STATE COMPUTER SECURITY

INSPECTOR GENERAL 
OFFICE OF 

OFFICE OF ANALYSIS AND INSPECTIONS 
DECEMER 1988  OFFICE OF INSPECTOR GENERAL

The mission of the Ofce of Insper Gener (010) is to promote the effciency, effective
progr 
ness and integrty of  in the Unite States Deparent of Health and Human Services 
(HS). It dos this by developing method to detet and prvent frud, waste and abuse. 
Secta 
Crate by statute in 1976, the Inspto Genera keeps both the  and the Congrss 
prgr 
fuly and curntly inormed about  or maagement prblems and reommends cor
peor 
retive action. The 010  its mision by conductig audits, investigations and inspec
apprxily 
tions with  1.200 sta strtegicaly locate arund the countr. 
OFFCE OF ANALYSIS AND INSPECll0NS 
re 
Th  the 
is pruced by the Ofce of Analysis and Insptions (OAl, one of the 
with 
major offces  the 010. The other two ar the Ofce of Audit and the Office of Inves
tigations. OAI conducts insptions whih ar tyicaly short-te studies designed to deter
mie prgr effecveness, effciency and vuncrilty to frd and abuse. 
THIS REPORT 
re 
The  is entied "Sta Coute Secmittyh."  It was conduct as follow-up to a study of 
compucteo retlatt  frud which found that one- of the frud involvig Ooverent funds 
Th sty 
wer  on Sta and loc compute systms.  sought to identi State ef
steg fedy-
for to pla and implement compute securty on  admini funded 
prgr.  systems 
In 
Th sty was prpar by the Regional  Gener Ofce of Anysis and Insp
Papatg 
tions, New Yor Region.  on the prjet we the followig: 
New York 
Le)  Al 
Jack Molnar (Pjet  Stubbs 
Lena 
John Trazyk  Czjka 
Wi11am 
Aprl 
Dallas 
Raph Tunell
 STATE COMPUTER SECURITY

Kusrow 
Richard P. 
INSPECTOR GENERAL 
1EC& ';88 
OAI-02-800630  "" 
EXECUTIVE SUMMARY 
BACKGROUND 
The 
PUlse of 

securty On systethmiss  inspection was

to identify State effons to

reuirnts ar  admnisterig f

th  having On the Statesderay funde Pro=""aplnan d and implement comPUter
of cOIDuter to assess the effect Federal
efon. It 

relate  involvig  Was  intiate out of an

ci  On Integrty and Efcien&acdsy, Wer COlFIed tt  aWarness that
fuds, as  identied by the Prdent One-
Ther we  On Stae cOIDUte syste.  s COun-
two phases of activity in 
tcoom piutde esecnurttyi  
 Was  reviwed and mthse tiingpse ction. Initiy, Fed 
relevant  were conducte with  guidace to 
reuil1nts an IInitog  FeStdate s On 
Sstuyt  ap shPoul rogrfsoc. s On the Aid to Fames  apprprite  stas
With Dprticees. pendnItt  CWashinthen detered 
that the 
, Mecaid an 
The send pha  FOO 
sPuroreys soifg  S(tAaD P) ainclnude  prgviirts  stto a1 2 Staes to dicuss compute securty with automatic 
ofcial who Wer repoThnis sibWlaes   not an audit of the 
sor a varety of securty 
 data 
sha 
envimnnts. The  fo the systems.  Sta syste,

data  but  rather a 
the State and 
 celonctael  saitneds . use of enhance fudisge.l eActtio n crtea inTche lUSdtate  proWerg serle cted to
 as
eah State siz, use of 
, dicussions we 
held at both 
FINDINGS 
Federa SecUr Guidae Has 
limid 11I/1t 
On Stas
Sta comUte seurty effon 
Fed 
mon  vared signficantly 
P1 ca gndace and 
monitog, and 
mied leamvg teh  of intSetsatt eisn  seurty
for  such  Vartion.  visite Th"e  Plac    of com
Agrultu  (USDA)  and State legiAludats tive by the  Gene for th U  to be the 
the dee1OPl1nt of State 
 pr=.p.r sor appe  S. DeParent of 
securty progrs.  to be th 
SCty  States without such  facrs inuencing 
I'  inuence had 
less organze
Examles  of th lite imact  Fed 
of 
we ablet htoat  nthOyt  fWiegr u nwar of any Fesdeu crtoy Uguted a ar 
Fed  that 3 of the 
Rtheev enue Serrvecuei r
ments wore r etono ugnendetiro ton s reultig &seuroty  FeSlada,   a12n S taotens l
y 4v Sistaittees
(IS) gudace  be of any value.  IDnitog. SOI1 
Th  said 
reguations. Seven 
 in the Incom an E.g1bilty
exception  th Inteal
burnso,  as  weU  Staast e tionk apPsmtrrngi  exception to thse reuimVeetrst iboen uSsyeS Wats m (IVS)
to the 
 IEVS  use of IRS data  they ar too  vir-
When asked what they believed would be an apptrhoipsr iaartea .F Tedheerya  wroalen,t  Sctoamter eagheenncsiievse  wreegreu la-
tually unanus in tpherio dgesrisr  wfoirt ha ssusipsptoacrten gin g uida  . They ar split about the level of 
tions, common to all 
field visitS, the others preferred the submission of vulnerabilty as-
monitoring; hal opted for 
Secrta for Management and Budget (ASMB) issued proposed
sessmentS. The Assistant  stada for Sta computer secuty on fedraly funded 
regutio  that include a common 
though the submission of vulnerabilty assessments. 
systems and monitoring 
Controls 
Stats Have Good Access 

termnal identifiers and 
identication numbers, 
the fonn of passwords and  the State securty 
Access contrls in 
audit trls of persons who had used the system ar the strngths of  ' abilty to create or 
progrs. Vutaly al States used access controls to limit employees
use. However, despite the apparent-
mod  keep a log of trsactions and system 
the States, a potential 
fies, and to  acss contrl effor note among 
implemente 
ly well designed and 
of personal data was noted in a number of States. 
vuerabilty to the protectio 
Whe this pratice does not 
Firt, may States issue generic passwords for query function. reords, it does crate oppor
unauthorized personsl tDo vmiewt oor  prit out climenat y Sta ar intrucing, or in
dictly permt  Secondy, 
eaily 
tuty for acces which is not 
of, personal computers which have access to tpher oclgienr,t  data bases. Such 
crasing the use  as opposed to  crates the oppor
crated for sta offces 
access, which is usualy 
quantities of data 
tUity for downoading large 
Strengthen Security in Specific Areas 
Stats Need to 
absence of some commonly ac
documente by the 
State computer securty is 
Weakess in 
cepted pratices:

spifc computer securty plan fully 
Tb-quarrs of the States visited do not have a 
implemente 
seurty at remote sites. 
the  monitore computer 
Only  States have plans for, and 
their security.
rik analyses to evaluate 

Only twO States do vulnerabilty assessments or 
backgrund checks. 
Only four States do personnel security 
th 
tested. 
plas have been 
on paper, but only 
Contigency plans generay exist  RECOMMENDATIONS 
Durg  tWice reommended chan
the course of this inspection, the Office of Inspector General 
Makng (NPRM), "Automatic Data Processing Equip
ges to ASMB' s Notice of Prposed Rule 
" The recommendations

ment and Services; Conditions for Federa Financial Parcipation.

included: 
Modying the NPRM to specifically require that the States have a single security plan. 
Addg a requirment for review of data securty in addition to physical security 
reviews. 
Establishing a clearly defied relationship between generic securty requirements and 
progr-specific reuirments. 
The recommendations listed above were incorprated into the NPRM. We recommend that 
stada 
Deparnt  in fmal form with a risk 
the  issue the common computer securty 
analysis requiment. Addtionaly, monitorig or review proedures for these regulations 
should be established.  .... ....... ......  ........  ................................... ................................................
.......................... ....... .................... ......................................... ..............
TABLE OF CONTENTS

EXECUTIVE SUMMARY 
INTRODUCTION... .................... ....... .................... ........... 

.......................................... 1

Pu 
rpose 
Backg ro und 

........................................ (I........................ ..................

Methodo logy.......... 

FINDI NGS 
................................................................................................................. 4

RECOMMENDATIONS .......................................... 
................................................... 9

AG ENCY COMMENTS................................................ ..............................................

1 0  INTRODUCTION

PURPOSE 
The purose of this inspection was to identify State effons to plan and implement computer 
securty on systems admnisterig federaly funded progra ns, and to assess the effect Federa 
requirments ar having on the States ' effons. 
BACKGROUND 
While the securty of Federa computer systems has long been monitored by both Congrss 
and the Executive Brach, it is only recently that attention has begu to focus on State com
puter systems use in the adstration of fedraly fuded program. Beyond the fact that 
adister 
signcant Fedral funds are used to develop and  these systems and ar expended
thugh 
these systems, a number of recent events have rased questions as to the qualty of 
State computer securty. 
In 1985, the Prsident s Council on Integrty and Efficiency (PCIE) reuested the Inspector 
(H) 
Genera (10) for the Deparent of Health and Huma Servces  conduct a study of 
computer-related frud in governent agencies. That inspection include interviews with 46 
perptrtors to lear about their individual cres and the system vulerabilties that existed 
cres 
which alowed these  to occur. Al of the perpetrtors held 
positions with some degree
of involvement in the agency s computer system. A number of the State and local agency per
petrtors charcterize their agency s existig computer seurty and internal controls as weak 
cre 
and, therefore, vuerable to the tye of  they commtted. The study also found that 43 
percent of these State and local employees had previous cral reor when hired by their 
agency. 
Congrss has also exprsse concern that computer securty systems have inadequate contrls 
which leave them vulerable to improper use and inadeuate proteCtion of privacy. Several 
adss 
legislative intiatives have been introduced which  the problems involving the securty 
progr. 
of computer systems in federay funde  The Office of Technology Assessment, 
the research ar of Congrss, issued a report which wared that the opportities for un-
authorize access to and use of governent computer data have incrased and also identified 
the computer matching perfored by \State agencies as an ara where protection of data may 
be insufcient.

The U.S. Deparent of Agrcultu s (USDA) 10 found computer system vunerabilities at 
State and local agencies adsterig Foo and Nutrtion Service (FS) progrs. Its 1984 
audit of 13 non-Fedra computer systems adisterg Foo Stap progrs found weak
leadg 
nesses in al of them,  the 10 to consider these systems highly vulerable. It also 
report 
that FNS had not issued any securty guidelines for non-
Federa systems and needed 
to improve its monitorig of these systems.  Another concern is the relative lack of Federa guidace for State computer securty as op
posed to Federa systems. Federal standas for Federal systems, which run thousands of 
pages and include NSDD-145, Office of Management and Budget (OMB) 
Cirulars A-130 
and Federal Inormtion Processing Standa (FIS) publications, requi each agency to 
have its own computer securty program. These Federa computer securty progrs ar
monitored by individual agencies and OMB though the A-123 process, by Inspectors General 
internal reviews, as well as by the General Accounting Office. 
stada 
By comparson, Federa  for State systems ar a patch-work of uncoordnated regula
tions. Each Federal agency, in overseeing the State adistration of its programs, issues 
stada 
guidelies; only some of them include  on computer securty. The agency may also 
issue dierig stadads dependig upon whether or not the State receives enhanced (Le., 75 
stada 
or 90 percent) Federa fundig for its ADP system. Those Fedra  which do exist 
var in degr and tyes of securty reuired, and may someties duplicate or confict with 
each other or with State requirments. Ths may present compliance diffculties for those 
States which process more than one Federa program at the same computer center. 
XI 
Among the varous program, Medicaid (title  of the Social Securty Act) has had regula
tions in place for almost 15 year providig for enhanced Federal Financial Parcipation
(FF) for the Medcaid Maagement Informtion System (MMS) for States reuestig it.
stada 
However, an amendment that reuired the development of securty  for MMS, not 
stada 
enacted unti 1980, alows States to conduct internal reviews using  developed by the 
Deparent. A yearly review by the Health Car Financing Admnistrtion (HCFA) of the 
States ' systems was requird unti 1985 when the Consolidated Omnbus Reconciiation Act 
stada 
(COBRA) revise the frquency of reviews to once every 3 years. The  issued to the 
States ar genera in natu and the specifc development of State secmity criteria is left to the 
States. 
Prgr 
With regar to the Aid to Famlies with Dependat Chidrn  (AFC), a general state
ment reuirg safeguar for inormtion existe for may years, but no discussion of State 
computer securty existed unti Public Law 96-265 was enacted, with the regulations effective 
in 1981. Public Law 96-265 alowed States to  fundig for the development 
reuceset ren hanced 
computeri  stada, 
of a  informtion system which met  includig secmity against
unauthor  reui 
access to or use of data The law also  the Deparent to monitor the 
stada. 
system s compliance with the 
Within USDA, the FNS, which monitors the Foo Stap progr,  ADP Security 
issued an 
which prvides States with genera automatic data processing (ADP) security 
Guide 
gudelies for developing their own seurty progrs. These stada, which were 
develope as a result of the 1984 audit noted above, apply to States with or without enhanced 
fundig. 
progr 
A reassessment of computer system securty  of States is now occurg due to the 
passage of Public Law 98-369, the Deficit Reduction Act of 1985 (DEFRA), which crated 
the Income and Eligibilty Verification System (IEVS). Ths law reuirs AFC, Medicaid,  ' "...
Foo Staps and other program to receive income information from the Internal Revenue 
Service (IS) and Social Securty Admnistration (SSA), and to use it in determning 
applicants ' eligibilty for progr  progrs were requird to 
benefits. All  sta using IEVS by 
September 30, 1986. Both the IRS and SSA have personal data safeguarding guidelines 
which al agencies obtaiing inormation from them must follow. The IRS  Tax Informtion

Security Guidelines 
 goes into specifc deta on areas of computer securty and record 
safekeeping. It also requirs a periodc report to the Federal fundig agency on the status of 
safeguarg  Progr 
proedures. The SSA issued securty instrctions in its  Operations 
Manual which apply to States that obtan informtion from the Benefit and Earings Data Ex
change (BENDEX) or Supplementa Data Exchange (SDX) systems. However
, SSA is cur
rently in the proess of changig these requirments by adoptig the IRS requirements. 
To ad to the concern at the Federa level, States ' assessments of their own securty progrms
offer litte reassurance. The National Association for State Information Systems (NASIS) 
stated in its 1984-1985 report that States  data securty appear to be far from an ac
complished fact and that progrss in establishig physical securty at States ' data centers does 
not appear to have been made. " Of the States reportng as par of the NASIS surey, half
voluntere that their data centers do not have a seurty plan. 
METHODOLOGY 
1bere were two phass of activity in ths inspection. Intialy, Federa gudace to States on 
computer securty was reviewed and meetings were conducted with appropriate Federal staffs 
identi 
to  relevant requirments and monitorig pratices. Based upon these activities, it was
detemred that the study should focus on the AFC, Medcaid and Foo Stap progrms. 
The second phas was to visit 12 States to discuss computer securty with ADP and program 
sta. The States were selected to assur a varety of securty envirnments. The selection
crte include progr size, use of shar data centers and use of enhanced funding. At 
Sta, 
each  discussions were held at both the State and local sites. The States visited were: 
Caorna 
Florida  Georgia
Ilois 
Marland  Michigan 
New Jersey  New York  Pennsylvania 
Texas  Vermont  Washington  FINDINGS 
Stat Computer Systems and Operatng Environments Var 
Unlike many Federal agencies or the Medicar caners and intennediares, not all State human 
service agencies own and operate their own computer systems. Six 
of the 12 States visited 
operated though a centralzed ADP agency. These agencies, which may be peer agencies to 
the human service agencies or components within a larger admnistrative 
servces agency, 
house and operate the State computer systems. Among the States we visited, the centralzed 
ADP agencies served frm 32 to 61 other agencies besides the human service agency. While 
this situation is not a problem in and of itself, it has implications for the implementation of 
progr 
specifc regulations and guidelines that relate to computer systems such as computer 
securty. 
Firt, these centraled ADP agencies have their own operatig rules and regulations as well as
adtrtive 
systems that addrss computer securty. Often these rules and systems 
ar the 
result of State law or policy. Second, because as many as 10 
dierent federay funded 
progrs 
are served by some of the centtd ADP agencies, the ADP agencies are potential
ly obligated to be in compliance with al of the varous Federa agency requirements. The lack 
of Fedra recognition of this workig envirnment has crated a problem for some States. 
progr 
Specifcally, the IRS securty reuirments under IEVS reuir the  officials to per
sonaly supervse the processing of the IRS tapes. However, they do not have access to the 
progr 
centr data center. Under nonnal operatig proedurs,  officials would simply send 
a tape to the data center for pressing. In practice, States appear to be ignoring the IRS re
quiment because it is not prctical. 
On the other hand, tWo of the centrzed ADP agencies reponed that they were unawar of 
any Fedra computer securty requiments that might apply. Th occur for two reasons: 
f1It, because of uneven and someties weak Fedra monitorig of progr-specific com
puter securty reuirments; second, because Federa requirments ar, by design, communi
cated to prgr sta in the agency adisterig the human sece progr. 
Therefore, the 
progr 
agency becomes an intennediar with the centr ADP agency and must also attempt 
to encourge or assur its compliance. 
Secur 
Federal  Guidance Has Limited Impact On States 
Whle al States were awar of the nee for computer securty and had securty progrs 
place, computer securty effort vared signifcantly between the States visited. This is due to 
the lack of common Federa guidace and monitorig, and mied levels of interest among the 
States in computer seurty. 
For example, the Famy Suppon Admstrtion (FSA) has securty stada that must be ad
drssed in plans for, and met in the certfication of, Famy Assistace Management Infonna
tion Systems (FAMS) which receive enhanced fundig. However, since 32 States are in the  planning or development stage and 10 States are not seeking such a system, most States 
curntly not covered by these requirments. Securty requirments for non-enhanced systems 
vialy 
are  non-existent in that they only speak to protectig personal data. The FSA per
forms some  ad hoc 
 reviews of securty by fundig ADP audits conducted by outside consult
ants where vulerabilties are suspected. 
The HCFA has MMIS securty stadads, and these ar regularly reviewed. However, since 
MMs ar 
most  contrcted to private agencies, the reviews rarly include the State systems. 
Also the gudace to remgionialy of fces, which conduct these reviews, focuses primarly on
clai 
proessing and  on eligibilty systems. Addtionally, in the most recent 
reviews for 8 of 12 States in this study, computer securty stadads were documented 
deemed met, " meang they were not actualy reviewed because they had been met in an ear
lier review. 
The USDA/S issued a comprhensive computer securty guide to State agencies in 
Februar 1986 as a follow-up to the USDA/O' s review of computer securty in 13 States. 
Ths guide, however, does not have the force of law and has largely ben implemented and 
monitore by corrspondence.

The SSA had a requirment unti September 1986 for each State receiving BEND EX data to 
have a secmity offcer and a wrttn, comprehensive seurty plan which was to be submined 
However, it appear that SSA has not implemented these securty requirements, ac
to  SSA. 
cordig to the States visited in ths inspection. 
The IRS' ''Tax Inonnation Securty Ouidelines " now apply to State agencies because of the 
IEVS reuiment. Based upon Internal Revenue Cod reuirments to safeguard tax data, 
requi a 
they  self-assessment of data securty that includes a review of computer securty. 
States report that the IRS requiments ar inappropriate and burnsome for the puroses of 
wi 
IEVS. A few States reponed that they  use a libera interpretation of the IRS guidelines 
unti "caught. 
Audits by the USDA/O and State legilative prssur appear to be the major factors influenc
progr. 
ing the development of State securty  States without such inuence had less or
ganze securty progr. For example, only 4 of the 12 States have a peonnel securty 
prgrs. 
component to the computer secmity  (peronnel securty is a madated component 
of Federa computer securty progrs.) In each of these four instaces, personnel securty

was intiated as par of the corrective action plan resultig frm the USDA/O audits. 
Only two States did fonnal risk analyses on their systems; in both instaces they were man
dated by the State legislatus. Two State legislatus madated the formt of the State com
adtrtor 
puter seurty plan. As one centr ADP  pointed out: "they (the State 
Legislatu) control our budget and our agencies' budgets. We do what they tell us to do. 
The most common computer secmity problem note by State ADP offcis was the lack of a  management commtment to securty. While this is not a problem unique to States or even the 
public sector, legislative concern, in at least 2 of 12 States, appear to have assured a manage
ment commtment. 
An example of the limted effect of Federal guidace is the fact that 3 of the 12 States visited 
reported that they were unaware of any applicable Federal computer securty stadads. All 
States reported that they were unawar of the BENDEX requirments; ths is understandable 
since it appear SSA never fonnally implemented them. A BENDEX computer securty re
quiment cals for States to have a Securty Action Plan (SAP) and to submit an annual 
evaluation of the SAP to SSA as a condition of receiving BENDEX and SDX data. Copies 
the SAP and evaluations for each of the States visited were requested of SSA. The SSA has 
faied to respond.

Although eight States reported computer securty monitorig by HCFA, and four each by FNS 
and FSA, only four recaled findigs or recommendations resultig from this Federal monitor
ing. The most commonly reported finding was the alady noted lack of personnel securty 
found by the USDAlG. Other problems noted wer the lack of testing of contingency plans 
or the lack of risk analysis. Although States were most awar (8/12) of HCFA visits, only one 
noted any reommendations resulting from HCFA monitog, a concern regarg the use of 
IEVS data A liely reason for the lack of fidigs resultig frm the HCFA monitoring is that 
durg 
HCFA did not always review computer securty  its System Performce Review (SPR) 
monitorig visits. For eight of the visited States, HCFA demed securty satisfactory and did 
not review it since it had passed review in the past It should be noted here that while only 
eight States reported HCFA monitorig visits, HCFA prouced monitorig report for al 
States. 
When asked about problems with Federa semity gudace, only five States offered any com
ments. One imort commnt was with regar to IRS' gudace in the IEVS reguations. 
Seven States took strng exception to these reuiments as being too burnsome, as well as 
inapproriate to the IEVS use of IRS data One State offcial said, "If we had to handle and 
use IRS data as IRS gudelies suggest, the use of IRS data would be unworkable. " Another 
offere ''Te IRS reuirments to destroy tape by cuttg the tape every so many inches, or to 
ru IRS tapes, shut down the system, veri JCL and then resta the system cold are anti
quated and costly. " There have been, and contiue to  ASMB to balance 
nee  be, effort by  HHSI 
IRS  to assur that ta data is protected with States ' needs to implement IEVS in an eff
cient maner. 
When asked what they believed would be an appropriate Federa role, State agencies were vir
unanus 
tualy  in their desir for assistace in this ara. The State agencies want a com
progr, 
prehensive set of minimum stadas, common to al  and to have supportg 
guidace. In fact, it should be note that a number of States ar actively lookig for a com
stada 
puter semity  and requested such guidace frm the inspection team States ar, 
however, split about how they would like to se the monitorig done. Whe half opted for 
monitong site visits, the others preferr the submission of a 
rik or vulnerabilty assessment. 
(Some note that the lattr could be done by a State audit agency.) The ASMB has issued a  " "
proposed reguation that includes a common stadad for State computer securty on federaly 
funded systems. It includes monitorig through the submission of vulnerabilty assessments. 
It should be noted, however, that only two of the States visited did 
vulnerabilty assessments 
us voluntay. 
and both were reluctat to shar them with 
Stats Have Good Access Controls 
Access contrls in the form of passwords and ID numbers, termal identiers, and audit trls 
of persons who had used the sylsittem  are th strngts of State seurty programs. VIrually all 
States use access contrls to  to their job responsibilties, employees abilty to 
crate or
mod 
fies, and to keep a log of trsactions and system use. States report that their use of 
trs 
contrls and audit  have developed out of a long hitory of establishing eligibilty and 
authorizig benefits thugh a deentrze operation. Thus, with the advent of automation it 
was logical to build such controls intO their computer systems. Seven of the States use com
mercial access control softwar such as "RACF,  ACF II," or Top Sect, while the others 
develope their own. 
vialy 
More specifcaly, the access contrls  always consiste of both employee specific 
Soc 
password and an ID. The latter was often the employee  Securty number. Ten of the 
States had proedurs for periodcaly changig password. Ths raged from every 3 months 
spec 
to a year. The IDs were used to limt the employees to  termals, specifc cases 
and/or specifc tys of trsactions. 
Despite the apparntly well-dsigned and implemented access control effort noted among the 
States, a potenti vuerabilty to the protection of persona data was noted in a number of 
States. This vuerabilty tok two form: 
May States issue generic passwords for the query function. Ths is 
tyicaly done for 
persons in clerical or reeptionist positions so they can determne if a client has a record. 
Whe ths pratice dos not dictly permt unauthorze persons access to view, print, 
crate or mod client reor, it dos crate an oppoty for access that is not easily 
monitored. Oenerc password  shad and 
ar easily  thereby render personal data
vuerble  dilosur. 
to 
Many States ar intrucig, or incrasing the use of, personal computers which have 
sta 
access to the client data bases. Such access, usualy crated for  offices as opposed 
progr  opportty 
to  personnel, crates the  for the mas maipulation of, or 
downoadg of, large quantities of data 
Stats Need To Strengthen Security In Specif Areas

Weakesses in State computer seurty can be doumented by the absence of some commonly 
accepted pratices. If one were to use OMB Cirular A- (M anagemenr ofF ederall nforma
130  the computer securty requirement applicable to Federal agencies) as a stad
tion Resources, 

ard for evaluatig State computer securty progrs, a number of specific deficiencies could 
be noted among the States visited. 
The-quarers of the States did not have a specifc computer securty plan in place. The 
OMB Circular A-130 requirs a specific c'omputer securty plan and the designation of 
an individual to be responsible for the implementation of the plan. Only four States had 
such proedurs in place. The others, when queried about computer security plans, 
reportd that they relied on a varety of admistrative 
guidelines, had a plan that
adssed 
data securty or access controls only or had no plan but were developing one. 
The Offce of lrspector Oenera in commentig on ASMB' s proposed computer securty 
gudelies for federay fuded systems durng the in-house review period reommended that 
one of the reuiments be for States to have one, comprehensive computer secmity plan. 
the 
Only  States had plans and monitorig procedures for computer security at remote 
sites (State distrct or county welfar offces). While Federa computer security 
gudace strsses that securty must be system-wide (Le., including remote sites), States 
in genera appear to leave remote site securty to the discrtion of local managers or 
ADP sta. The access control system, in most instaces, is statewide by design, and 
nie 
therefore, is in place at remote sites. These  States ar providig local managers 
with litte more than the access control maual. Two of these States report that they do 
look at seurty durg monitoring visits but neither had stadads against which to 
evaluate the securty at the local offces. 
Only two States did vuerabilty assessments or risk analyses to evaluate their securty. 
It should be noted that not only is a periodc risk analysis required on Federal computer 
systems, but the prpose ASMB computer securty reuirments for States wil require 
a risk assessment. As noted earlier, the two States that did risk assessments did so at the 
dition of 
their State legislatus. A possible implementation problem for the ASMB 
reguation is that both States were reluctat to shar those report with us on a voluntar 
basis. However, mostf Stiat e computer systems had been reviewed by outside agencies 
such as "Big 8 CPA"  or State auditors. 
Eight States did not do personnel securty backgrund checks. Background checks 
are a 
stada reuiment for Fedra employment and peonnel securty is a mandated 
component of Fedra computer securty. The dicussions with States revealed that the 
idea of background checks for persons who had access to computers was never really 
considered. In fact, the four that do perform backgrund checks do so in response to the 
USDA/O audits. 
Contigency plans generay exist on paper in the form of a proposal to move into and 
the 
shar another agency s facilty. Only  plans have ben tested.  RECOMMENDATIONS

The most signficant findig of this inspection is the lack of common, Federal stadards for 
States to meet with regar to securty on their federally funded computer systems. The 
HHS/ASMB issued on Sepiember 21, 1987 a Notice of Prposed Rulemakg - "Automatic 
Data Processing Equipment and Services; Conditions for Federal Financial Parcipation. " 
The NPRM, among other things, wil establish such stadas. Durg the process of develop
ing the stada, 010 made recommendations to strengten them based upon the experience 
gained in conducting ths inspection. 
The recommendations included: 
Modyig  reui 
the NPRM to spcifcally  that the States have a single securty plan. 
Addng a requirment for review of data securty in addtion to physical securty 
reviews. 
Establishing a clearly defined relationship between generic securty requirements and 
progr-specific requirments.

The recommendations listed above were incorprate into the NPRM. It should also be noted 
that USDA is in the proess of developing a companion securty reguation for its 
grantees. 
stada 
We recommend that the HHS common computer seurty  be issued in final, with the 
requiement for risk analyses. 
Review and follow-up proedurs wil nee to be establihed in ordr to properly monitor im
stada. 
plementation of the  The 010 will monitor implementation of the stadas to deter
mie  adssing 
their effectiveness in  the aras of concern highlghted by ths report.  AGENCY COMMENTS

Substative comments on the draf report were received frm ASMB and FSA within HHS 
and from the Foo and Nutrtion Servce (FS) and the Inspector Genera at USDA. 
trsferred 
The HHS/ASMB reported that lead responsibilty for State ADP systems had been 
from ASMB to FSA, and that FSA was now in the proess of finalizig the computer securty 
regulations for States receivig Federal funds. FSA report that the final regulations wil soon 
go thugh fial Deparenta clearce. 
The USDA/S reportd that on August 8, 1988 they issued an NPRM establishing minimum 
adisterig 
computer securty requiments for State and local agencies  Foo Stap
Prgrs.  viraly 
Our analysis of these reguations indicates that they are  identical to the 
HHS reguations. The USDA/O suggested that responsibilty for assurg and monitorig 
complice with the regUations be assigned. The USDA reguations note that FNS wil be 
responsible for assurg compliance; FSA wi assume that responsibilty withn HHS. They 
requi  prima 
wil be using either the  securty reviews or the corrctive action plans as the 
means for monitoring complice.