As of July 1, 1997, 26 percent of the nation’s population—approximately 70 million persons who are veterans, veterans’ dependents, or survivors of deceased veterans—was potentially eligible for VA benefits and services, such as health care delivery, benefit payments, life insurance protection, and home mortgage loan guarantees. As a result, VA’s computer systems, programs, and data are at risk of inadvertent or deliberate misuse, fraudulent use, and unauthorized alteration or destruction occurring without detection. We also found that VA had not adequately protected its systems from unauthorized access from remote locations or through the VA network. Access Authority Is Not Appropriately Limited for Authorized VA Users

A key weakness in VA’s internal controls was that the department was not adequately limiting the access of VA employees. The VBA CIO also said that a task force established to address control weaknesses had evaluated the inappropriate access that we identified at the Hines and Philadelphia benefits delivery centers and made recommendations for corrective measures. The directors of the Austin Automation Center and the Dallas Medical Center told us that they planned to periodically review system access. The director of the Austin Automation Center told us that actions had been taken to address the reported weaknesses. Computer Security Planning and Management Program Is Not Adequate

A key reason for VA’s general computer control problems was that the department did not have a comprehensive computer security planning and management program in place to ensure that effective controls were established and maintained and that computer security received adequate attention. The Dallas Medical Center has upgraded its computer hardware and added network capabilities since 1994. Conclusions

VA’s access control problems, as well as other general computer control weaknesses, are placing sensitive veteran medical and benefit information at risk of disclosure, critical financial and benefit delivery operations at risk of disruption, and assets at risk of loss. Recommendations

We recommend that you direct the VA CIO to work in conjunction with the VBA and VHA CIOs and the facility directors as appropriate to limit access authority to only those computer programs and data needed to perform job responsibilities and review access authority periodically to identify and correct inappropriate access; implement ID and password management controls across all computer platforms to maintain individual accountability and protect password confidentiality and test these controls periodically to ensure that they are operating effectively; develop targeted monitoring programs to routinely identify and investigate unusual or suspicious system and user access activity; restrict access to computer rooms based on job responsibility and periodically review this access to determine if it is still appropriate; separate incompatible computer responsibilities, such as system programming and security administration, and ensure that access controls enforce segregation of duties principles; require operating system software changes to be documented, authorized, tested, independently reviewed, and implemented by a third party; and establish controls to ensure that disaster recovery plans are comprehensive, current, fully tested, and maintained at the off-site storage facility. VA also informed us that the CIO will report periodically to the OIG on VA’s progress in correcting computer control weaknesses throughout the department.
Why GAO Did This Study

Pursuant to a legislative requirement, GAO provided information on weaknesses in general computer controls that support key financial management and benefit delivery operations of the Department of Veteran Affairs (VA).

What GAO Found

GAO noted that: (1) general computer control weaknesses place critical VA operations, such as financial management, health care delivery, benefit payments, life insurance services, and home mortgage loan guarantees, and the assets associated with these operations, at risk of misuse and disruption; (2) sensitive information contained in VA's systems, including financial transaction data and personal information on veteran medical records and benefit payments, is vulnerable to inadvertent or deliberate misuse, fraudulent use, improper disclosure, or destruction, possibly occurring without detection; (3) the general control weaknesses GAO identified could also diminish the reliability of the department's financial statements and other management information derived from VA's systems; (4) GAO found significant problems related to the department's control and oversight of access to its systems; (5) VA did not adequately limit the access of authorized users or effectively manage user identifications (ID) and passwords; (6) VA also had not established effective controls to prevent individuals, both internal and external, from gaining unauthorized access to VA systems; (7) VA's access control weaknesses were further compounded by ineffective procedures for overseeing and monitoring systems for unusual or suspicious access activities; (8) VA was not providing adequate physical security for its computer facilities, assigning duties in such a way as to segregate incompatible functions, controlling changes to powerful operating system software, or updating and testing disaster recovery plans to prepare its computer operations to maintain or regain critical functions in emergency situations; (9) a primary reason for VA's continuing general computer control problems is that it does not have a comprehensive computer security planning and management program; (10) the VA facilities that GAO visited plan to address all of the specific computer control weaknesses identified; (11) the director of the Dallas Medical Center and the Veterans Benefits Administration (VBA) Chief Information Officer (CIO) also said that specific actions had been taken to correct the computer control weaknesses that GAO identified at the Dallas Medical Center and the Hines and Philadelphia benefits delivery centers; and (12) VA plans to develop a comprehensive security plan and management program.