Type your search and hit enter
WA agencies reproached for weak cloud management

WA agencies reproached for weak cloud management

Five state agencies failed to assess business risks of moving to cloud

The Western Australia government’s flight to the cloud has encountered turbulence at five separate agencies.

In an Information Systems Audit Report released today, the WA Office of the Auditor General gave failing marks on cloud to Department of Fisheries, Department of Sport and Recreation, Metropolitan Redevelopment Authority, Public Sector Commission and Public Transport Authority.

“None of the five agencies could demonstrate effective management across all of the key areas relating to their implementation of a cloud based service with a consequent risk to the confidentiality, integrity and availability of information,” the audit found.

“Common weaknesses included not assessing business risks and costs and benefits of shifting to the cloud, inadequate contractual arrangements, and weaknesses in the IT security and business continuity arrangements.”

One example cited was the agencies failing to specify in contracts that data was not to be stored offshore even though that’s what they wanted, the audit said. The audit found that one agency’s back-up data was in fact stored offshore.

There were also no contractual requirements related to data security controls, service continuity or performance reports, according to the audit.

The Department of Finance and State Records Office is now producing additional guidance about offshore storage and other cloud issues, it said.

Of the five agencies, four did not effectively manage risks associated with cloud, the audit found.

“In particular, these risks related to information security and sovereignty, system performance, unauthorised access, legal and regulatory compliance and loss of access to the system, service or information. If these risks are not managed properly, they could have a significant impact on an agency’s key objectives and operations and result in the loss or disclosure of information.”

Only two agencies had written a business case to support their decision to the move to the cloud, the audit found.

Three of the agencies suffered from a range of information security weaknesses, including known software vulnerabilities that had not been fixed or updated and a lack of encryption for sensitive information on backup tapes.

All five WA agencies acknowledged problems and pledged to resolve the issues.

Adam Bender covers telco and enterprise tech issues for Computerworld and is the author of dystopian sci-fi novels We, The Watched and Divided We Fall. Follow him on Twitter: @WatchAdam

Follow Computerworld Australia on Twitter: @ComputerworldAU, or take part in the Computerworld conversation on LinkedIn: Computerworld Australia

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags auditWestern AustraliaWA

More about Office of the Auditor GeneralOffice of the Auditor GeneralPublic Transport Authority

Show Comments