United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office Accounting and Information Management Division author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 2000-09-06 monographic deposited born digital 36 p. GA 1.13:AIMD-00-295 https://www.govinfo.gov/app/details/GAOREPORTS-AIMD-00-295 P0b002ee1803931bd f:ai00295 DGPO 2010-08-12 2011-03-24 GAOREPORTS-AIMD-00-295 machine generated eng fdlp REPORT GAOREPORTS-AIMD-00-295 AIMD-00-295 Computer security Information resources management Internal controls Internal audits Computer crimes Computer viruses Computer software ILOVEYOU Computer Virus Melissa Computer Virus National Plan for Information Systems Protection Letter Report AIMD Pursuant to a congressional request, GAO reviewed inspectors' general information security audit findings for 24 federal agencies, focusing on: (1) information security weaknesses identified in audit reports issued from July 1999 through August 2000 and GAO's findings with similar information that GAO reported in September 1998; (2) weaknesses and the related risks at selected individual agencies; and (3) the most significant types of weaknesses in each of six categories of general controls that GAO used in its analysis.<p/>GAO noted that: (1) evaluations of computer security published since July 1999 continue to show that federal computer security is fraught with weaknesses and that, as a result, critical operations and assets continue to be at risk; (2) as in 1998, GAO's analysis identified significant weaknesses in each of the 24 agencies covered by its review; (3) since July 1999, the range of weaknesses in individual agencies has broadened, at least in part because the scope of audits being performed is more comprehensive than in prior years; (4) while these audits are providing a more complete picture of the security problems agencies face, they also show that agencies have much work to do to ensure that their security programs are complete and effective; (5) the weaknesses identified place a broad array of federal operations and assets at risk of fraud, misuse, and disruption; (6) for example, weaknesses at the Department of the Treasury increase the risk of fraud associated with billions of dollars of federal payments and collections, and weaknesses at the Department of Defense increase the vulnerability of various military operations that support the department's war-fighting capability; (7) further, information security weaknesses place enormous amounts of confidential data, ranging from personal and tax data to proprietary business information, at risk of inappropriate disclosure; (8) for example, in 1999, a Social Security Administration employee pled guilty to unauthorized access of the administration's systems; (9) the related investigation determined that the employee had made many unauthorized queries, including obtaining earnings information for members of the local business community; (10) for most agencies, the weaknesses reported covered the full range of computer security controls; (11) security program planning and management were inadequate; (12) physical and logical access controls also were not effective in preventing or detecting system intrusions and misuse; (13) software change controls were ineffective in ensuring that only properly authorized and tested software programs were implemented; (14) duties were not adequately segregated to reduce the risk that one individual could execute unauthorized transactions or software changes without detection; (15) sensitive operating system software was not adequately controlled, and adequate steps had not been taken to ensure continuity of computerized operations; and (16) more needs to be done, especially in the area of security program planning and management, which involves instituting routine risk management activities aimed at ensuring that risks are understood and controls are implemented. https://www.govinfo.gov/content/pkg/GAOREPORTS-AIMD-00-295/html/GAOREPORTS-AIMD-00-295.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-AIMD-00-295/pdf/GAOREPORTS-AIMD-00-295.pdf GAO/AIMD-00-295 https://www.govinfo.gov/app/details/GAOREPORTS-AIMD-00-295 Letter Report GAO/AIMD-00-295; Information Security: Serious and Widespread Weaknesses; Computer security Information resources management Internal controls Internal audits Computer crimes Computer viruses Computer software ILOVEYOU Computer Virus Melissa Computer Virus National Plan for Information Systems Protection