This generally means that controls be established in a number of areas, including, but not limited to: a comprehensive security program with top management commitment, sufficient resources, and clearly assigned roles and responsibilities for those responsible for the program’s implementation; clear, consistent, and up-to-date information security policies and vulnerability assessments to identify security weaknesses; awareness training to ensure that computer users understand the security risks associated with networked computers; assurance that systems administrators and information security officials have sufficient time and training to do their jobs properly; cost-effective use of technical and automated security solutions; and a robust incident response capability to detect and react to attacks and to aggressively track and prosecute attackers. Equally worrisome are DISA’s internal test results; in assessing vulnerabilities, DISA attacks and successfully penetrates Defense systems 65 percent of the time. But in the Rome case, Air Force Information Warfare Center staff estimated that the attacks on the Rome Lab cost the government over half a million dollars. This included costs for time spent to take the lab’s systems off the networks, verify the integrity of the systems, install security “patches,” and restore computer service. National Security Concerns

systems experts believe that computer attacks are capable of disrupting communications, stealing sensitive information, and threatening our ability to execute military operations. Instead, all they really need to steal sensitive data or shut down military computers is a $2,000 computer and modem and a connection to the Internet. . . goes well beyond the Department. Defense Faces Challenges in Securing Its Systems

methods of attack. DISA established its Global Defensive Information Warfare Control Center and its Automated Systems Security Incident Support Team (ASSIST) in Arlington, Virginia. Each of the military services has established computer emergency response capabilities, as well. However, many of Defense’s policies relating to computer systems attacks are outdated and inconsistent.
Why GAO Did This Study

GAO discussed information security procedures at the Department of Defense (DOD).

What GAO Found

GAO noted that: (1) as many as 250,000 DOD computer systems were attacked in 1995; (2) hackers successfully penetrate DOD computer systems 65 percent of the time; (3) hackers attack DOD computer systems to steal and destroy sensitive data and install reentry devices; (4) these attacks cost the government over half a million dollars, including the cost of disconnecting the system, verifying the system's integrity, installing security patches, and restoring computer services; (5) hackers are capable of disrupting communications and threatening U.S. military operations; (6) DOD faces a huge challenge in protecting its computer systems due to the size of its information infrastructure, increasing amounts of sensitive data, Internet use, and skilled hackers; (7) DOD has established a Global Information Warfare Control Center and a Automated Systems Security Incident Support Team to provide around-the-clock service and respond to computer attacks; (8) many DOD policies pertaining to computer security are outdated and inconsistent and DOD system and network administrator's are inadequately trained to perform their jobs; and (9) DOD needs to be more aggressive in developing an automated program that responds to computer attacks.