Generally, Code Red and Code Red II are both “worms,” which are attacks that propagate themselves through networks without any user intervention or interaction. They both take advantage of a flaw in a component of versions 4.0 and 5.0 of Microsoft’s Internet Information Services (IIS) Web server software. SirCam is a malicious computer virus that spreads primarily through E- mail. Once activated on an infected computer, the virus searches through a select folder and mails user files acting as a “Trojan horse” to E-mail addresses in the user’s address book. In addition to spreading, the virus can attempt to delete a victim’s hard drive or fill the remaining free space on the hard drive making it impossible to perform common tasks such as saving files or printing. On July 19, the Code Red worm infected more than 250,000 systems in just 9 hours, according to the National Infrastructure Protection Center (NIPC). It is allegedly responsible for the leaking of secret documents from the government of Ukraine. Third, agencies do not have an effective information security program to prevent and respond to attacks—both external attacks, like Code Red, Code Red II, and SirCam, and internal attempts to manipulate or damage systems and data. Agencies also often lack effective access controls to their computer resources and consequently cannot protect these assets against unauthorized modification, loss, and disclosure. We reported earlier this year that several agencies have taken significant steps to redesign and strengthen their information security programs. Lastly, the Congress recently enacted legislation to provide a comprehensive framework for establishing and ensuring the effectiveness of information security controls over information resources that support federal government operations and assets.
What GAO Found

Organizations and individuals have recently had to contend with particularly vexing computer attacks. The most notable is Code Red, but potentially more damaging are Code Red II and SirCam. Together, these attacks have infected millions of computer users, shut down websites, slowed Internet service, and disrupted businesses and government operations. They have already caused billions of dollars of damage, and their full effects have yet to be completely assessed. Code Red and Code Red II are both "worms," which are attacks that propagate themselves through networks without any user intervention or interaction. Both take advantage of a flaw in a component of versions 4.0 and 5.0 of Microsoft's Internet Information Services Web server software. SirCam is a malicious computer virus that spreads primarily through E-mail. Once activated on an infected computer, the virus searches through a select folder and mails user files acting as a "Trojan horse" to E-mail addresses in the user's address book. In addition to spreading, the virus can delete a victim's hard drive or fill the remaining free space on the hard drive, making it impossible to save files or print. On July 19, 2001, the Code Red worm infected more than 250,000 systems in just nine hours, causing more than $2.4 billion in economic losses. SirCam is allegedly responsible for the leaking of secret documents from the Ukrainian government. U.S. government agencies do not have an effective information security program to prevent and respond to these attacks and often lack effective access controls to their computer resources and consequently cannot protect these assets against unauthorized modification, loss, and disclosure. However, several agencies have taken significant steps to redesign and strengthen their information security programs. Also, Congress recently enacted legislation to provide a comprehensive framework for establishing and ensuring the effectiveness of information security controls over information resources that support federal operations and assets.