Defense automates removal of network access of former staff following investigation

The Australian Department of Defense has automated the process of removing network and system access for personnel and non-compliant accounts.

Following an investigation by the Australian National Audit Office (ANAO) which found 1,451 users “whose access to the defense network was not removed in accordance with requirements” between financial years 2022 and 2023, Defense announced the Defense Accounts Retirement Service (DARS). .

The new service will automatically disable systems access for the accounts of departing Defense personnel, leaving contractors, and “help automatically remediate accounts that are not in compliance with Defense policies, such as [ISM] and the Defense Security Principles Framework (DSPF),” Defense said. iTnews.

Additionally, workers who no longer hold authorization, valid sponsorship or other DSPF and Information Security Manual (ISM) requirements will also be removed.

The changes follow the ANAO audit as part of the iCommonwealth Financial Statements Survey 2022-2023who was concerned about the large number of unauthorized accesses to computer systems.

“Committee chair Linda Burney said poor IT governance, particularly user access issues, continues to be among the important findings of the Auditor General’s report on the financial statements,” a statement said. press release from the joint public accounts and audit committee.

“Ms Burney said “unauthorized user access to computer systems across the Commonwealth remains a problem as in previous years. The risks this poses are potentially significant as some of the agencies involved hold highly sensitive information.

Defense also said that in response to this it had strengthened its ability to “prevent and detect unauthorized access” and introduced better governance controls for its systems.

The audit also found there were 2,000 instances where former Defense contractors and employees had accessed its network.

However, in a statement seen by iTnews, Defense said “the vast majority were false positives” and that these were largely cases where “an individual completed one engagement and began another engagement at within Defense”.