Objective

To determine whether security over HBDF’s critical systems is sufficient to minimize the various risks associated with unauthorized access to its systems and data.

Background

HBDF is a public benefit corporation established in 1965 by the Laverne Law (Laws of New York, Chapter 567 of the Laws of 1965). The mission of HBDF is to promote agriculture through the breeding of Standardbred horses and the conduct of equine research within the State. To carry out its legislative mission, HBDF administers the New York Sire Stakes races, Excelsior/State Fair Series races, and County Fair Races. Using the money from these race series, HBDF contributes to the Statewide 4-H program and the Harry M. Zweig Memorial Fund for Equine Research to promote equine research at Cornell University.

Currently, HBDF has only two employees—the Executive Director and an intern. Additional staff and support for HBDF is provided through a shared service agreement with the New York State Gaming Commission and a third-party administrator. To fulfill its mission, HBDF relies on critical data hosted by the Office of Information Technology Services (ITS). To ensure security over this data, HBDF utilizes ITS policies and procedures including the following: account management and access control, information security, patch and vulnerability management, internet privacy, and contact web pages.

Key Findings

We identified areas where HBDF could improve certain security controls in place to minimize the various risks associated with unauthorized access to its systems and data. Due to the confidential nature of our audit findings, we communicated the details of these findings with three recommendations in a separate confidential preliminary report to HBDF officials for their review and comment. HBDF officials agreed with our findings and have already begun actions to implement our recommendations.

Key Recommendation

Implement the three recommendations included in our confidential preliminary report.