In addition, AAC risks certain types of  unauthorized access not being detected because it had not completely  corrected the user access monitoring weaknesses we previously identified. AAC had established a solid foundation for its computer security planning  and management program by creating a centralized computer security  group, developing a comprehensive security policy, and promoting security  awareness. Although AAC had substantially corrected previously identified computer  security weaknesses, we tested additional access and system software  controls and found weaknesses that posed risks of unauthorized  modification, disclosure, or destruction of financial and sensitive veteran  medical and benefit information. A program to regularly test information system controls would also have  allowed AAC to detect additional network security weaknesses. Addressing the remaining additional  issues should help AAC ensure that an effective computer security  environment is achieved and maintained. Conclusions

AAC had made substantial progress in improving information system  general controls. Until AAC completes implementing its computer  security planning and management program by establishing a framework  for continually assessing risks and routinely monitoring and evaluating the  effectiveness of information system controls, it will not have adequate  assurance that appropriate controls are established and operating  effectively. AAC could have identified and  corrected these types of weaknesses, which could also adversely affect  other agencies that depend on AAC for computer processing support, had it  fully implemented an effective computer security planning and  management program. Recommendations

We recommend that the Acting VA Chief Information Officer (CIO) work  with the director of AAC to implement policies and procedures for assessing and managing risk on a establish processes for (1) monitoring compliance with established  information system control policies and procedures, (2) testing the  effectiveness of information system controls, and (3) improving  information system controls based on the results of these activities; and expand the center’s user access activity monitoring program to identify  and investigate unusual or suspicious patterns of successful access to  sensitive data and resources for unauthorized access.
Why GAO Did This Study

Pursuant to a legislative requirement, GAO assessed the effectiveness of information system general controls at the Department of Veterans Affairs' (VA) Austin Automation Center (AAC).

What GAO Found

GAO noted that: (1) AAC had made substantial progress in correcting specific computer security weaknesses that GAO identified in its previous evaluation of information system controls; (2) AAC had established a solid foundation for its computer security planning and management program by creating a centralized computer security group, developing a comprehensive security policy, and promoting security awareness; (3) however, AAC had not yet established a framework for continually assessing risks and routinely monitoring and evaluating the effectiveness of information system controls; (4) GAO also identified additional computer security weaknesses that increased the risk of inadvertent or deliberate misuse, fraudulent use, improper disclosure, and destruction of financial and sensitive veteran medical and benefit information on AAC systems; (5) an effective computer security planning and management program would have allowed AAC to identify and correct the types of additional weaknesses that GAO identified; (6) in addition, AAC continues to run the risk that unauthorized access may not be detected because it had not established a program to identify and investigate unusual or suspicious patterns of successful access to sensitive data and resources; (7) these weaknesses could also affect other agencies that depend on AAC information technology services; (8) AAC was very responsive to addressing new security exposures identified and corrected several weaknesses before GAO's fieldwork was completed; (9) the Acting Assistant Secretary for Information Technology said VA would implement all of GAO's recommendations by September 30, 1999; and (10) addressing the remaining issues will help ensure that an effective computer security environment is achieved and maintained.