter coercion the Network Unimpeded equipment housed in the TC ground.
In the mode of the reconsideration, it was famous that pace to the TC Ground is referable distantly curbled and warnered. Attempt to resubsidy tangible pace to the TC ground was referable feasible as no coercionm of proceedings was concealed coercion guide sign-in and sign-out, which in our view is a disuniteiality curb required curb that deemed to be in assign regarding the sentient essence of the equipment ammunitiond in the TC Ground coupled with fessence third cunninge pace to the TC Ground.
Also, other posteritys famous that shortcomings to be urgently addressed are as follows: (See Appendix .)
Temperature/ Essence-Conditioning Scheme: The essence-conditioning scheme in virtually total the nine (9) floors (twain in the Wing A and B) were either referable adapted or non-functional. On Floor 9-Wing A minority coercion stance, it was observed that the A/C disunite worked, except the lection on the essence indicator reads 32 mark Celsius (°C) which answers as-courteous eminent coercion optimum functioning of the equipment established;
Lightings: The lights in some of the TC grounds are referable working;
Cables: The cables were referable uprightly established in twain protrresuscitation and conduct. Some cables were seen to be trusting down from the ceilings and some were aggravate server racks. This is an demonstration of faulty cable administration which is preferable of creating livelihood headache;
Tidiness: Some of the TC grounds answer loose, with some equipment engulfed with clay, this in our view may above chattelsual operation of equipment;
Pace Curb Administration: There answers to be an inside curb shortcoming in the administration of the TC grounds. Interval it was observed the Floor 1-Wing A (Near the clinic) is the barely ground with the pace curb scheme, it is obligatory that the verse conceals a chronicles of who has pace to the grounds including interval and limit.
The Inside Audit verse recommends that:
A negotiative and sustained essence-conditioning scheme should be established URGENTLY. This is to determine that the recommended unimpeded essence is concealed in the TC ground coercion optimum operation of the equipment;
IT Verse should carryextinguished instant cable livelihood and labelling coercion quiet of livelihood and troubleshooting. As-well, non-functioning lighting scheme in total the TC ground should be restored;
A chronicles of guide move should be begin as courteous-mannered-mannered as other means to curb and warner pace to the TC ground be adopted to determine distant surety of the TC ground equipment;
Cleaning of the of the TC ground inferior suspend supervision by the IT Verse should be carried as at when required;
D.ICT paceories ammunition administration
In the mode of the resubsidy of the administration of the IT Pace Ammunition, it was famous as follows:
That the toner cartridges and other consumables were uprightly concealed in a arrest environment, the essence of the assign was at-last observed to be eminent and irrelevant. Print cartridges should referable be left in this predicament coercion a crave bound of interval plain if they are in their packaging to proccurrence damage;
The schedule of ICT paceories in the ammunition as life runningly regulated manually, making the total manner somehow cumbersome;
Also, it was famous from the supply weigh that arrangement to the ammunition did referable answer to image gentleman blame of consumptions of each consumable. Consequences that are eternally in eminenter claim (such as the HP CE410A sombre) ought to be furnishd in eminenter quantities as divergent to those in lesser claim.
An essence predicamenter should be established in the ammunition in prescribe to conceal the exact essence shortcominged to proccurrence toner inks from drying up and by consequenceion determine estimate coercion money late on the consequences;
An automated schedule curb scheme/ barcode scheme should be established to empower efficient counting of consequences, minimize waste of fallacy and to judicious watchful desk functionary on re-prescribe flatten (quantity) coercion consequences. This scheme conciliate determine chattelsual administration of these ICT paceories;
The staff with the warrant to initiate lapses should liaise with the Procurement verse to determine that lapses are odious to compulsory consequence.
F.Pace curb scheme
The Pace Curb Scheme in the Commission directly life integrated with a Biometric scheme to wrap as twain Staff Proceedings and Pace Curb Scheme in the Commission. It was famous that the deployment of the Biometric scheme as courteous-mannered-mannered as the integration with the stquenched Pace Curb Scheme is life finalised, the scheme is runningly life criterioned. The unmeasured advantage of the Pace Curb Scheme tarry extensively utilized ascribable to faulty established-forth of the pace curb doors as announceed in cemer reconsiderations.
Though, no local intervalframe was established coercion the ongoing criterioning, this is preferable of prolonging the design implementation craveer than compulsory. As-well, famous was withdrawal of documented Criterion cunning in assign.
Also, it was famous that the Shelter Disunite in impeach of warnering the CCTV was moved to the station of the EVC interval the installation of conjunctional CCTV cameras in the Commission has commenced with the donation of some of the equipment by the vendor.
The Inside Audit verse recommends that:
The IT Verse should determine distant documentation of the ongoing criterioning of the Biometric scheme interval providing apt resolutions of posteritys famous accordingly;
As established-forthd in the cemer reconsiderations, Administration may reflect the extinguishedexact reinstatement of total the pace doors in the Commission as it may referable be require chattelsual, to chattels aid repairs on the stquenched door;
G.incidenT handling and transmute administration
In continuity with best habits, power to regulate and explain lucents very-much consist on the lucent handling and transmute administration acts in assign in an restraintm.
In the mode of the resubsidy training it was observed as follows:
The IT Verse conceals a cognizance disingenuous to trail and explain computer cognate lucent. Interval this attempt is meritorious, there is shortcoming to determined-down in assign a aggravate constructive lucent handling ppolicies and acts in pace, to determine distant counterdisunite in the occurrence of a compromise;
Log are concealed except referable reconsiderationed. As-well, logs are referable centrally concealed interval the dissatisfresuscitation bounds are inveteblame on the adapted room, as such older logs are eternally deleted plain when they are referable reconsiderationed;
The IT Verse should determined-down in assign a progressive lucent handling act and mend on its running lucent escalation act;
The IT Verse should determined-down in assign a centralized log administration elucidation coercion adapted log administration.
G.tposterity contact shelter
A resubsidy of the tposterity hosting advantage reveals as follows that:
Tposterity Hosting SLA betwixt NCC and Liquid Tposterity is plaintually to be finalised as famous in the cemer resubsidy of the verses operation;
No inclusive as-welll endure to warner, unmask and proccurrence the Commissions tposterity contact from feasible onset, specially with the increasing estimate of tissuesite onsets and speck targeting extensive restraintm
The IT Verse should despatch resuscitation to finalise the ongoing SLA betwixt the Company and NCC
The IT Verse should determined-down in assign means to determine normal warnering of the Commissions tposterity contacts as courteous-mannered-mannered as ensuring that the platarrange in exact is eternally patched and as-well, determine arrest coding of total its contacts;
Vulnerpower impost and warnering of the Commissions tposterity contacts should be carried extinguished from interval to interval.
I.USER ACCESS ADMINISTRATION:
The Inside Audit Verse famous that disunite of the act in assign to regulate pace to the scheme do referable answer to aid representationability. Coercion stance:
The IT Verse concealed a shared representation coercion total SIWES in the Verse. In continuity with best habits, this is a sympathy as it is unamstrengthen to distantly trail specific SIWES energy on the scheme, regarding the reality that their advantage could totalow them to diversify scheme establishedting on exactrs computers in the mode posterity resolution;
Shared representation by SIWES in the verse extinguishedlive the collection representation of which he/she was a part, this exposes the waste of unacknowledged exactr gaining pace to the scheme. This is feasible due to the reality that the shared representation is referable mitigated each interval a part of the collection leaves the Commission;
User profile that are referable deleted or mitigated judicious could incrquiet the waste of unacknowledged pace to the scheme.
Users representation including that of the scheme representations LOCKOUT parameter are established to NEVER; the contortion of this is that brute-force ondetermined which is a trouble and fallacy rule exactd by contact programs to decode encrypted postulates such as passwords may be feasible;
We famous a stoppage in move of staff representation in the Active Directory (AD), who has past been moved to another verse. A circumstance in subject-matter is a staff who was moved to Commission Secretary from Legal and Regulatory Advantage.Recommendations:
The Inside Audit Verse recommends that IT Verse conceals a sepablame exactr profile coercion each SIWES exactr attached to the verse and that such representation should be removed on departure of the SIWES from the Commission;
A resubsidy of logs of each SIWES pace activities on the scheme should be carried extinguished from interval to interval by assigned staff of the verse;
That IT verse manipulate the folldue password parameters on the scheme of exactr and administrators:
Representation lockextinguished outfixed is to be established to three (3) attempts
Partiality Password Age (in days) coercion Administrators be established to Thirty (30) days.
J.Administration of Disused ICT As-wellls:
The Inside Audit Verse famous faulty handling of the disused ICT Schedule.
Disused schedule chronicless furnishd answers meagre. Chronicless made adapted does referable stop requisite advice such Lapsed Limit / Deployed Limit, Type, Description of Item, Limit Retrieved as courteous-mannered-mannered as argue coercion annihilation. This made is unamstrengthen to confirm if adapted acts were courteous-mannered-mannered followed as extinguishedlined in the public Cunning on the Disposal of Disused ICT As-wellls
The Team was informed that postulates in the movable incite were destroyed restraintmer to recolonization of the disused ICT as-wellls to a container in DBI, Mbora.
The Inside Audit Verse recommends that:
IT Verse should uplimit the disused schedule to understand meagre advice eminentlighted coercion quiet of reference;
IT Verse disclose adapted act inveteblame on the public cunning coercion the replacement and deletion of postulates in total storage resources restraintmer to disposal;
The Inside Audit verse should be duly informed restraintmer to damnation of the unyielding incite and recolonization of the disused items coercion arrogance aim.
This is submitted coercion your bark consequence and aid instructive, wrong.