### A. Overview

With the advent of the INTERNET and escalating hacker activity
nationwide, the threat of compromise or damage to computer systems has
grown exponentially over the last few years. The SSA network
infrastructure is essential to timely delivery of critical SSA services.
Because of this the Agency strives to prevent any compromise or damage
to our systems, whether through inadvertent disclosure or modification
or loss of information.

Government policy requires prompt identification, reporting and
resolution of security incidents. Presidential Decision Directive (PDD)
63, Critical Infrastructure Protection, specifies that we "take all
necessary measures to swiftly eliminate any significant vulnerability to
**both physical and cyber attacks** on our critical infrastructures,
including especially our cyber systems and ... have a system for
responding to a significant infrastructure attack, while it is underway,
with the goal of isolating and minimizing damage."

OMB A‑130, Appendix III, also requires that agencies have a process in
place to provide help to users when a systems security incident occurs
and to share information concerning common vulnerabilities and threats.
All employees, SSA partners, stakeholders and contractors need to be
fully aware of the obligation to identify and report these incidents as
quickly as possible.

SSA has long had reporting procedures in place for various incidents.
The SSA Security Response Team (SSASRT) has been formed to better
address the newer dynamic threats against our electronic systems and to
assist the work force with handling systems incidents by centralizing
this activity in one functional unit. While all incidents should be
reported to the SSASRT, there may be additional reporting requirements
for incidents involving personnel and physical security. The SSA
Administrative Instructions Manual System (AIMS), Material Resources
Manual, Chapter 04 and General Administration Manual, Chapter 12,
contain the procedures for those incidents.

A more formalized incident response team can better respond to all
incidents and make sure that the broad range of issues which arise are
fully coordinated. It also ensures that SSA executives receive a
comprehensive assessment of impact on SSA as quickly as possible.

### Responsibilities

#### Office of Finance, Assessment and Management

The Office of Finance, Assessment and Management (OFAM) has overall
responsibility for SSA's Information Systems Security, Physical Security
and Protective Security Programs. The Office of Protective Security
Services (OPSS), Office of Facilities Management, is responsible for the
policies, program management and evaluation of the Agency's physical and
protective security programs.

**SSA Information Systems Security Officer**

The SSA Information Systems Security Officer (SSAISSO, **formerly
SSASSO**), OFAM, ensures that a systems security incident reporting
process, as part of an overall SSA security reporting process, is
developed and implemented in SSA. The SSAISSO provides guidance on
incident reporting to the Component and Regional Security Officers. The
SSAISSO is a member of the SSASRT. The SSAISSO is also responsible for
preparing quarterly reports to the Federal Computer Incident Response
Center (FedCIRC) on security incidents taking place during the previous
quarter.

#### SSASRT

SSA's Security Response Team, which reports to the Executive Staff, is
tasked with responding to incidents involving computer systems, Internet
and Intranet servers and Local Area Network Servers (LANs). The team is
also responsible for reporting major incidents to FedCIRC as soon as a
determination is made that a major incident is occurring.

These incidents or attacks may involve, but are not limited to, such
things as malicious code (virus, worm or Trojan horse); Email
bombardment (SPAMMING); an unauthorized change in system configuration
or discovery of an unknown 'hidden file'; repeated attempts to access
SSA's systems (Hacking) or a stranger's attempt to learn PINs and
passwords under false pretexts (Social Engineering).

**Component Security Officers**

**Regional Security Officers**

Component Security Officers (CSO) and Regional Security Officers (RSO)
report incidents for their respective components and, where appropriate,
work with the SSASRT and/or OPSS to resolve incidents.

**Managers**

Managers ensure that their employees are made aware of the reporting
procedures and the security policies in place to protect SSA information
systems, employees and SSA property. They are responsible for reporting
security incidents to the Network Service Center and for notifying the
CSO or RSO.

#### LAN Administrators

LAN Administrators, familiar with SSA systems, may often be the first to
discover a security incident. They are responsible for immediately
reporting these incidents to the Network Service Center and for
notifying their CSO or RSO.

**Users**

All employees and other systems users are responsible to report security
incidents. They must notify their manager or LAN Administrator
immediately. If the manager or LAN Administrator is not available, the
user must immediately report the incident to the Network Service Center
and notify the CSO or RSO.

**Federal Computer Incident Response Center (FedCIRC)**

In support of Presidential Decision Directive (PDD) 63 and the
Government Information Security Reform Act (GISRA), FedCIRC provides a
central focal point for incident reporting, handling, prevention and
recognition. The purpose is to ensure the government has critical
services available in order to withstand or quickly recover from attacks
against its information resources.

The primary purposes of the FedCIRC are to provide the means for Federal
agencies to work together to handle security incidents, share related
information, solve common security problems and to collaborate with the
[National Infrastructure Protection Center
(NIPC)](http://www.fbi.gov/nipc/index.htm) for the planning of future
infrastructure protection strategies and dealing with criminal
activities that pose a threat to the critical information
infrastructure.

# Security Incidents

Security incidents may involve suspected viruses, threats to persons,
attempted systems intrusions, unauthorized release of Privacy Act
information, theft of government or personal property, or any other
suspicious situation. This policy provides the procedure for reporting
those incidents.

> 1\. Information Systems Security Incidents

a\. Malicious Code

> Malicious code may be a virus, worm or Trojan horse and all are
> designed to do damage to data.
>
> A virus is a specifically programmed set of instructions intended to
> destroy, alter or cause loss of data. It can spread from one program
> to another, from one system to another [or]{.underline} from one
> computer to another. A typical computer virus copies itself into the
> operating software, [and]{.underline} executes instructions to erase,
> alter or destroy data.

Worms are similar to viruses in that they make copies of themselves, but
differ in that they need not attach to particular files or sectors at
all. Once a worm is executed, it seeks other systems to infect, then
copies its code to them.

> Trojan horses are not viruses. However, they are programs that contain
> destructive payloads, which pretend to be legitimate programs. They
> are spread when the user executes the program.
>
> See [Exhibit
> A](#exhibit-a---preventing-and-detecting-malicious-code-incidents) for
> information on preventing and identifying malicious code incidents.
> For current information about these incidents at SSA see the
> Information Systems Security Intranet site.

b.  Systems Intrusions

> SSA has in place many controls to protect our information from
> alteration, destruction, loss or disclosure. However, there still may
> be attempts to gain access to SSA systems.\
> \
> Systems intrusions may take various forms. They may include denial of
> Internet or E‑Mail services, unauthorized control or modification of
> WEB pages, vulnerability scanning, password cracking, sniffing, social
> engineering to gain system access and others. All suspected systems
> intrusions, or attempts, must be **immediately** reported to
> management.

2.  Physical Security Incidents

> SSA's physical security program protects personnel and facilities,
> materials, equipment and information against threats other than
> military action. The Office of Finance, Assessment and Management is
> responsible for the Agency's Physical and Protective Security
> Programs. The SSA Administrative Instructions Manual System (AIMS),
> Material Resources Manual, Chapter 04 and General Administration
> Manual, Chapter 12, contain the policies for these programs and
> procedures for reporting incidents.

3\. Allegations of Fraud, Abuse or Misuse\
\
The Social Security Act along with other Federal statutes requires that
SSA protect the integrity, privacy, and confidentiality of all personal
data and ensure the integrity of trust fund outlays for all benefits
paid under the programs it administers. Under the auspices of the SSA
systems security program, SSA takes precautions by utilizing policies,
procedures and controls to ensure that personal data entrusted to SSA is
not misused and that the programs are safe from abuse by the public and
the individuals who administer them.

The Program Operations Manual System (POMS) GN 04111 and GN 04112
contain procedures for detecting and reporting suspected program and
employee fraud. Employees can report suspected fraud cases to their
supervisors or through the Fraud hotline. The SSA Fraud hotline number
for reporting alleged or suspected [employee]{.underline} and
[program]{.underline} violations is 1-800-269-0271. SSA employees may
also report potential [program]{.underline} violations via the SSA-8551.
This form is not to be used for alleged employee violations.

# Reporting Procedures for Information Systems Security Incidents 

> SSA employees, contractors and members of the public may report any
> suspicious incident involving information systems. The procedures to
> be followed are:
>
> 1\. SSA Employees and Other Users of SSA Systems
>
> a\. Whom to Notify\
> \
> Notify the manager immediately. If the manager is not available,
> contact the LAN administrator. The manager or LAN administrator will
> contact the local/component security officer **AND** make a report to
> the Incident Response Help Line. The local security officer must also
> notify the regional security officer.
>
> In the event an SSA system user cannot reach either the manager or LAN
> administrator, they should contact the security officer and
> **IMMEDIATELY** notify the Network Service Center (NSC) Help Line**.**
> Select the option to "report a computer security incident" and ask to
> report a suspected computer incident.

+-------------+------------+--------------+------------+-------------+
|             |            | Users of SSA |            |             |
|             |            | Systems      |            |             |
|             |            | ![           |            |             |
|             |            | ](media/imag |            |             |
|             |            | e1.wmf){widt |            |             |
|             |            | h="0.7881944 |            |             |
|             |            | 444444444in" |            |             |
|             |            | height       |            |             |
|             |            | ="0.83263888 |            |             |
|             |            | 88888889in"} |            |             |
+-------------+------------+--------------+------------+-------------+
|             |            |              |            |             |
+-------------+------------+--------------+------------+-------------+
|             |            |              |            |             |
+-------------+------------+--------------+------------+-------------+
| Contact     | Manager    | Contact LAN  | SLC not    | Contact     |
| Manager     | not        | Admin        | available  | Security    |
|             | available  | istrator/SLC |            | Officer     |
| ![](med     |            |              |            |             |
| ia/image2.p |            | ![           |            | #           |
| ng){width=" |            | ](media/imag |            | ####### AND |
| 0.490277777 |            | e3.png){widt |            |             |
| 77777776in" |            | h="0.6513888 |            | ![](me      |
| height="    |            | 888888889in" |            | dia/image4. |
| 0.608333333 |            | height       |            | png){width= |
| 3333333in"} |            | ="0.50277777 |            | "0.62222222 |
|             |            | 77777778in"} |            | 22222222in" |
| Manager     |            |              |            | height="    |
| Will:       |            | SLC Will:    |            | 0.653472222 |
|             |            |              |            | 2222222in"} |
|             |            |              |            |             |
|             |            |              |            | NSC Help    |
|             |            |              |            | Line        |
+-------------+------------+--------------+------------+-------------+
|             |            |              |            |             |
+-------------+------------+--------------+------------+-------------+
|             |            |              |            |             |
+-------------+------------+--------------+------------+-------------+
| Contact     |            | Contact      |            |             |
| Security    |            | Security     |            |             |
| Officer     |            | Officer      |            |             |
|             |            |              |            |             |
| #           |            | ######## AND |            |             |
| ####### AND |            |              |            |             |
|             |            | NSC Help     |            |             |
| NSC Help    |            | Line         |            |             |
| Line        |            |              |            |             |
+-------------+------------+--------------+------------+-------------+
|             |            |              |            |             |
+-------------+------------+--------------+------------+-------------+

> b\. What to Report

-   Your name, phone number and E‑Mail address

-   An alternate point of contact (if appropriate)

-   Location of affected machine

-   Hostname and IP address of affected machine

-   Data or Information which is at risk

-   Hostname and IP address of source of the attack (if known)

-   Any other information you can provide that will assist in analyzing
    the incident

2\. General Public\
\
If any member of the general public reports an incident to any SSA
employee or to the SSA-OIG Hotline, the person receiving the report must
call the NSC Help line.

> 3\. NSC Personnel

NSC personnel will complete a SSA Security Response Team (SSASRT)
Incident Report and contact the SSASRT member on call.

4.  SSASRT Personnel

The SSASRT receives reports of suspected incidents and takes appropriate
action. The SSASRT may refer the report to a Regional (RSO) or Component
(CSO) Security officer for resolution. The SSASRT will notify the
reporting individual that the report has been referred to a RSO/CSO. The
SSASRT will maintain a copy of the Incident Report. The SSASRT will
follow-up with the RSO/CSO and maintain a report of the results.

####### Reporting of Security Incidents to Outside Agencies

All Federal Agencies are required to report on security incidents to
FedCIRC. These reports are used by FedCIRC to build a government-wide
picture of attacks against government cyber resources, and to aid in
developing government-wide responses to incidents.

The SSAISSO develops a quarterly report to FedCIRC on incidents at our
Agency. In the case of serious incidents, SSA reports to FedCIRC during
the incident to facilitate FedCIRC's responsibility to coordinate
inter-Agency responses. To read more about FedCIRC, go to
[www.fedcirc.gov](../www.fedcirc.gov).

**F. References**

#### Legislation

> Government Information Security Reform Act of 2000

#### Office of the President

Presidential Decision Directive 63 -- "Critical Infrastructure
Protection"

#### National Institute of Standards and Technology

ITL Bulletin, "Computer Attacks, What They Are and How to Defend Against
Them", May 1999

# Office of Management and Budget

OMB Circular No. A-130,\"Management of Federal Information Resources\",
Appendix III, \"Security of Federal Automated Information Systems\".

**Social Security Administration**

**Administrative Instructions Manual System**

Chapter 04, Property Management

Instruction 05, *Reporting Lost, Stolen, or Damaged SSA-Controlled
Personal Property*

Instruction 50, *SSA Physical Security Review Program*\
Instruction 54, *Physical Security and Personal Protection*

Chapter 12, Field Administration

Instruction 01, *Protective Security Program*.

**Program Operations Manual System**

GN 04111 Detecting and Developing Program Violations

GN 04112 Reporting Employee Violations

###### Exhibit A - Preventing and Detecting Malicious Code Incidents

Everyone at SSA has a responsibility to take steps to prevent malicious
code from entering SSA systems. **The Office of Telecommunications and
Systems Operations** (OTSO) is responsible for procuring the site
license for the SSA-approved anti-virus software. For IWS/LANs, OTSO
installs the software on the IWS/LAN servers and provides the periodic
upgrades

The

**Office of Information Management** (OIM) has management oversight
responsibilities for the End-User Computing Information Center (IC) and
assures that the IC provides support for the SSA-approved anti-virus
software. **The Information Center** makes available the latest version
of the approved anti-virus software, for which SSA has a site license,
as well as the most recent signature file updates. Information on
viruses can be found on the IC Intranet site. In addition, the IC staff
helps with removal of a detected virus, provides new information on
viruses, and keeps track of technical information discovered during
virus attacks.

# Management is responsible for ensuring that LAN administrators install the SSA-approved anti-virus software and ensure that updates are timely for all servers and workstations. Local management should ensure frequent screening to ensure a virus-free environment. Managers are also responsible for preventing the spread of false virus rumors. Managers should work closely with the CSO/RSO to ensure that employees are fully informed of SSA policies regarding the identification and reporting of viruses. They also report virus incidents to the Network Service Center Help Line and the CSO or RSO.

**Users** are responsible for using only the SSA approved anti-virus
software obtained through SSA licensing procedures. **Users may not
disable the virus-scanning software**. They should frequently scan PCs
and all files and media received from others to prevent the spread of
viruses. Users must also report suspected virus attacks to their
managers.

##### [Virus Prevention]{.underline} 

1\. Anti-Virus Software

**All SSA personal computers (PC) must have the current SSA standard
anti-virus software installed** **as well as the latest virus signature
file updates**. The only approved SSA anti-virus software is that for
which SSA has a license. Some personal computers (PC) may be delivered
with another anti-virus software already loaded on the system. While
this software may be used as a supplement to the SSA-approved software
to screen for viruses, the anti-virus software distributed and updated
by OTSO is the Agency standard. SSA receives updates from the vendor and
OTSO tests the software before distributing it to the IWS/LANs. The IC
makes the file updates available on its Intranet Home Page.

2\. Ensuring Virus-free Software

Unlike many other security threats, viruses can enter a given system
accidentally. For viruses to spread, they must be \"transported\", by
file or through E-Mail. An executable file or other file, such as a Word
document or Excel spreadsheet, attached to an electronic mail message
may contain viruses.

> You may also be introduced to software through magazine articles,
> computer conventions or others that you believe would be helpful to
> SSA\'s daily operations.
>
> **Before you use any diskettes or other media on SSA computers, you
> must screen them for viruses using** **SSA-approved virus-screening
> software.** This software should be installed on your PC, or available
> through your LAN. If you need assistance, contact your LAN manager or
> security officer. The IC can also provide assistance with installation
> or updates of the virus-scanning software.
>
> 3\. Avoiding Problems

To reduce the risk of virus problems occurring:

• lock removable media and software when not in use.

• in cases where you need to bring removable media back to the office
from another location, the media must be scanned before using on any SSA
system.

• use caution when downloading programs from internet sites. Generally,
this is not a good practice unless the sites are trusted, such as other
state and federal government sites or well-known commercial sites.

-   save attachments to Email messages to a file and scan before
    viewing. Often a virus, Trojan horse or worm will be disguised as a
    legitimate program and sent as an attachment to electronic mail. The
    background virus scanning option must be enabled so that opened
    attachments will be scanned before executing. The best insurance
    against a virus is saving an attachment to disk and scanning that
    file [before]{.underline} opening. **UNDER NO CIRCUMSTANCES IS THE
    VIRUS-SCANNING SOFTWARE TO BE DISABLED.**

• do [NOT]{.underline} run or use demo software until it has been
screened

• make frequent backups of your files to removable media; and

• frequently scan PCs and other media using the SSA approved anti-virus
software. Although viruses can occur at any time, some viruses execute
on certain dates only.

### [Virus Identification]{.underline} 

1.  Types of Viruses

-   Boot viruses place their code in the sector whose code the machine
    will automatically execute when booting, so that when the machine
    boots, they load and run. After they are finished loading, they load
    the original boot code, which they have previously moved to another
    location.

```{=html}
<!-- -->
```
-   File viruses attach to executable program files in such a way that
    when you run the infected program, the virus code first executes.
    After the virus is finished loading and executing, it loads and
    executes the program it has infected.

```{=html}
<!-- -->
```
-   Macro viruses are file viruses that attach their macros to templates
    and other files in such a way that, when an application loads the
    file and executes the instructions in it, the first instructions to
    execute are those of the virus.

```{=html}
<!-- -->
```
-   A companion virus attaches to the operating system, rather than
    files or sectors. In DOS, when you run a file named \"ABC\", the
    rule is that ABC.COM would execute before ABC.EXE.\
    A companion virus places its code in a COM file whose first name
    matches the name of an existing EXE. You run \"ABC\", and the actual
    sequence is \"ABC.COM\", \"ABC.EXE\"

```{=html}
<!-- -->
```
-   Worms are similar to viruses in that they make copies of themselves,
    but differ in that they need not attach to particular files or
    sectors at all. Once a worm is executed, it seeks other systems -
    rather than parts of systems - to infect, then copies its code to
    them.

-   Trojan horses are not viruses. However, they are programs that
    contain destructive payloads, which pretend to be legitimate
    programs. It is spread when the user executes the program.

2\. Computer Virus Symptoms

This is a list of some symptoms that may indicate the presence of a
computer virus. Some symptoms occur only once while others occur while
the virus is still spreading. Watch for:

• programs taking longer to start, or running slower, than usual;

• unusual displays, including \"scrolling\" parts of the screen, the
unexpected appearance of \"bouncing balls\" or odd messages;

• unexpected sound effects;

• unknown new files or directories; or loss of files or directories;

• increased file size [or]{.underline} a sudden decrease in free space.

3.  Virus Characteristics

Viruses normally have multiple characteristics. Their characteristics
are:

-   **Memory Resident:** Loads much like a TSR staying in memory where
    it can easily replicate itself into programs of boot sectors. Most
    common.

```{=html}
<!-- -->
```
-   **Non-Resident:** Does not stay in memory after the host program is
    closed, thus can only infect while the program is open. Not as
    common.

```{=html}
<!-- -->
```
-   **Stealth:** The ability to hide from detection and repair manifests
    in two ways.

> Full - Virus redirects disk reads to avoid detection.
>
> Size - Disk directory data is altered to hide the additional bytes of
> the virus.

-   **Encrypting:** Technique of hiding by transformation. Virus code
    converts itself into cryptic symbols. However, in order to launch
    (execute) and spread the virus must decrypt and can then be
    detected.

```{=html}
<!-- -->
```
-   **Polymorphic:** Ability to mutate by changing code segments to look
    different from one infection to another. This type of virus is a
    challenge for ant-virus detection methods.

```{=html}
<!-- -->
```
-   **Triggered Event:** An action built into a virus that is set off by
    the date, a particular keyboard action or DOS function. It could be
    as simple as a message printed to the screen or serious as in
    reformatting the hard drive or deleting files.

```{=html}
<!-- -->
```
-   **In the Wild:** A virus is referred to as \"in the wild\" if is has
    been verified by groups that track virus infections to have caused
    an infection outside a laboratory situation. A virus that has never
    been seen in a real world situation is not in the wild, and
    sometimes referred to as \"in the zoo\".

The steps you take to identify, isolate and resolve computer viruses
[and]{.underline} to prevent viruses from entering SSA\'s systems depend
on your role and responsibilities.

Do not use these procedures under the following conditions:

a\. False Alarms

> Because software \"bugs\" and [user errors]{.underline} are more
> common than viruses, it is important to avoid unfounded rumors of
> viral infections. \"False alarms\" can be unnecessarily disruptive. Do
> [not]{.underline} use this procedure when you have a non-virus
> situation.

b\. Virus Hoaxes

In recent years, there has been a proliferation of hoaxes disguised as
virus warnings. They are usually transmitted through E-Mail and contain
messages that play on people's fears, warning the reader of impending
doom. These messages urge the recipient to send the alert to as many
others as possible. They are NOT viruses, but may cause work disruption
through false scares, or overloading of SSA\'s E-Mail system. They
include:

-   AOL4Free

```{=html}
<!-- -->
```
-   PKZ300

```{=html}
<!-- -->
```
-   Deeyenda

-   Elf Bowling and Frogapult

-   GESCHENK (cokegift)

```{=html}
<!-- -->
```
-   Ghost.exe

```{=html}
<!-- -->
```
-   Good Times

-   Join the Crew

```{=html}
<!-- -->
```
-   Irina

```{=html}
<!-- -->
```
-   Penpal

-   Win a Holiday

-   Wobbler

All such \"virus warnings\" should be immediately reported to your
Component or Regional Security Officer and your local manager. **DO NOT
TRANSMIT THE MESSAGE TO OTHERS**.

The CSO/RSO should contact the IC, which maintains information on these
virus hoaxes, and take appropriate action.