Initial Report Into MSD Kiosk Security Released
An early security review of the Ministry of Social Development's public computer kiosks has been released under the Official Information Act (via the website FYI.org.nz).
In October Keith Ng revealed that kiosk users could access senstive information on the MSD's corporate computer network.
The review, made by security-assessment.com (a subsiduary of Dimension Data) in April 2011, flagged this vulnerability as well as a 'critical' issue. Critical issues are decribed as "alloing remote users to compromise multiple component of a project or solution". Details of this issue were withheld by MSD.
A Deloitte report subsequent to Ng's revelations referred to the review and found MSDs response to security warnings it received to be wholly inadequate. (MSD releases and Deloitte report, Multimedia and report on MSD press conference, Keith Ng summary)
The document
from a request of FYI.org.nz:
foiextract20121121-21805-12v7tw6-0
Scoop
copy: MSD_SA_kiosk.pdf
Mirror:
https://dl.dropbox.com/u/20088543/foi.html