2017-10-10 Services & Organisation Committee Agenda

SERVICES & ORGANISATION COMMITTEE MEETING AGENDA                                    10 OCTOBER 2017


Provider                System provided
TechnologyOne           Enterprise systems including property, financials and payroll
Nexon Asia Pacific      Server and storage infrastructure, network links and telephony
Genasys                 Call Centre system
Microsoft               Email and Office 365 collaboration tools
Civica                  Library management system
Velpic                  Online learning and induction system

In May 2017, TechnologyOne became the first Australian software as a service vendor to be
certified for cloud services by the Australian Signals Directorate (ASD) of the Department of
Defence. The TechnologyOne cloud obtained an “unclassified dissemination limiting marker”
level of certification. This level certification by the ASD indicates the TechnologyOne cloud is
suitable for highly sensitive personal data providing an additional level of assurance to Council.

Procuring cloud based systems from expert external providers with systematic approaches to
security provides a greater level of assurance that Council systems and information are secure.

3.       Fraud Incident Attempts

Two recent email impersonation fraud attempts were identified being the first sophisticated fraud
attempts against Council (targeting Financial Services staff). The robustness of Council’s internal
ICT and Finance control frameworks prevented any financial loss. The Queensland Government
Cyber Security Unit and Queensland Police Identity and Cyber Unit were provided copies of the
emails of both incidents to provide them with intelligence.

General and specific internal controls in place to prevent such fraud attempts include:
  Educating staff via emailed newsletters, posters and videos regarding cybersecurity risks;
  An intranet page providing information and videos on cyber security;
  Regular phishing testing;
  Email filtering rules;
  PC anti-virus systems;
  Access restrictions on Council data; and
  Procurement and finance policies and processes, segregation of duties and the
    establishment of appropriate financial delegations.

Previous Council Consideration

Nil.

Finance & Risk

Risk

Business continuity in addition to failing to meet customer expectations are key risks included in
Council’s strategic risk register. Appropriate ICT security assists in mitigating these risks.

Consultation

External Consultation - Community & Stakeholder

Nil.


                                                                                         Page 83 of 84