Objective, Scope, and Methodology

Our objective was to evaluate the design and test the effectiveness of  information system general controls over the financial systems maintained  and operated by the Department of Interior at its NBC-Denver data center. NBC-Denver has  made progress in correcting the weaknesses identified by the OIG and has  taken other steps to improve security. Specifically, NBC-Denver had not adequately limited the access granted to  all authorized users, controlled all aspects of the system software  environment, or completely secured access to its network. The risks  created by these access control weaknesses were heightened because the  center had not established a comprehensive program for routinely  monitoring access activity to identify and investigate unusual or suspicious  access patterns that could indicate unauthorized access. Computer Security Management Program Is Essential

A key reason for NBC-Denver’s weaknesses in information system controls  was that it had not yet fully developed and implemented a comprehensive  entitywide security management program to ensure that effective controls  were established and maintained and that computer security received  adequate attention. This report contains recommendations to you.
Why GAO Did This Study

This report reviews information system general controls over the financial systems maintained by the Department of the Interior at its National Business Center (NBC) in Denver, Colorado.

What GAO Found

GAO found that although the Denver center has made progress in correcting previously cited computer security weaknesses, additional weaknesses affect the Denver center's information system control environment. These weaknesses affect the center's ability to prevent and detect unauthorized changes to financial information, control electronic access to sensitive personnel information, and restrict physical access to sensitive computing areas. The Denver center did not adequately limit access granted to authorized users, control all aspects of the system software controls, or secure access to its network. Also, the Denver center had not fully established a comprehensive program to routinely monitor access to its computer facilities and data and to identify and investigate unusual or suspicious access patterns that could indicate unauthorized access. The primary reason for these weaknesses was that the Denver center had not yet fully developed and implemented a comprehensive entitywide program to manage computer security.