{ "document_id": 15062, "page": 85, "width_pt": 612, "height_pt": 792, "rotation": 0, "pipeline_version": "paddleocr-vl-1.6+paul-48", "engine": "paddleocr_vl", "source_run_id": 15174, "item_count": 20, "counts_by_type": { "form_field": 1, "header": 2, "heading": 1, "list": 2, "list_item": 7, "text": 7 }, "build_ms": 2, "items": [ { "id": "p85.1", "order": 1, "type": "header", "bbox": { "l": 482.16, "t": 741.12, "r": 518.88, "b": 727.92 }, "text": "Page", "attrs": { "block_label": "header" }, "level": 2 }, { "id": "p85.2", "order": 2, "type": "header", "bbox": { "l": 527.04, "t": 740.64, "r": 540.72, "b": 728.88 }, "text": "79", "attrs": { "block_label": "number" }, "level": 2 }, { "id": "p85.3", "order": 3, "type": "text", "bbox": { "l": 104.88, "t": 712.32, "r": 541.92, "b": 685.44 }, "text": "only the duration of time needed. Once that specific audit or review is finished, the access should be terminated." }, { "id": "p85.4", "order": 4, "type": "list", "bbox": { "l": 86.64, "t": 685.62, "r": 541.92, "b": 613.68 }, "text": "", "attrs": { "item_count": 2 }, "children": [ { "id": "p85.4.1", "order": 5, "type": "list_item", "bbox": { "l": 86.64, "t": 685.62, "r": 541.92, "b": 642.72 }, "text": "One user class associated with training was assigned to two staff. However, KSU acknowledged that this user class was no longer needed, indicating that unnecessary access existed and would be removed." }, { "id": "p85.4.2", "order": 6, "type": "list_item", "bbox": { "l": 86.64, "t": 643.26, "r": 541.92, "b": 613.68 }, "text": "There was also a duplicate account identified. KSU's IT staff confirmed that one of the duplicate accounts was removed on October 19, 2022." } ] }, { "id": "p85.5", "order": 7, "type": "heading", "bbox": { "l": 69.84, "t": 600, "r": 209.76, "b": 587.52 }, "text": "User access authorizations", "attrs": { "block_label": "paragraph_title" }, "level": 3 }, { "id": "p85.6", "order": 8, "type": "text", "bbox": { "l": 68.16, "t": 585.84, "r": 542.16, "b": 474.72 }, "text": "Testing was conducted to determine whether appropriate documentation and authorization was maintained to support access to Banner. Out of 73 users that were granted access to Banner between FY 2019 and FY 2021, 7 were selected for review, representing 9.6 percent of the population. The employees selected for review were: (1) Dean of Student Leadership, Conduct, and Health, (2) Title III Assistant Director, (3) Chair, School of Criminal Justice, (4) Internal Auditor, (5) Interim Dean, School of Nursing & Health Sciences, (6) Senior Woman Administrator/Associate Athletic Director, and (7) Executive Vice President for Finance and Administration." }, { "id": "p85.7", "order": 9, "type": "text", "bbox": { "l": 69.6, "t": 462.24, "r": 357.84, "b": 448.56 }, "text": "Testing revealed exceptions with all seven users examined:" }, { "id": "p85.8", "order": 10, "type": "list", "bbox": { "l": 86.4, "t": 449.22, "r": 541.92, "b": 293.76 }, "text": "", "attrs": { "item_count": 5 }, "children": [ { "id": "p85.8.1", "order": 11, "type": "list_item", "bbox": { "l": 86.4, "t": 449.22, "r": 541.68, "b": 420.24 }, "text": "Three users did not have a new hire email on file to request the initial setup of their network/email/system access;", "marker": "-" }, { "id": "p85.8.2", "order": 12, "type": "list_item", "bbox": { "l": 87.12, "t": 420.78, "r": 540.96, "b": 392.16 }, "text": "Four users were missing supervisor signatures approving their New Hire/Department IT Access Request Forms;" }, { "id": "p85.8.3", "order": 13, "type": "list_item", "bbox": { "l": 86.88, "t": 392.34, "r": 541.92, "b": 363.6 }, "text": "Four users were missing supervisor signatures from their Acknowledgment of Receipt of University Policies & Procedures Forms; and," }, { "id": "p85.8.4", "order": 14, "type": "list_item", "bbox": { "l": 86.88, "t": 363.9, "r": 541.68, "b": 321.36 }, "text": "All seven users were missing signatures approving their Banner Access Request Forms and/or the forms did not support the security roles/access granted. For each user reviewed and found not to have support on file for the access granted, the review found:" }, { "id": "p85.8.5", "order": 15, "type": "list_item", "bbox": { "l": 123.12, "t": 320.16, "r": 541.92, "b": 293.76 }, "text": "The Dean of Student Leadership, Conduct, and Health had forms on file for the Finance and Student modules, but had query and modify access to all 8 modules.", "marker": "○", "children": [ { "id": "p85.8.5.1", "order": 16, "type": "form_field", "bbox": { "l": 123.12, "t": 320.16, "r": 135.12, "b": 308.16 }, "text": "", "attrs": { "field_kind": "radio", "label": "The Dean of Student Leadership, Conduct, and Health had forms on file for the Finance and Student modules, but had query and modify access to all 8 modules.", "source": "glyph_estimate", "bbox_estimated": true, "label_source": "parent_text", "label_ref": "p85.8.5", "text_offset": 0, "text_span": 0 } } ] } ] }, { "id": "p85.9", "order": 17, "type": "text", "bbox": { "l": 123.36, "t": 292.56, "r": 541.92, "b": 238.56 }, "text": "The Title III Assistant Director, the Chair of School of Criminal Justice, the Interim Dean of School of Nursing & Health Sciences, and the Senior Woman Administrator/Associate Athletic Director had forms on file for the Finance module, but had query and modify access to all 8 modules." }, { "id": "p85.10", "order": 18, "type": "text", "bbox": { "l": 123.6, "t": 237.6, "r": 541.68, "b": 197.76 }, "text": "The Internal Auditor had forms on file for Human Resources, Financial Aid, Student, and Accounts Receivable modules, but had query and modify access to all 8 modules." }, { "id": "p85.11", "order": 19, "type": "text", "bbox": { "l": 123.12, "t": 196.56, "r": 541.92, "b": 141.12 }, "text": "The former EVP for Finance had a Banner Access Form on file that authorized his access to the Finance Module, Human Resources Module and Accounts Receivable module, but he had query and modify access to all 8 Banner modules approved by the former President." }, { "id": "p85.12", "order": 20, "type": "text", "bbox": { "l": 68.64, "t": 127.92, "r": 543.12, "b": 71.52 }, "text": "According to KSU, many of the Banner user classes are cross-populated with forms from different modules. For example, the former EVP for Finance was granted access to a job or form in the Accounts Receivable (T) module, which then gave him access to a separate job or form within a completely different module. At some point, KSU determined that, based on the function of the" } ], "excluded_furniture": { "first": [], "last": [] } }