United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office Accounting and Information Management Division author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 2000-06-22 monographic deposited born digital 14 p. GA 1.13:T-AIMD-00-229 https://www.govinfo.gov/app/details/GAOREPORTS-T-AIMD-00-229 P0b002ee18039d3c0 f:ai00229t DGPO 2010-08-12 2011-03-28 GAOREPORTS-T-AIMD-00-229 machine generated eng fdlp REPORT GAOREPORTS-T-AIMD-00-229 T-AIMD-00-229 Computer security Information systems Data collection Internal controls Proposed legislation Joint ventures Interagency relations Private sector Information resources management ILOVEYOU Computer Virus Y2K NIST Federal Computer Incident Response Capability Program Testimony AIMD Pursuant to a congressional request, GAO discussed the proposed Cyber Security Information Act of 2000 (H.R. 4246), focusing on how it can enhance critical infrastructure protection and the formidable challenges involved with achieving the goals of the bill.<p/>GAO noted that: (1) by removing key barriers that are precluding private industry from sharing information about infrastructure threats and vulnerabilities, H.R. 4246 can help build the meaningful private-public partnerships that are integral to protecting critical infrastructure assets; (2) however, to successfully engage the private sector, the federal government itself must be a model of good information security; (3) currently, it is not; (4) significant computer security weaknesses--ranging from poor controls over access to sensitive systems and data, to poor control over software development and changes, to nonexistent or weak continuity of service plans--pervade virtually every major agency; (5) and, as illustrated by the recent ILOVEYOU computer virus, mechanisms already in place to facilitate information sharing among federal agencies about impeding threats and vulnerabilities have not been working effectively; and (6) moreover, the federal government may not yet have the right tools for identifying, analyzing, coordinating, and disseminating the type of information that H.R. 4246 envisions collecting from the private sector. https://www.govinfo.gov/content/pkg/GAOREPORTS-T-AIMD-00-229/html/GAOREPORTS-T-AIMD-00-229.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-T-AIMD-00-229/pdf/GAOREPORTS-T-AIMD-00-229.pdf GAO/T-AIMD-00-229 https://www.govinfo.gov/app/details/GAOREPORTS-T-AIMD-00-229 Testimony GAO/T-AIMD-00-229; Critical Infrastructure Protection: Comments on the; Computer security Information systems Data collection Internal controls Proposed legislation Joint ventures Interagency relations Private sector Information resources management ILOVEYOU Computer Virus Y2K NIST Federal Computer Incident Response Capability Program