{ "document_id": 15062, "page": 83, "width_pt": 612, "height_pt": 792, "rotation": 0, "pipeline_version": "paddleocr-vl-1.6+paul-48", "engine": "paddleocr_vl", "source_run_id": 15174, "item_count": 14, "counts_by_type": { "caption": 1, "footnote": 1, "header": 2, "heading": 3, "table": 1, "table_cell": 2, "text": 4 }, "build_ms": 3, "items": [ { "id": "p83.1", "order": 1, "type": "header", "bbox": { "l": 482.4, "t": 741.36, "r": 518.88, "b": 727.68 }, "text": "Page", "attrs": { "block_label": "header" }, "level": 2 }, { "id": "p83.2", "order": 2, "type": "header", "bbox": { "l": 526.56, "t": 740.64, "r": 540.96, "b": 728.64 }, "text": "77", "attrs": { "block_label": "number" }, "level": 2 }, { "id": "p83.3", "order": 3, "type": "heading", "bbox": { "l": 69.6, "t": 712.08, "r": 289.44, "b": 696.96 }, "text": "CHAPTER 4: Information Technology", "attrs": { "block_label": "paragraph_title" }, "level": 3 }, { "id": "p83.4", "order": 4, "type": "text", "bbox": { "l": 68.4, "t": 683.52, "r": 541.92, "b": 613.68 }, "text": "Examination findings in this chapter discuss matters involving logical security controls, which are controls that restrict a user's access to information technology systems to prevent unauthorized access. Findings in this chapter identify inappropriate system configurations and naming conventions. In addition, the Findings identify a lack of system access controls, user monitoring, and separation of duties." }, { "id": "p83.5", "order": 5, "type": "heading", "bbox": { "l": 68.88, "t": 600.48, "r": 541.68, "b": 571.2 }, "text": "Finding 17: KSU Did Not Implement Adequate Access Controls Over Its Accounting and Payroll Systems.", "attrs": { "block_label": "paragraph_title" }, "level": 3 }, { "id": "p83.6", "order": 6, "type": "text", "bbox": { "l": 68.16, "t": 557.28, "r": 543.36, "b": 444.96 }, "text": "KSU did not implement adequate controls over user access to the Banner accounting system and Automatic Data Processing (ADP) payroll system. The various security policies KSU has in place do not explain the processes required to grant, change, or delete access to Banner and ADP. Also, the security audit procedures, dated November 2017, do not reflect current procedures used by staff to monitor access to KSU systems. Rather, data owners (individuals responsible for a module) are made aware of the current audit procedures and schedules via email or during manager meetings. By not properly implementing adequate access controls, KSU is at risk for allowing inappropriate access to University resources." }, { "id": "p83.7", "order": 7, "type": "heading", "bbox": { "l": 69.36, "t": 432.96, "r": 153.84, "b": 420 }, "text": "Security Audits", "attrs": { "block_label": "paragraph_title" }, "level": 3 }, { "id": "p83.8", "order": 8, "type": "text", "bbox": { "l": 68.4, "t": 419.04, "r": 543.36, "b": 334.8 }, "text": "According to KSU’s Data Classification Policy, data owners must actively monitor and review their systems and procedures for potential misuse and/or unauthorized access. KSU’s Information Technology (IT) staff indicated that Banner and ADP audits are conducted quarterly. As part of the security audit, the Banner module managers are to ensure users have appropriate access to modules. If inappropriate or unnecessary access is identified during these reviews, changes are submitted to IT for processing. As reflected in Figure 16, Banner is made up of eight modules:" }, { "id": "p83.9", "order": 9, "type": "caption", "bbox": { "l": 189.36, "t": 322.32, "r": 423.12, "b": 309.36 }, "text": "Figure 16: Banner Modules and Descriptions", "attrs": { "block_label": "figure_title" } }, { "id": "p83.10", "order": 10, "type": "table", "bbox": { "l": 175.68, "t": 309.36, "r": 434.16, "b": 139.2 }, "text": "", "attrs": { "block_label": "table", "n_rows": 1, "n_cols": 2, "integrity": { "cells_checked": 2, "cells_flagged": 0 } }, "children": [ { "id": "p83.10.1", "order": 11, "type": "table_cell", "bbox": { "l": 178.9057, "t": 296.859346, "r": 224.43489, "b": 139.78179899999998 }, "text": "MODULE\nF\nG\nH\nN\nP\nR\nS\nT", "attrs": { "row": 0, "col": 0, "rowspan": 1, "colspan": 1, "bbox_refit": true, "merged_continuation": true } }, { "id": "p83.10.2", "order": 12, "type": "table_cell", "bbox": { "l": 247.512025, "t": 296.859346, "r": 364.891016, "b": 139.78179899999998 }, "text": "DESCRIPTION\nFINANCE\\nFINANCE - PURCHASING\nGENERAL\nHR\nPOSITION CONTROL\nPAYROLL/PERSONNEL\nFINANCIAL AID\nSTUDENT\\nSTUDENT - ADMISSIONS\nACCOUNTS RECEIVABLE", "attrs": { "row": 0, "col": 1, "rowspan": 1, "colspan": 1, "bbox_refit": true, "merged_continuation": true } } ] }, { "id": "p83.11", "order": 13, "type": "text", "bbox": { "l": 68.64, "t": 113.76, "r": 541.92, "b": 70.8 }, "text": "Review of Banner audit reports and change documentation provided for FY 2019 through FY 2021 identify that all eight modules were not consistently reviewed by KSU. Figure 17 identifies the modules that were reviewed by KSU during the period." }, { "id": "p83.12", "order": 14, "type": "footnote", "bbox": { "l": 178.8, "t": 136.8, "r": 431.76, "b": 125.04 }, "text": "Source: APA, based on email communication from KSU CIO.", "attrs": { "block_label": "vision_footnote" } } ], "excluded_furniture": { "first": [], "last": [] } }