Consultants advise Los Alamos on security
Connecting state and local government leaders
Los Alamos National Laboratory needs to centralize its IT user access controls, take better care of its backup tapes and re-engineer its business process controls, according to a report from an independent auditor. <br>
Los Alamos National Laboratory needs to centralize its IT user access controls, take better care of its backup tapes and re-engineer its business process controls before switching to a new financial system, according to a report from an independent auditor.
Ernst & Young LLP of New York surveyed the operations of the Los Alamos, N.M., weapons laboratory for the University of California, which manages the lab for the Energy Department. The consulting firm compiled its findings into seven reports, which the university released yesterday.
The weapons lab has been under pressure in recent months over accusations of property mismanagement and other problems [see story at www.gcn.com/vol1_no1/daily-updates/21393-1.html].
Lab officials are preparing to replace several legacy systems with Oracle Financials, according to Ernst & Young's report. The lab, however, has 'minimal focus on the re-engineering of business process controls and security,' the study said.
Because a highly integrated enterprise resource planning system such as the Oracle application can propagate data errors quickly, the lab 'should strive to re-engineer its business process controls and security to the greatest extent possible before going live on Oracle,' the report said.
The consultants found that Los Alamos ships its backup tapes to Lawrence Livermore National Laboratory via Federal Express. 'Due to the changing environments that these tapes will go through from LANL to LLNL and back again, it is highly possible that the data stored on the tapes could be damaged in routing and become unreadable,' the study said.
Instead, Los Alamos should hire a vendor to provide temperature-controlled transportation and off-site storage of the data tapes, the consultants recommended.
The lab needs to start performing routine data recovery tests on its servers and should test its disaster recovery plan for business systems at least once a year, the report said. Officials also should consider assigning user access control responsibilities to one central group instead of the various sections of the lab's Business Unit Services Group.
Other Los Alamos areas that Ernst & Young studied included accounts payable, banking, Energy funding, budget execution, cash receipts, payroll processes, property management and property accounting.