A new audit from city Controller Scott Stringer takes one of the city's largest agency's to task for its lax cyber security.
The Department of Citywide Administrative Services had a bad habit of forgetting to terminate workers' access to its systems after they left the agency, according to the audit.
There was no suggestion of any mischief done by any former users — but in the days of alleged election rigging and widespread hacking by cyber thieves on the hunt for personal information, leaving an open portal isn't a good idea, Stringer said.
"This should be a no-brainer. At a time when cyberattacks are spiking, the city must do everything possible to keep sensitive information out the hands of criminals," he said.
"It takes only a single person — one disgruntled ex-employee or consultant — to compromise a critical information system," Stringer said.
Vigilance is especially relevant for DCAS, as it controls many of the city government's most sensitive functions.
Those "mission-critical" computer systems include confidential and private information, Stringer noted.
The controller's audit discovered that 1,935 users had access to DCAS' direct online order program, its FleetFocus application that tracks employees in city-owned cars and its online application for civil service exams.
Per city regulation, DCAS is supposed to deactivate accounts for former employers and users who haven't logged in for more than 90 days.
Stringer's audit found 211 accounts — 11% of the total users — that should have been disabled but were still live.
Thirty of those were for ex-employees or those on long-term leave.
Seven of the 30 accessed the DCAS network after the employee left the agency, the report found.
The lack of cybersecurity put the city at risk for a hack, Stringer noted.
It also opened the door for someone to steal city data or even potentially defraud the city, he added.
Stringer's audit also noted DCAS wasn't enforcing best practices on passwords, allowing employees to choose simple ones and ignoring a rule that said they should be changed every 90 days.
It also needed to update its list of approved external users and develop a disaster recovery plan, Stringer said.
A DCAS spokesperson said the agency had already made most fixes.
"There was a question about a small subset of employees on long term leave with computer access which we agreed to fix. It is important to note that DCAS has safeguards in place to ensure that the agency is not at risk of security breaches," the spokeswoman said. "Also DOITT's Security Operation Council monitors all of the City's networks, including the servers in the DCAS Data Center to maintain their confidentiality, integrity and availability."