Angus Council”s corporate services convener, Mark Salmond, has defended its IT security after a report calling for tighter controls over computer access, passwords and data encryption.
The council has been advised to adopt robust measures against the risk of sensitive information falling into the wrong hands if council equipment is lost or inappropriately accessed.
Key failings included default passwords, administrator access to users and lack of encryption on equipment such as laptops.
Potential threats were highlighted in relation to a system used to exchange information such as child protection messaging and benefits information.
Officials have said steps will be taken to address the issues raised in the report, and yesterday Mr Salmond said he was happy that “rigorous controls” exist.
He said, “Our policy and practice is that no personal data is stored on mobile devices such as laptops or data sticks to eliminate the risk of data being accessed should any such device be lost or stolen.
“We operate a multi-layered security model, using the industry leading systems and it is fully security tested and verified by external specialists on a regular basis.
“The council has suffered no data losses, hacking breaches or significant virus outbreaks.”
He added, “Every year the IT security processes in all councils are reviewed by the UK Communication-Electronics Security Group to ensure compliance with the GSX Code of Connection, the national standard for information security controls.
“Angus Council has a very good record, always receiving accreditation-this year achieving full compliance in 82 of 86 controls in the latest more complex revision of the code.”
Mr Salmond said, “Every year new levels of protection are developed to counter new threats and every year Communication-Electronics Security Group make recommendations that help all councils improve IT security.
“The council, as the recent report highlights, is now acting on the four recommendations made this year and will be fully compliant within the September 2010 and February 2011 deadlines set by the group.”
Image used under Creative Commons licence courtesy of Flickr user john a ward.