Pay.gov is a Key Electronic Government Initiative

FMS’s Pay.gov is a governmentwide transaction portal that allows federal  agencies to collect and the public to make several types of payments to the  federal government via the Internet. FMS has estimated that Pay.gov  eventually could process about 80 million transactions and collect about  $125 billion a year. However, FMS did not sufficiently assess the risk associated with the  Pay.gov computing environment. For example,  FMS had not conducted a business risk assessment for the computing  environment because officials did not believe this was necessary. In addition, weaknesses in other  information system controls, including segregation of duties, software  change controls, service continuity, and application security controls,  further increased risk to Pay.gov. Further, FMS performed several security reviews to identify and mitigate  vulnerabilities associated with Pay.gov. Despite these controls, numerous information security control weaknesses  increased the risk that external and internal users could have gained  unauthorized access to Pay.gov, which could have led to the inappropriate  disclosure or modification of its data or to the disruption of service. FMS and the Federal Reserve did not consistently implement effective  electronic access controls to prevent, limit, and detect access to Pay.gov  and its computing environment. Numerous vulnerabilities existed in  Pay.gov’s computing environment because of the cumulative effects of  control weaknesses in the areas of user accounts and passwords, access  permissions and rights, network services and security, and audit and  monitoring of security-related events. Although FMS and the Federal  Reserve had implemented numerous controls for Pay.gov, the security of  Pay.gov systems and data was diminished because FMS did not ensure that  risks were fully assessed, policies and controls were effectively  implemented, operating personnel were aware of strong security practices,  known weaknesses were promptly mitigated, and systems were reviewed  for security exposures after changes to the systems were made. Conclusions

Although FMS and the Federal Reserve had implemented numerous  controls to protect Pay.gov computing resources, risks were not  sufficiently assessed, and numerous control weaknesses increased risks to  the confidentiality, integrity, and availability of Pay.gov systems and data  because FMS did not provide sufficient management oversight to ensure  that key elements of the Pay.gov information security program were fully or  consistently implemented. These include (1) completing a comprehensive security risk  assessment for the Pay.gov computing environment; (2) documenting and  implementing appropriate security and management controls to protect the  application and its computing environment; (3) establishing a team to  periodically check the configuration of servers and networks, as well as to  evaluate operational staff awareness of and adherence to established  policy; (4) engaging the Federal Reserve’s National Incident Response  Team and establishing an agreement with the Federal Reserve that the  general auditors of the various Reserve Banks will conduct regular  information technology audits of FMS’s Internet applications; (5)  instituting greater separation of duties and a more rigorous software  change management process to maintain stricter control over deployed  software; and (6) documenting security policies in all statements of work  so that all vendors are aware of and accountable for security requirements.
Why GAO Did This Study

"Pay.gov" is an Internet portal sponsored and managed by the Department of the Treasury's Financial Management Service (FMS) and operated at three Federal Reserve facilities. Pay.gov is intended to allow the public to make certain non-income-tax-payments to the federal government securely over the Internet. FMS estimates that Pay.gov eventually could annually process 80 million transactions valued at $125 billion annually. Because of the magnitude of transaction volume and dollar value envisioned for Pay.gov, GAO was asked to determine whether FMS (1) conducted a comprehensive security risk assessment and (2) implemented and documented appropriate security measures and controls for the system's protection.

What GAO Found

FMS had not fully assessed the risks associated with the Pay.gov initiative. Although the agency prepared a business risk assessment for the Pay.gov application, it had not fully assessed the risks associated with Pay.gov computing environment. Insufficiently assessing risks can lead to implementing inadequate or inappropriate security controls. Although FMS and the Federal Reserve had documented and implemented many security controls to protect Pay.gov, security controls were not always effectively implemented to ensure the confidentiality, integrity, and availability of the Pay.gov environment and data. FMS and the Federal Reserve established and documented key security and control policies and procedures for Pay.gov. In addition, they established numerous controls intended to restrict access to the application and computing environment and performed several security reviews to identify and mitigate vulnerabilities. However, numerous information security control weaknesses increased the risk that external and internal users could gain unauthorized access to Pay.gov, which could lead to the inappropriate disclosure or modification of its data or to the disruption of service. For example, FMS and the Federal Reserve had not consistently implemented access controls to prevent, limit, and detect electronic access to the Pay.gov application and computing environment. These weaknesses involved user accounts and passwords, access rights and permissions, and network services and security, as well as auditing and monitoring security-relevant events. In addition, weaknesses in other information systems controls--such as segregation of duties, software change controls, service continuity, and application security controls--reduced FMS's effectiveness in mitigating the risk of errors or fraud, preventing unauthorized changes to software, and ensuring the continuity of data processing operations when unexpected interruptions occur. These computer weaknesses existed, in part, because FMS did not provide sufficient management oversight of Pay.gov operating personnel at the Federal Reserve facilities to ensure that elements of the Pay.gov computer security program were fully or consistently implemented.