full-disclosure - Council financial data at risk from internet hackers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1348645302.42044.YahooMailNeo@web171205.mail.ir2.yahoo.com>
Date: Wed, 26 Sep 2012 08:41:42 +0100 (BST)
From: Bit WAshor <b1t.wash0r@...il.com>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Council financial data at risk from internet
	hackers

SENSITIVE 
financial data could be at risk after it was revealed that a council’s 
IT network could be open to outside attacks following an audit of its 
systems.
The detailed look into IT systems at South Derbyshire District Council has 
highlighted several issues which could see the authority left open to 
external attack.
The problem arose as a result of an interim audit report, undertaken by Grant Thornton, which highlighted key risk areas.
Specialist vulnerability testing discovered a ‘number of issues which needed to be addressed’ in order to protect council computer systems 
and sensitive data.
After the problem was highlighted in November 2011, the council set up an action plan.
However, despite making progress, some problems such as weak or blank passwords on servers and issues with domain administrator credentials 
remain.
The report stated: “We acknowledge that the council is working with suppliers to resolve some of the issues.
“Without full resolution of issues raised in relation to external 
vulnerability testing, management cannot be assured that the council’s 
IT network and systems are secure from attacks.
“A successful attack could interrupt net- works services and be used to access sensitive financial data.”
The council stated: “The remaining issues are more complex to resolve and the resolutions could have implications for the relevant business 
process.” The authority revealed that the password problem was being 
addressed but changes could impact the working of software.
A deadline of November has been set for the resolution of the 
problems, which were deemed a medium priority, meaning ‘action is 
required to address a significant deficiency’.
The recommendations will be discussed at a meeting of the council’s 
audit sub committee at the Civic Offices, in Civic Way, Swadlincote, on 
September 26.
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/