Auditor general ‘encouraged’ by province’s IT security measures for remote workers, but risks remain

Hey there, time traveller!
This article was published 12/03/2024 (584 days ago), so information in it may no longer be current.

The provincial government has taken steps to bolster technological security for employees working remotely but some risks persist, a new report from Manitoba’s auditor general says.

Tyson Shtykalo reviewed the province’s information technology systems after some 3,500 public-service employees switched to a hybrid work model during the COVID-19 pandemic.

Between June 2021 and June 2023, his audit examined IT security processes and policies, data-protection measures and the security training provided to staff.

The resulting 23-page report identified three areas of concern, recommending the province improve employee training, review outdated IT policies and update some security settings.

“I am encouraged that Manitoba has introduced security measures to protect information and systems used by employees to work remotely, but there is room for some improvement,” Shtykalo said.

“Addressing these findings would create a more secure work environment.”

While the province uses data encryption to protect sensitive information, the report identified instances where encryption was weak, warning that the current security setting are not impervious to data leaks and cyber attacks.

He also found some remote work policies and procedures have not been updated in close to a decade.

Further, an estimated 31 per cent of employees had not completed mandatory technology training.

“Remote work helped keep some employees safe during the COVID-19 pandemic. However, it has increased IT security threats that can put systems and data at risk,” the report says.

“Remote workers who have not undergone security training are more likely to fall victim to phishing emails and other social engineering tactics. This can result in compromised credentials, malware infections and data breaches.”

The audit did not include employees working in Crown corporations, Shared Health and regional health authorities, or within universities and school districts.

It also did not include members of the allied public service, which include staff working for politicians and officials at the Manitoba legislature.

In a written response included with the report, the province said it accepts all three of Shytkalo’s recommendations and will “continue to regularly review policies, procedures, guidelines and standards.”

tyler.searle@freepress.mb.ca