United States Government Publishing Office publisher pbl distributor dst United States Government Accountability Office Accounting and Information Management Division author aut Government Organization text government publication eng GAOREPORTS Legislative Agency Publications gao legislative 2010-08-12 U.S. Government Printing Office 2000-02-17 monographic deposited born digital 17 p. GA 1.13:T-AIMD-00-97 https://www.govinfo.gov/app/details/GAOREPORTS-T-AIMD-00-97 P0b002ee1803a3ee8 f:ai00097t DGPO 2010-08-12 2011-03-24 GAOREPORTS-T-AIMD-00-97 machine generated eng fdlp REPORT GAOREPORTS-T-AIMD-00-97 T-AIMD-00-97 Internal controls Confidential communication Data integrity Information resources management Information leaking Computer security Hackers Computer crimes Financial management systems Computer networks National Plan for Information Systems Protection Testimony AIMD Pursuant to a congressional request, GAO discussed its recent review of information security at the Environmental Protection Agency (EPA).<p/>GAO noted that: (1) GAO's review found serious and pervasive problems that essentially render EPA's agencywide information security program ineffective; (2) current security program planning and management is largely a paper exercise that has done little to substantively identify, evaluate, and mitigate risks to the agency's data systems; (3) GAO's tests of computer-based controls have concluded that the computer operating systems and the agencywide computer network that support most of EPA's mission-related and financial operations are riddled with security weaknesses; (4) many of the most serious weaknesses--those related to inadequate protection from intrusions via the Internet and poor security planning--had been previously reported to EPA management in 1997 by EPA's Inspector General; (5) the negative effects of such weaknesses are illustrated by EPA's own records which show several serious computer security incidents in the last 2 years that have resulted in damage and disruption to agency operations; (6) GAO identified deficiencies in EPA' incident detection and handling capabilities that draw into question EPA's ability to fully understand or assess the nature of or damage due to its computer security breaches; (7) accordingly, EPA's computer systems and the operations that rely on these systems are highly vulnerable to tampering, disruption, and misuse; (8) moreover, EPA cannot ensure the protection of sensitive business and financial data maintained on its larger computer systems or supported by its agencywide network; and (9) GAO's work has sensitized EPA to the seriousness of these issues and agency officials have informed GAO of some corrective actions and announced other plans which, if properly implemented, can begin to address several of these serious problems. https://www.govinfo.gov/content/pkg/GAOREPORTS-T-AIMD-00-97/html/GAOREPORTS-T-AIMD-00-97.htm https://www.govinfo.gov/content/pkg/GAOREPORTS-T-AIMD-00-97/pdf/GAOREPORTS-T-AIMD-00-97.pdf GAO/T-AIMD-00-97 https://www.govinfo.gov/app/details/GAOREPORTS-T-AIMD-00-97 Testimony GAO/T-AIMD-00-97; Information Security: Fundamental Weaknesses Place EPA; Internal controls Confidential communication Data integrity Information resources management Information leaking Computer security Hackers Computer crimes Financial management systems Computer networks National Plan for Information Systems Protection