United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office Accounting and Information Management Division author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 2000-05-10 monographic deposited born digital 12 p. GA 1.13:T-AIMD-00-171 https://www.govinfo.gov/app/details/GAOREPORTS-T-AIMD-00-171 P0b002ee1803947e7 f:ai00171t DGPO 2010-08-12 2011-03-28 GAOREPORTS-T-AIMD-00-171 machine generated eng fdlp REPORT GAOREPORTS-T-AIMD-00-171 T-AIMD-00-171 Computer networks Computer security Computer crimes Information resources management Electronic mail Computer viruses Internal controls Internet Melissa Computer Virus ILOVEYOU Computer Virus Testimony AIMD Pursuant to a congressional request, GAO discussed the "ILOVEYOU" computer virus, focusing on the need for agency and governmentwide improvements in information security.<p/>GAO noted that: (1) ILOVEYOU is both a virus and a worm; (2) the damage resulting from this particular hybrid is limited to users of the Microsoft Windows operating system; (3) ILOVEYOU typically comes in the form of an electronic mail (e-mail) message from someone the recipient knows; (4) as long as recipients do not run the attached file, their systems will not be affected and they need only to delete the e-mail and its attachment; (5) if opened, the ILOVEYOU can spread and infect systems by sending itself to everyone in the recipient's address book; (6) there are areas of management and general control that are integral to improving problems in information security; (7) most agencies do not develop security plans for major systems based on risk, have not formally documented security policies, and have not implemented programs for testing and evaluating the effectiveness of controls they rely on; (8) these are fundamental activities that allow an organization to manage its information security risks cost-effectively rather than by reacting to individual problems ad hoc; (9) agencies often lack effective access controls to their computer resources and, as a result, are unable to protect these assets against unauthorized modification, loss, and disclosure; (10) these controls would normally include physical protections such as gates and guards and logical controls, which are controls built into software that: (a) require users to authenticate themselves through passwords or other identifiers; and (b) limit the files and other resources that an authenticated user can access and the actions that he or she can take; (11) testing procedures are undisciplined and do not ensure that implemented software operates as intended, and access to software program libraries is inadequately controlled; (12) GAO found that computer programmers and operators are authorized to perform a wide variety of duties; (13) this, in turn, provides them with the ability to independently modify, circumvent, and disable system security features; (14) GAO's reviews frequently identify systems with insufficiently restricted access to the powerful programs and sensitive files associated with the computer system's operation; (15) such free access makes it possible for knowledgeable individuals to disable or circumvent controls; (16) service continuity controls are incomplete and often not fully tested for ensuring that critical operations can continue when unexpected events occur; and (17) agencies can act immediately to address computer weaknesses and reduce their vulnerability to computer attacks. https://www.govinfo.gov/content/pkg/GAOREPORTS-T-AIMD-00-171/html/GAOREPORTS-T-AIMD-00-171.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-T-AIMD-00-171/pdf/GAOREPORTS-T-AIMD-00-171.pdf GAO/T-AIMD-00-171 https://www.govinfo.gov/app/details/GAOREPORTS-T-AIMD-00-171 Testimony GAO/T-AIMD-00-171; Information Security: "ILOVEYOU" Computer Virus Emphasizes; Computer networks Computer security Computer crimes Information resources management Electronic mail Computer viruses Internal controls Internet Melissa Computer Virus ILOVEYOU Computer Virus