Government officials are increasingly concerned about attacks from individuals and groups with malicious intent, such as crime, terrorism, foreign intelligence gathering, and acts of war. Experts also agree that there has been a steady advance in the sophistication and effectiveness of attack technology. Specifically, this program is to include   periodic risk assessments that consider internal and external threats to the integrity, confidentiality, and availability of systems, and to data supporting critical operations and assets; the development and implementation of risk-based, cost-effective policies and procedures to provide security protections for information collected or maintained by or for the agency; training on security responsibilities for information security personnel and on security awareness for agency personnel;   periodic management testing and evaluation of the effectiveness of policies, procedures, controls, and techniques;   a process for identifying and remediating any significant deficiencies;   procedures for detecting, reporting and responding to security incidents;   an annual program review by agency program officials. These six areas are (1) security program management, which provides the framework for ensuring that risks are understood and that effective controls are selected and properly implemented; (2) access controls, which ensure that only authorized individuals can read, alter, or delete data; (3) software development and change controls, which ensure that only authorized software programs are implemented; (4) segregation of duties, which reduces the risk that one individual can independently perform inappropriate actions without detection; (5) operating systems controls, which protect sensitive programs that support multiple applications from tampering and misuse; and (6) service continuity, which ensures that computer-dependent operations experience no significant disruptions. Although our current analyses showed that most agencies had significant weaknesses in these six control areas, as in past years’ analyses, weaknesses were most often identified for security program management and access controls. For security program management, we identified weaknesses for all 24 agencies in 2002—the same as reported for 2001, and compared to 21 of the 24 agencies (88 percent) in 2000. Our current analyses of information security at federal agencies also showed that the scope of audit work performed has continued to expand to more fully cover all six major areas of general controls at each agency. They more likely indicate that information security weaknesses are becoming more fully understood—an important step toward addressing the overall problem. Federal agencies and other public and private entities rely extensively on computerized systems and electronic data to support their missions. Accordingly, the security of these systems and data is essential to avoiding disruptions in critical operations, data tampering, fraud, and inappropriate disclosure of sensitive information. The weaknesses identified place a broad array of federal operations and assets at risk. In particular, our review of 24 of the largest federal agencies showed that agencies had not fully implemented requirements to   conduct risk assessments for all their systems;   establish information security policies and procedures that are commensurate with risk and that comprehensively address the other reform provisions;   provide adequate computer security training to their employees, including contractor staff; test and evaluate controls as part of their management assessments; implement documented incident handling procedures agencywide; identify and prioritize their critical operations and assets and determine the priority for restoring these assets should a disruption in critical operations occur; or   have a process to ensure the security of services provided by a contractor or another agency. At this time, however, GISRA is still scheduled to expire on November 29, 2002. We believe that continued authorization of such important information security legislation is essential to sustaining agencies’ efforts to identify and correct significant weaknesses. In addition, in October 2001, President Bush signed executive orders creating the Office of Homeland Security and establishing the President’s Critical Infrastructure Protection Board. First, it is important that the federal strategy delineate the roles and responsibilities of the numerous entities involved in federal information security. Fifth, agencies must have the technical expertise they need to select, implement, and maintain controls that protect their information systems.
Why GAO Did This Study

Protecting the computer systems that support our critical operations and infrastructures has never been more important because of the concern about attacks from individuals and groups with malicious intent, including terrorism. These concerns are well founded for a number of reasons, including the dramatic increases in reported computer security incidents, the ease of obtaining and using hacking tools, the steady advance in the sophistication and effectiveness of attack technology, and the dire warnings of new and more destructive attacks. As with other large organizations, federal agencies rely extensively on computerized systems and electronic data to support their missions. Accordingly, the security of these systems and data is essential to avoiding disruptions in critical operations, as well as to helping prevent data tampering, fraud, and inappropriate disclosure of sensitive information. At the subcommittee's request, GAO discussed its analysis of recent information security audits and evaluations at 24 major federal departments and agencies.

What GAO Found

Although GAO's current analyses of audit and evaluation reports for the 24 major departments and agencies issued from October 2001 to October 2002 indicate some individual agency improvements, overall they continue to highlight significant information security weaknesses that place a broad array of federal operations and assets at risk of fraud, misuse, and disruption. GAO identified significant weaknesses in each of the 24 agencies in each of the six major areas of general controls. As in 2000 and 2001, weaknesses were most often identified in control areas for security program management and access controls. All 24 agencies had weaknesses in security program management, which provides the framework for ensuring that risks are understood and that effective controls are selected and properly implemented. Implementation of the Government Information Security Reform provisions (GISRA) is proving to be a significant step in improving federal agencies' information security programs. It has also prompted the administration to take important actions to address information security, such as integrating security into the President's Management Agenda Scorecard. However, GISRA is scheduled to expire on November 29, 2002. GAO believes that continued authorization of such important information security legislation is essential to sustaining agencies' efforts to identify and correct significant weaknesses. In addition to reauthorizing this legislation, there are a number of important steps that the administration and the agencies should take to ensure that information security receives appropriate attention and resources and that known deficiencies are addressed. These steps include delineating the roles and responsibilities of the numerous entities involved in federal information security and related aspects of critical infrastructure protection; providing more specific guidance on the controls agencies need to implement; obtaining adequate technical expertise to select, implement, and maintain controls to protect information systems; and allocating sufficient agency resources for information security.