Audit Report 

OIG-05-040 

INFORMATION TECHNOLOGY: Mint’s Computer Security 

Incident Response Capability Needs Improvement 

July 13, 2005

Office of 

Inspector General 

Department of the Treasury 

Contents 

Mint’s Computer Security Incident Response Capability Needs Page 1 

Audit Report....................................................................................................3 

Results In Brief...............................................................................................4 

Background ...................................................................................................4 

Findings and Recommendations .......................................................................5 

Mint’s CSIRC Policy And Procedures Need To Be Updated..............................6 

Recommendations......................................................................................8 

Mint’s Computer Security Incident Reporting Was Not Complete .....................8 

Recommendation .....................................................................................11 

Mint’s Software Patch Management Process Needs Improvement..................11 

Recommendations....................................................................................14 

Appendices

Appendix 1: Objective, Scope, and Methodology.........................................16 

Appendix 2: Overview of Treasury’s CSIRC Structure ..................................17 

Appendix 3: Management Comments.........................................................19 

Appendix 4: Major Contributors.................................................................23 

Appendix 5: Report Distribution.................................................................24 

Abbreviations

CIO Chief Information Officer 

CSIRC Computer Security Incident Response Capability 

FISMA Federal Information Security Management Act 

FY Fiscal Year 

GISRA Government Information Security Reform Act 

IDS Intrusion Detection System 

IT Information Technology 

Mint United States Mint 

NIST National Institute of Standards and Technology 

OIG Office of Inspector General 

OIS Office of Information Security 

Improvement (OIG-05-040)
Contents 

Mint’s Computer Security Incident Response Capability Needs Page 2 

OIT Office of Information Technology 

OMB Office of Management and Budget 

TCSIRC Treasury’s Computer Security Incident Response Center 

TD P Treasury Directive Publication 

Treasury Department of the Treasury 

Improvement (OIG-05-040)
OIG Audit 

Report

The Department of the Treasury 

Office of Inspector General 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 3 

 

 July 13, 2005 

Jerry Horton 

Chief Information Officer 

United States Mint 

The Office of Inspector General’s (OIG) Annual Audit Plan for Fiscal 

Year (FY) 2004 included the audit project, Independent Evaluation 

of Treasury’s Information Security Program and Practices Pursuant 

to the Federal Information Security Management Act (FISMA). As 

part of this review, the OIG was required to evaluate aspects of the 

Department of the Treasury’s (Treasury) computer security incident 

response capability (CSIRC). During our FY 2003 FISMA 

independent evaluation, we noted that the number of computer 

security incidents reported by Treasury bureaus varied significantly. 

The Office of Management and Budget (OMB) reported similar 

divergence in incidents reported across Federal agencies in its 

FY 2003 FISMA report to Congress in March 2004. 

This audit was structured based on current, as well as prior, OMB 

FISMA reporting requirements. The OIG plans to incorporate the 

results of this audit into its FY 2005 FISMA evaluation. This audit 

is also consistent with Treasury Directive Publication (TD P) 85-01, 

Treasury Information Technology Security Program 1, which 

requires that Treasury bureaus establish and maintain an incident 

response capability. 

Our overall objective for this audit was to determine if the United 

States Mint (Mint) established an adequate CSIRC process. To 

accomplish this objective, we: (1) interviewed Mint information 

technology (IT) personnel; (2) reviewed relevant IT policy and 

procedure documents; and (3) observed the actual IT reporting 

processes that produce CSIRC and software patch management 

data. A more detailed description of our objective, scope, and 

methodology is provided in Appendix 1. 

1

 Treasury IT Security Program (TD P 85-01) was updated as of August 15, 2003. 
Results In Brief

Overall, we found that although the Mint established a CSIRC and 

a software patch management function, its computer security 

incident reporting process needs improvement. For instance, we 

identified that: (1) CSIRC policy and procedures need to be 

updated; (2) security incidents were not being completely reported; 

and (3) necessary documentation for its patch management system 

was not being retained. 

Our report includes several recommendations that, in our opinion, 

will assist Mint in remedying the deficiencies identified above. 

Specifically, we are recommending that Mint’s Chief Information 

Officer (CIO) ensure that: 

1. Current Mint CSIRC policy and procedures are updated and 

incorporate the guidance established by TD P 85-01. 

2. Help Desk procedures are created that clearly define 

requirements for communications with the Office of Information 

Security (OIS) when an incident is discovered. 

3. Complete computer security incident data is collected from all 

existing internal and external sources and is consistently 

reported to the Treasury Computer Incident Response Center 

(TCSIRC) on a monthly basis. 

4. Current software patch management policy and procedures are

updated and incorporate penetration testing guidance

established by TD P 85-01. 

5. All security bulletin patches retain appropriate configuration 

change request and testing documentation. 

6. All applicable security bulletin patches are applied, and written 

justification is retained for those that are not applied. 

7. All configuration change requests are included in the patch 

tracking system. 

Background 

According to the National Institute of Standards and Technology 

(NIST), computer security incident response has become an 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 4 
 

important component of IT programs. 2 Security-related threats 

have become not only more numerous and diverse, but also more 

damaging and disruptive. New types of security-related incidents 

emerge frequently. Preventative activities based on the results of 

risk assessments can lower the number of incidents, but not all 

incidents can be prevented. An incident response capability is 

therefore necessary for rapidly detecting incidents, minimizing loss 

and destruction, mitigating the weaknesses that were exploited, 

and restoring computing services. 

NIST guidance also states that since performing incident response 

effectively is a complex undertaking, establishing a successful 

incident response capability requires substantial planning and 

resources.3

 Continually monitoring threats through an intrusion 

detection system (IDS) is essential. Establishing clear procedures 

for assessing the current and potential business impact of incidents 

is critical, as is implementing effective methods of collecting, 

analyzing, and reporting data. Building relationships and 

establishing suitable means of communication with other internal 

groups (e.g., human resources, legal) and with external groups

(e.g., other incident response teams, law enforcement) are also 

vital. 

TCSIRC provides a means for receiving and/or disseminating 

computer security incident information to Treasury bureaus; and 

consistently responding to, and reporting on, computer security 

incidents. See Appendix 2 for an overview of the TCSIRC 

structure and functionality. 

Prior to our audit, OIS did not have a full-time manager for the 

Mint’s CSIRC function. However, during the audit, an Operations 

Division Chief was appointed and was assigned the responsibility 

to manage the Mint’s CSIRC function. 

Findings and Recommendations

Although deficiencies existed in its current CSIRC process, we 

identified areas where the Mint was taking appropriate steps in 

2

 NIST Special Publication 800-61, “Computer Security Incident Handling Guide”, dated January 2004. 3

 NIST Special Publication 800-61, “Computer Security Incident Handling Guide”, dated January 2004. 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 5 
 

establishing an adequate CSIRC and software patch management 

function. For example: 

• Mint established a full-time CSIRC function operated by the OIS. 

• Mint’s CSIRC function distinguishes between computer security 

“events”4 and computer security “incidents.”5 Further,

computer security incidents are reported on a monthly basis. 

• Mint established a full-time software patch management 

function to address computer security vulnerabilities. The 

software patch management function is operated by the Office 

of Information Technology (OIT). 

• The software patch management function subscribes to relevant 

hardware and software vulnerability alert services. 

• The OIT maintains a dedicated lab used for testing patches prior 

to implementation. 

• Mint’s software patch management function is integrated with 

the configuration management process, which includes a 

change control board that reviews and approves software 

patches. 

• The OIS developed an end user IT security awareness training 

program in which aspects of the CSIRC function are 

incorporated. 

Finding 1 Mint’s CSIRC Policy And Procedures Need To Be Updated

Mint’s policy and procedures relating to CSIRC were not current 

with Treasury guidance. More specifically, (1) current CSIRC 

policy was based on outdated Treasury policy; (2) current CSIRC 

procedures did not incorporate all required aspects of Treasury’s 

current IT security policy; and (3) Mint’s Help Desk policy does not 

address handling computer security incidents. By not updating 

current policy and procedures, the Mint cannot ensure that IT

security personnel will address computer security incidents 

appropriately.

4

 Per TD P 85-01, an “event” is a notable occurrence, not yet assessed, in a computing or

telecommunications system or network that may affect that system or network. 5 Per TD P 85-01, an “incident” is the violation of an explicit or implied security policy in a computing 

or telecommunications system or network. 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 6 
Mint’s CSIRC Policy Is Not Based On Current Treasury Policy

We found that although the Mint established a policy regarding its 

CSIRC process, this policy was not based on current Treasury 

policy. The Mint’s current policy6

 establishes guidelines for 

responding to and reporting information technology incidents, 

however, the policy is based on Treasury’s Security Manual 

TD P 71-10. In August 2004, the Treasury CIO issued a 

memorandum stating that Treasury had updated its IT security 

policy and that TD P 85-01 now formally documents the IT 

security program. As a result, TD P 85-01 superceded 

TD P 71-10. By not incorporating the policy guidance mandated by 

TD P 85-01, Mint CSIRC policy is not current with Treasury’s IT 

security policy. 

Mint’s CSIRC Procedures Are Not Based On Current Treasury 

Policy

We also found that Mint established procedures regarding its 

CSIRC process. Mint’s current procedures7

 provide guidance for 

recognizing and identifying IT security incidents. Further, the 

procedures assist in defining security incidents, as well as how to 

respond to IT events that become security incidents. After 

comparing Mint’s CSIRC procedures with TD P 85-01, we found

that the procedures did not require Mint to: 

• Update TCSIRC every four hours after an initial incident 

report is filed, until the incident is resolved; and as new 

information about the incident is discovered.8

• Specify approved methods for Mint’s CSIRC to deliver 

unclassified system incident data to TCSIRC.9

• Specify approved methods for Mint’s CSIRC to deliver 

critical infrastructure protection asset incident data to 

TCSIRC.10

• Forward to TCSIRC, any relevant information that becomes 

available after an incident is closed.11

 

6

 Mint Directive 9C-5, IT Security Incident Response and Reporting Policy, dated May 2002. 7

 U.S. Mint IT Security Incident Prevention and Response Procedures, dated May 28, 2004. 8

 Part 1—Sensitive Systems, Section 6.2.2.1 of TD P 85-01. 9

 Part 1—Sensitive Systems, Section 6.2.2.6 of TD P 85-01. 10 Part 1—Sensitive Systems, Section 6.2.2.7 of TD P 85-01. 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 7 
By not incorporating the policy guidance mandated by TD P 85-01, 

the Mint’s CSIRC procedures are not current with Treasury’s IT 

security policy. 

Mint’s CSIRC Procedures Do Not Address Handling Computer 

Security Incidents For Its Help Desk

The Mint did not establish procedures requiring Help Desk 

personnel to notify OIS when a suspected incident is discovered. 

However, during the audit, OIS acknowledged that procedures 

would be created to address this deficiency. By not establishing 

procedures requiring Help Desk personnel to notify OIS when an

incident is discovered, Mint increases the risk that detected 

incidents will go unreported. 

Recommendations 

The CIO should ensure that: 

1. Current Mint CSIRC policy and procedures are updated and 

incorporate the guidance established by TD P 85-01. 

2. Help Desk procedures are created that clearly define 

requirements for communications with the OIS when an incident 

is discovered. 

Management Response Management agreed with the 

recommendations and has implemented or is in the process of 

instituting corrective measures. 

OIG Comment The actions taken and/or planned by the Mint’s 

Office of Information Security are responsive to the intent of our 

recommendations. 

Finding 2 Mint Computer Security Incident Reporting Was Not 

Complete 

The Mint security incidents were not being completely reported. 

Specifically, we found that incidents involving the Mint’s firewall, 

 11 Section 6.3.2.4 of TD P 85-01. 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 8 
IDS, e-mail server virus detection software, Help Desk, and IT 

equipment thefts were not being accurately and completely 

reported. By not completely identifying all computer security 

incidents, the Mint is underreporting its actual security incidents.

Firewall Log Incidents Were Not Accurately Reported

The Mint was not reporting all firewall12 log incidents to TCSIRC. 

For the month of August 2004, the Mint reported zero

“unsuccessful access or penetration attempt” incidents to TCSIRC. 

Mint currently has 15 firewalls deployed for its various network 

systems. Each firewall produces a continuous log file of relevant 

network events that the firewall has evaluated and processed. The 

amount of data collected in these firewall event logs is substantial. 

We received the data for one of the firewalls event log files for the 

month of August 2004. Because of the large volume of event log 

data, only the first and last days of August 2004 were examined. 

The firewall event log files identified 21,110 and 65,940 events for 

both of these days, respectively. From these events, we identified 

that 1,567 and 7,315 were categorized as actual computer 

security incidents. These numbers represent unsuccessful access 

or penetration attempts and are reportable per TD P 85-01. 

IDS Log Incidents Were Not Completely Reported

Because OIS does not research medium and low severity IDS 

events13, they were unable to completely determine how many

actual computer security incidents occurred at the time of our 

audit. An IDS allows IT security personnel to observe and react to 

a variety of anomalous behaviors on monitored networks and 

server machines by creating a continuous log file of substantial 

event data. Further, an IDS provides a second line of defense that 

exists beyond a firewall. 

The commercial provider for the Mint’s CSIRC function classifies all 

IDS events as high, medium, or low severity according to its own 

internally developed criteria. When an IDS event is classified in the 

 

12 A firewall allows authorized network traffic to pass through the device and onto its specified 

destination and is used to block unauthorized attempts to access IT resources. 13 For the two days that we reviewed, most of Mint’s IDS event log data falls in these two categories. 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 9 
high severity category, the commercial provider verbally alerts OIS 

personnel, who research the event and verifies all relevant 

information. If OIS determines that a high priority IDS event is an 

actual computer security incident, then it is reported to TCSIRC as 

such. 

We selected our sample of IDS event log data that corresponded to 

the firewall that was discussed in the previous section. We 

selected the month of August 2004 for our review. Because of the 

large volume of event log data, only the first and last days of 

August 2004 were examined. We found that 15,764 and 15,270 

total events were recorded for these days, respectively. However, 

since OIS does not research medium and low severity IDS events, 

the total number of incidents could not be determined. 

E-mail Server Anti-Virus Incidents Were Not Reported

The Mint was not reporting virus detection (and removal) incidents 

to TCSIRC. For the month of June 2004, Mint reported zero virus 

detection (and removal) incidents to TCSIRC. Mint’s 

e-mail system is administered by five Microsoft Exchange servers. 

All five servers process an anti-virus program capable of removing 

e-mail viruses and unwanted e-mail (i.e., Spam). These servers 

also produce a continuous log file showing e-mail virus removal 

activity. We utilized the results of these logs for all five servers 

and found that 54 virus removal incidents were identified. 

Mint’s Help Desk Security Incidents Were Not Reported

The Mint was not reporting Help Desk security incidents to 

TCSIRC. For the month of March 2004, the Mint reported zero

computer security incidents to TCSIRC. Our review of the Help 

Desk tracking system showed that of the 3,120 tickets generated 

for March 2004, 50 tickets identified potential IT security issues. 

Some of these issues included actual viruses detected and removed 

by the Microsoft Exchange E-mail server’s anti-virus program; and a 

suspected virus was identified after a virus scan was performed. 

In addition, we identified tickets listing potential IT security 

problems. However, these tickets contained incomplete or 

inconclusive information regarding the follow-up and resolution of 

the issue. 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 10 
Mint IT Equipment Theft Incidents Were Not Reported

The Mint reported zero IT equipment thefts to TCSIRC for the 

month of March 2004. However, Mint Police case files identified 

that one case of IT equipment theft was reported for March 2004. 

This case involved the theft of six personal computers from a Mint 

site in the Washington, DC area. 

Recommendation 

The CIO should ensure that: 

3. Complete computer security incident data is collected from all 

existing internal and external sources ensuring that data is 

consistently reported to TCSIRC on a monthly basis. 

Management Response Management substantially agreed with the 

recommendation and is in the process of instituting corrective 

measures to address several of the issues detailed in our report. 

However, the Mint stated that they believe that the reporting 

requirement in TD P 85-01 to report all quarantined files would 

have a significant impact on their resource utilization. The Mint 

has requested an Exception to Policy for reporting e-mail server 

anti-virus incidents, and they have recommended that the reporting 

requirement be deleted from TD P 85-01. They are currently 

waiting for a response to this request for and exemption. If the

exemption is granted, the Mint will report only significant malicious 

application incidents. If the exemption is denied, the Mint will 

report all incidents as required by TD P 85-01. 

OIG Comment We believe management should implement our 

recommendation as stated. 

Finding 3 Mint’s Software Patch Management Process Needs 

Improvement

Although the Mint has established a process for managing its 

software patch management function, improvement is still needed. 

For example, the Mint’s current software patch management policy 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 11 
was not complete. Also, Mint was not retaining the necessary 

information for its patch management tracking system. 

Software Patch Management Policy Was Not Complete

The Mint established policy and procedures for its software patch 

management process. The policy and procedures were in 

compliance with TD P 85-01, with the exception of penetration 

testing follow-up. TD P 85-01 requires that bureaus ensure that 

vulnerabilities discovered during penetration testing are repaired 

and that any damages incurred during the interim are mitigated. 

The Mint’s current policy and procedures do not address this issue. 

Without establishing guidance requiring adequate follow-up on 

vulnerabilities identified during penetration testing, Mint systems 

could remain vulnerable to security attacks.

Supporting Documentation For Mint’s Patch Tracking System Is 

Incomplete

As part of its CSIRC process, the Mint established a software 

patch management function. This process is performed by the OIT 

in conjunction with the Mint’s change control board. The software 

patch management cycle consists of: (1) receiving alerts of 

possible IT security vulnerabilities; (2) logging the alerts into a 

tracking system; (3) assessing the relevance of alerts to current IT 

infrastructure; (4) forwarding relevant alerts and patches to the 

internal configuration management process; (5) testing proposed 

software patches; (6) receiving final configuration management

approval for installation; and (7) installing software patches and 

tracking results. 

We reviewed the OIT’s patch tracking system and patch processing 

cycle and found that documentation did not exist for some of the 

security bulletin patches we reviewed. For example, we found that 

some of the Microsoft Security Bulletin Patches were installed but 

lacked appropriate configuration change request documentation, as 

well as testing documentation. We also found examples where

Microsoft Security Bulletin Patches that should have been installed, 

were not. Further, no explanation was documented on why the 

decision was made not to install these patches. Finally, we found 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 12 
that some Mint configuration change requests were not entered in 

the patch tracking system. 

Appendix III to OMB Circular A-130, Security of Federal Automated 

Information Resources, requires that agencies establish, as part of 

a system security plan, an incident response capability. This 

capability should ensure that help is provided to users when a

security incident occurs in the system and to share information 

concerning common vulnerabilities and threats. This capability 

shall share information with other organizations consistent with 

NIST coordination. Appendix III also requires that an agency 

should be able to respond in a manner that both protects its own 

information and helps to protect the information of others who 

might be affected by the incident. To address this concern, 

agencies should establish formal incident response mechanisms. 

The Treasury Information Technology Security Program, 

TD P 85-01, establishes comprehensive, uniform IT security 

policies to be followed by each bureau in developing its own 

specific policies and operating directives. The Treasury IT Security 

Program serves as a foundation for the bureaus’ IT security 

programs. TD P 85-01 clarifies national policies, adapts them to 

Treasury’s specific circumstances, and imposes additional 

requirements when necessary.

TD P 85-01 outlines procedures for an incident response capability 

designed to receive and disseminate incident information and 

provide a consistent capability to respond to and report on 

incidents. It also provides guidance to Treasury bureaus, 

Departmental Offices, the OIG, and the Treasury Inspector General 

for Tax Administration staff on responding to and reporting security 

incidents that affect Treasury’s ability to conduct its mission. 

Specifically, TD P 85-01 provides for the following: 

• A framework for identifying, handling, managing, responding 

to, and reporting incidents in a timely and expeditious 

fashion. 

• A mechanism for disseminating generic and specific incident 

information to the CIOs and bureaus to ensure that actions 

are being taken to minimize the impact of ongoing or

potential incidents. 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 13 
• Government-wide information sharing of threats, incidents, 

and trends to support security planning and operations. 

Without a complete CSIRC and software patch management 

process, the Mint runs the risk of not accurately identifying and 

accounting for all its computer security incidents. As a result, the 

Mint may understate mandated CSIRC reporting requirements such 

as those identified as part of FISMA. For the Government 

Information Security Reform Act (GISRA) FY 2002 reporting (the 

precursor to FISMA), the Mint reported zero computer security 

incidents. For FISMA FY 2003 reporting, the Mint only reported 

one incident. This discrepancy occurred because the Mint was 

only reporting significant (excluding minor) incidents for their 

GISRA and FISMA reports. By continuing to report incomplete and 

inconsistent information, the Mint cannot ensure that computer 

security incidents are being reported correctly. 

Recommendations 

The CIO should ensure that: 

4. Current software patch management policy and procedures are

updated and incorporate penetration testing guidance

established by TD P 85-01. 

5. All security bulletin patches retain appropriate configuration 

change request and testing documentation. 

6. All applicable security bulletin patches are applied, and written 

justification is retained for those that are not applied. 

7. All configuration change requests are included in the patch 

tracking system. 

Management Response Management agreed with the 

recommendations and has implemented or is in the process of 

instituting corrective measures. 

OIG Comment The actions taken and/or planned by the Mint’s 

Office of Information Security are responsive to the intent of our 

recommendations. 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 14 
* * * * * * 

I would like to extend my appreciation to the Mint for the 

cooperation and courtesies extended to my staff during the review. 

If you have any questions, please contact me at (202) 927-5774. 

Major contributors to this report are listed in Appendix 4. 

/s/ 

Louis C. King 

Director, Information Technology Audits 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 15 
Appendix 1 

Objective, Scope, and Methodology 

The objective of this audit was to determine if the Mint established 

an adequate CSIRC process. This objective was accomplished by 

determining if the Mint established and implemented CSIRC policy 

and procedures compliant with Treasury and OMB criteria, as well 

as ensuring an adequate CSIRC process. We performed this audit 

by: (1) interviewing appropriate OIS and OIT personnel; 

(2) obtaining and reviewing applicable CSIRC and software patch 

management process documentation; (3) obtaining and analyzing 

bureau level and Departmental level CSIRC data; and (4) observing 

bureau level and Departmental level CSIRC processes. 

Our standards for CSIRC and software patch management 

performance for this audit were based solely on the bureau 

requirements published in Treasury Department Publication 

TD P 85-01 and OMB agency reporting requirements for FY 2003 

FISMA. 

This report details the fieldwork performed at the Mint’s 

headquarters site in Washington, DC, from May through September 

2004. We conducted our audit in accordance with generally 

accepted government auditing standards. 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 16 
Appendix 2 

Overview of Treasury’s CSIRC Structure 

 

Treasury’s CSIRC Reporting Structure14

Bureau System

Administrator

Bureau User

Bureau Security

Officer

Bureau Network

Administrator

Bureau CSIRC

1st Tier Incident Reporting

TCSIRC

2nd Tier Incident Reporting

NSIRC FedCIRC Treasury

OIG

External

Entities

External Reporting

Bureau System

Administrator

Bureau User

Bureau Security

Officer

Bureau Network

Administrator

Bureau CSIRC

1st Tier Incident Reporting

TCSIRC

2nd Tier Incident Reporting

NSIRC FedCIRC Treasury

OIG

External

Entities

External Reporting

Source: Treasury IT Security Program (TD P 85-01) 

The TCSIRC serves as a 24 hours a day, 7 days a week, 365 days a year, 

escalation center and as the central point of contact for incidents within 

Treasury. The TCSIRC facilitates incident reporting to the Treasury OIG and 

with external reporting entities. In addition, TCSIRC provides the following 

functions: 

• A framework for identifying, handling, managing, responding to, and 

reporting computer incidents in a timely and expeditious manner. 

• A mechanism for disseminating generic and specific computer security 

incident information to ensure that actions are being taken to minimize 

the impact of ongoing or potential incidents. 

• Government-wide information sharing of threats, incidents, and trends to 

support computer security planning and operations. 

14 As of September 2003, the United States Computer Security Readiness Team (i.e., US-CERT) 

replaced FedCIRC in protecting the nation’s Internet infrastructure against cyber attacks. 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 17 
Appendix 2 

Overview of Treasury’s CSIRC Structure 

The following events are defined as computer security incidents and should be 

reported to TCSIRC: 

Computer Security Incidents

Incident Type Incident Description 

Malicious Logic Attacks 

Performed by crackers/hackers attempting to gain 

privileges and/or information, capture passwords, 

and modify audit logs to hide unauthorized activity. 

Attempts include viruses, Trojan horses, worms, and 

scripts. 

Probes and Reconnaissance Scans Includes probing or scanning networks for critical 

services or security weaknesses. 

Unauthorized Access and 

Unsuccessful Attempts

All successful unauthorized accesses and suspicious 

unsuccessful attempts. 

Denial-of-Service Attacks 

Affect the availability of critical resources, such as email servers, web servers, routers, gateways, and 

communication infrastructure. 

Alterations/Compromises of 

Information 

Involve the unauthorized altering of information or 

the compromise of information. 

Adverse Site Mission Impact Significantly impact the mission of the site or 

operations. 

Classified System Incidents 

Involve either a system used to process national 

security information or classified information on any 

system not certified for that level of classified 

information.

Loss or Theft of Equipment With 

Classified Information

Includes the compromise of user accounts and 

passwords allowing unauthorized persons access to 

Treasury computing resources, agents’ names, or 

case information that could compromise an 

investigation or risk the loss of human life. Emphasis 

is on the data that was lost or stolen, not on the 

hardware itself. 

Misuse of Resources Misuse of a computing or telecommunications 

system or network by an authorized user. 

Domain Name System Attacks Affect the availability of services or networks. 

Root Compromise Compromise the most trusted privileges of the 

machines on the network. 

Web Site Defacements Superficial destruction of web pages that could 

cause embarrassment, but not lead to an attack. 

Source: Treasury IT Security Program (TD P 85-01) 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 18 
Appendix 3 

Management Comments 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 19 
Appendix 3 

Management Comments 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 20 
Appendix 3 

Management Comments 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 21 
Appendix 3 

Management Comments 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 22 
Appendix 4 

Major Contributors 

Office of Inspector General

Louis C. King, Director 

Joseph A. Maranto, III, IT Audit Manager 

George Prytula, III, IT Audit Manager 

Susan R. Sebert, Referencer 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 23 
Appendix 5 

Report Distribution 

Department of the Treasury

Office of the Chief Information Officer 

Office of Accounting and Internal Control

United States Mint

Office of Information Security 

Office of Information Technology 

Office of Management and Budget

Office of Inspector General Budget Examiner 

Mint’s Computer Security Incident Response Capability Needs 

Improvement (OIG-05-040)

Page 24