Laserfiche WebLink
<br />Sample Government, FLORIDA <br /> <br />SCHEDULE OF FINDINGS AND RESPONSES <br /> <br />FISCAL YEAR ENDED SEPTEMBER 30, 2009 <br />(Continued) <br /> <br />I. CURRENT YEAR COMMENTS AND RECOMMENDATIONS (Continued) <br /> <br />Condition <br /> <br />The lockbox data, prior to being uploaded into TaxSys is stored in an unencrypted and unsecured network <br />file directory. This creates the potential for unauthorized changes to be made to the file. <br /> <br />Cause <br /> <br />The cause of the Issue IS the lack of encryption and/or security controls to prevent unauthorized <br />modifications. <br /> <br />Effect <br /> <br />The risk that the data uploaded into TaxSys is not complete or accurate. <br /> <br />Recommendation <br /> <br />We recommend that the Entity implement additional controls to ensure that the file cannot be modified <br />while stored on the network directory. <br /> <br />Views of Responsible Officials and Corrective Action <br /> <br />Records Taxes and Treasury (RTT) Division completes scheduled lockbox file transfers from the bank <br />each day. The lockbox files are transferred in encrypted format from the bank and stored on a division- <br />maintained server in both encrypted and decrypted formats. TaxSys end users browse to this location each <br />day to upload the files into the TaxSys application for posting. The share where these lockbox files reside <br />is only available to four individuals and three system administrators in RTT, and is not available through <br />the Active Directory network infrastructure. The four individuals are those involved with the lockbox <br />import process, or backup staff. <br /> <br />The TaxSys application does not have the capability to store and/or encrypt/decrypt files. RTT has <br />approached the vendor with requests to support encryption, but there is no capability to decrypt data as <br />part of the upload and posting process. In order to compensate for this issue, RTT management has <br />instituted procedures which require verification of data input and output by responsible individuals in <br />several sections within the agency. <br /> <br />Other Matters <br /> <br />2009-10 Self-Insurance Fund <br /> <br />Criteria <br /> <br />Internal service funds have a cost-reimbursement objective. A significant surplus or deficit in an internal <br />service fund could indicate that participating funds are not properly reporting the costs of the goods or <br /> <br />9 <br />