IT Security

Table of Contents

• Executive Summary
  • Introduction
  • The Canadian Institutes of Health Research (CIHR)
  • IT Security
  • Risks Addressed by the Audit
  • Audit Objective
  • Scope
  • Criteria
  • Overall Audit Opinion
  • Statement of Assurance
  • Summary of Internal Control Strengths
  • Summary of Internal Control Weaknesses
• Detailed Report
  • Methodology and Criteria
  • Observations, Recommendations, and Management Action Plan

Executive Summary

Introduction

The Internal Audit of IT Security is part of the Risk-Based Annual Internal Audit Plan 2010-11 approved by the Canadian Institutes of Health Research (CIHR) Governing Council (GC).

The Canadian Institutes of Health Research (CIHR)

The Canadian Institutes of Health Research (CIHR) is the Government of Canada's agency responsible for funding health research in Canada. CIHR was created in 2000 under the authority of the CIHR Act and reports to Parliament through the Minister of Health. CIHR's mandate is to "excel, according to internationally accepted standards of scientific excellence, in the creation of new knowledge and its translation into improved health for Canadians, more effective health services and products and a strengthened Canadian health-care system." CIHR comprises 13 "virtual" institutes - each headed by a Scientific Director, who is assisted by an Institute Advisory Board - which bring together all partners in the research process - the people who fund research, those who carry it out, and those who use its results - to share ideas and focus on what Canadians need: good health and the means to prevent and fight disease. Each Institute supports a broad spectrum of research in its topic areas and, in consultation with its stakeholders, sets priorities for research in those areas. CIHR funds nearly 13,000 researchers and trainees in universities, teaching hospitals, and other health organizations and research centres in Canada.

IT Security

The government policy on security and Information Technology (IT) security operational standard require that departments and agencies protect information throughout its life cycle. IT security is the safeguards that preserve the confidentiality, integrity, and availability of electronically stored, processed, and transmitted information.

The observations made in these reports informed the planning of this audit; as of this report date, management has stated that all issues included in these reports have been resolved. The Director, Financial Operations and Monitoring undertook the Internal Control Framework Project which reported several findings relevant to IT security. These issues were included as part of the scope of this audit.

Risks Addressed by the Audit

The audit addresses whether the IT security framework adequately preserves the confidentiality, integrity, and availability, of electronically stored, processed, and transmitted information at CIHR. This risk is related to the TBS Management Accountability Framework (MAF) elements of Stewardship – "The departmental control regime (assets, money, people, services, etc.) is integrated and effective, and its underlying principles are clear to all staff" – and Risk Management – "The executive team clearly defines the corporate context and practices for managing organizational and strategic risks proactively."

Audit Objective

The objective of the audit is to provide reasonable assurance that the safeguards that preserve the confidentiality, integrity, and availability of electronically stored, processed, and transmitted information at CIHR are adequate and effective.

Scope

The audit covered the organization and administration of IT security and IT-related aspects of personnel, physical, hardware, software, communications and operations security.

Criteria

The criteria used for assessing the audit objective are derived from the Treasury Board (TB) Policy on Government Security, Policy on the Management of Information Technology, Directive on the Management of Information Technology, Operational Security Standard on Physical Security, Operational Security Standard on Business Continuity Planning Program, Operational Security Standard: Management of Information Technology Security (MITS), Security Organization and Administration Standard, Information Technology Security Audit Guide; Information Systems Audit and Control Association/IT Governance Institute's (ISACA/ITGI) Control Objectives for Information and related Technology (COBIT®); RCMP guide on Physical Protection of Computer Servers; and Communications Security Establishment (CSE) guides on Baseline Security Requirements for Network Security Zones in the Government of Canada [ PDF (2.01 MB) - external link ] and Clearing And Declassifying Electronic Data Storage Devices [ PDF (1.44 MB) - external link ].

Overall Audit Opinion

The audit has concluded that IT Security at CIHR has moderate issues in that some control weaknesses were identified, but exposure is limited because either the likelihood or the impact of the risk is not high and because management has recognized the weaknesses and initiated mitigating actions.

Statement of Assurance

The audit of the IT Security was conducted in accordance with the Federal Government Policy on Internal Audit and related professional standards. In my professional judgement as Chief Audit Executive, sufficient and appropriate audit procedures have been performed and evidence gathered to support the accuracy of the opinion provided in this report. The audit opinion is based on a comparison of conditions that existed at the time of the audit against established audit criteria that were agreed upon with management.

Summary of Internal Control Strengths

The following key elements of IT Security have been implemented:

• an IT security coordinator (ITSC) responsible for managing a department-wide IT security program with defined accountabilities, activities and responsibilities has been appointed and serves as CIHR's principle IT security contact;
• policies, procedures and/or practices exist governing IT security, security clearance approvals, distribution of IT resources, incident management, system development and modification, system standard builds, and the patching of Windows software;
• many vital IT systems [redacted for security reasons] have undergone a threat and risk assessment and these assessments classify the information and system that allow the identification of proper handling and security clearance requirements;
• a business continuity plan developed by the Business Continuity Planning Coordinator in conjunction with the ITSC has been approved;
• basic IT security training is provided at employee orientation;
• a centralized Helpdesk facility that formally tracks and manages IT issues and incidents exists and its activities are integrated with network administration personnel;
• personnel responsible for managing cryptographic materiel and security equipment have been appropriately trained;
• [redacted for security reasons];
• IT security assets are segregated from public access; and
• the IT security management process incorporates risk information from central agencies.

Summary of Internal Control Weaknesses

The following elements of IT Security have not been implemented:

• IT systems are not recertified in the face of a changing IT environment;
• [redacted for security reasons];
• recommendations made in security assessment documents lack formal follow-up;
• [redacted for security reasons];
• [redacted for security reasons];
• [redacted for security reasons];
• the business continuity plan has not been tested;
• the ITSC is not formally involved in the contracting process for IT-related items; and
• current practices regarding Blackberries are not in line with the relevant internal standard.

Internal Audit thanks management and staff for their excellent cooperation during this audit.

Martin Rubenstein

Chief Audit Executive
Canadian Institutes of Health Research

Management agrees with the conclusions of this audit.

Evie Gray
Chief Information Officer

Detailed Report

Methodology and Criteria

The assessment of IT Security at CIHR was performed through interviews with management and staff; review of documentation; and analysis of controls against audit criteria. Controls were deemed adequate if they were sufficient to minimize the risks that threatened the achievement of objectives.

The audit criteria used for assessing the audit objective are derived from the Treasury Board (TB) Policy on Government Security, Policy on the Management of Information Technology, Directive on the Management of Information Technology, Operational Security Standard on Physical Security, Operational Security Standard on Business Continuity Planning Program, Operational Security Standard: Management of Information Technology Security (MITS), Security Organization and Administration Standard, Information Technology Security Audit Guide; Information Systems Audit and Control Association/IT Governance Institute's (ISACA/ITGI) Control Objectives for Information and related Technology (COBIT®); RCMP guide on Physical Protection of Computer Servers; and Communications Security Establishment (CSE) guides on Baseline Security Requirements for Network Security Zones in the Government of Canada [ PDF (2.01 MB) - external link ] and Clearing And Declassifying Electronic Data Storage Devices [ PDF (1.44 MB) - external link ].

The audit was conducted between August 2010 and May 2011.

Observations, Recommendations, and Management Action Plan

The following are audit observations, recommendations, and management action plan to address weaknesses in the IT Security at CIHR.

Date modified:

2012-06-21