VA Information Systems: The Austin Automation Center Has Made Progress in Improving Information System Controls
Published: 1999-06-08T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Pursuant to a legislative requirement, GAO assessed the effectiveness of information system general controls at the Department of Veterans Affairs' (VA) Austin Automation Center (AAC).
section_title: What GAO Found
paragraphs: GAO noted that: (1) AAC had made substantial progress in correcting specific computer security weaknesses that GAO identified in its previous evaluation of information system controls; (2) AAC had established a solid foundation for its computer security planning and management program by creating a centralized computer security group, developing a comprehensive security policy, and promoting security awareness; (3) however, AAC had not yet established a framework for continually assessing risks and routinely monitoring and evaluating the effectiveness of information system controls; (4) GAO also identified additional computer security weaknesses that increased the risk of inadvertent or deliberate misuse, fraudulent use, improper disclosure, and destruction of financial and sensitive veteran medical and benefit information on AAC systems; (5) an effective computer security planning and management program would have allowed AAC to identify and correct the types of additional weaknesses that GAO identified; (6) in addition, AAC continues to run the risk that unauthorized access may not be detected because it had not established a program to identify and investigate unusual or suspicious patterns of successful access to sensitive data and resources; (7) these weaknesses could also affect other agencies that depend on AAC information technology services; (8) AAC was very responsive to addressing new security exposures identified and corrected several weaknesses before GAO's fieldwork was completed; (9) the Acting Assistant Secretary for Information Technology said VA would implement all of GAO's recommendations by September 30, 1999; and (10) addressing the remaining issues will help ensure that an effective computer security environment is achieved and maintained.

section_title: Letter
paragraphs: As part of our review of computer security at the Department of Veterans  Affairs (VA), we assessed the effectiveness of information system general  controls at the Austin Automation Center (AAC).  Our review of VA  computer security was performed in connection with the department’s  required annual financial statement audit for fiscal year 1998.  Our  evaluation included follow-up on the computer security weaknesses we  identified at AAC in conjunction with the audit of VA’s fiscal year 1997  financial statements.
Today, we are also issuing a report designated for “Limited Official Use,”  which details the weaknesses we identified at AAC and the current status  of corrective actions.  This version of the report, which was excerpted for  public release, provides a general summary of the weaknesses we  identified, the status of corrective actions, and the recommendations we  made.
We advised the director of AAC of specific corrective actions that could be  taken to address the weaknesses we identified.  The results of our  evaluation were shared with the VA’s Office of Inspector General (IG) for its  use in auditing VA’s consolidated financial statements for fiscal year 1998.
subsections: section_title: Background
paragraphs: VA is responsible for administering health care and other benefits, such as  compensation and pensions, life insurance protection, and home mortgage  loan guarantees, that affect the lives of more than 25 million veterans and  approximately 44 million members of their families.  In providing these  benefits and services, VA collects and maintains sensitive medical record  and benefit payment information for veterans and their family members.
AAC is one of VA’s three centralized data centers.  It maintains the  department’s financial management and other departmentwide systems,  including centralized accounting, payroll, vendor payment, debt collection,  benefits delivery, and medical systems.  AAC also provides, for a fee,  information technology services to other government agencies.   As of  November 1998, the center either provided or had entered into contracts to  provide information technology services, including batch and online  processing and workers’ compensation and financial management  computer applications, for nine other federal agencies.
In fiscal year 1998, the VA's payroll was more than $11 billion and the  centralized accounting system processed more than $7 billion in  administrative payments.  AAC also maintains medical information for both  inpatient and outpatient care.  For example, AAC systems document  admission, diagnosis, surgical procedure, and discharge information for  each stay in a VA hospital, nursing home, or domiciliary.  In addition, AAC  systems contain information concerning each of the guaranteed or insured  loans closed by VA since 1944, including about 3.5 million active loans.
As one of VA’s three centralized data centers, AAC is part of a vast array of  computer systems and telecommunication networks that VA relies on to  support its operations and store the sensitive information the department  collects in carrying out its mission. The remaining two data centers support  VA’s compensation, pension, education, and life insurance benefit  programs.
In addition to the three centralized data centers, the Veterans Health  Administration operates 172 hospitals at locations across the country that  operate local financial management and medical support systems on their  own computer systems.  These data centers and hospitals are  interconnected, along with 58 Veterans Benefits Administration regional  offices, the VA headquarters office, and customer organizations such as  non-VA hospitals and medical universities, through a wide area network.   All together, VA’s network services over 700 locations nationwide, including  Puerto Rico and the Philippines.
section_title: Objective, Scope, and Methodology
paragraphs: Our objective was to evaluate and test the effectiveness of information  system general controls over the financial systems maintained and  operated by VA at AAC.  General controls, however, also affect the security  and reliability of nonfinancial information, such as veteran medical and  loan data, maintained at this processing center.
Specifically, we evaluated information system general controls intended to protect data, files, programs, and equipment from unauthorized access,  modification, and destruction; prevent the introduction of unauthorized changes to application and provide adequate segregation of duties involving application  programming, system programming, computer operations, security, and  quality assurance; ensure recovery of computer processing operations in case of a disaster  or other unexpected interruption; and ensure that an effective computer security planning and management  program is in place.
We restricted our evaluation to AAC because VA's Office of Inspector  General was planning to review information system general controls for  fiscal year 1998 at the Hines and Philadelphia benefits delivery centers.
To evaluate information system general controls, we identified and  reviewed AAC's general control policies and procedures.  We also tested  and observed the operation of information system general controls over  AAC's information systems to determine whether they were in place,  adequately designed, and operating effectively.  In addition, we determined  the status of previously identified computer security weaknesses, but did  not perform any follow-up penetration testing.
We performed our review from October 1998 through March 1999, in  accordance with generally accepted government auditing standards. Our  evaluation was based on the guidance provided in our Federal Information  System Controls Audit Manual (FISCAM) and the results of our May 1998  study of security management best practices at leading organizations.
After we completed our fieldwork, the director of AAC provided us with  updated information regarding corrective actions.  We did not verify these  corrective actions but plan to do so as part of future reviews.
VA provided us with written comments on a draft of this report, which are  discussed in the “Agency Comments” section and reprinted in appendix I.
section_title: AAC Has Acted to Improve Security
paragraphs: AAC has made substantial progress in addressing the computer security  issues we previously identified.  At the time of our review in 1998, AAC had  corrected 40 of the 46 weaknesses that we discussed with the director of  AAC and summarized in our September 1998 report on VA computer  security.  AAC had addressed most of the access control, system software,  segregation of duties, and service continuity weaknesses we identified in  1997 and had improved computer security planning and management.  For  example, AAC had reduced the number of users with access to the computer room, restricted access to certain sensitive libraries, audit information, and established password and dial-in access controls, developed a formal system software change control process, expanded tests of its disaster recovery plan, and established a centralized computer security group.
AAC was also proactive in addressing additional computer security issues  we identified during our current review.
section_title: Key Issues Were Still Outstanding
paragraphs: We identified a continuing risk of unauthorized access to financial and  sensitive veteran medical and benefit information because the center had  not fully implemented a comprehensive computer security planning and  management program.  If properly designed, such a program should  identify and correct the types of additional access control and system  software weaknesses that we found.  In addition, AAC risks certain types of  unauthorized access not being detected because it had not completely  corrected the user access monitoring weaknesses we previously identified.
subsections: section_title: Computer Security Planning and Management Is Essential
paragraphs: Our May 1998 study of security management best practices found that a  comprehensive computer security planning and management program is  essential to ensure that information system controls work effectively on a  continuing basis.  Under an effective computer security planning and  management program, staff (1) periodically assess risks, (2) implement  comprehensive policies and procedures, (3) promote security awareness,  and (4) monitor and evaluate the effectiveness of the computer security  environment.  In addition, a central security staff is important for providing  guidance and oversight for the computer security planning and  management program to ensure an effective information system control  environment.
AAC had established a solid foundation for its computer security planning  and management program by creating a centralized computer security  group, developing a comprehensive security policy, and promoting security  awareness.  However, AAC had not yet instituted a framework for  continually assessing risks or routinely monitoring and evaluating the  effectiveness of information system controls.  In March 1999, the director  of AAC told us that the center plans to expand its computer security  planning and management program to include these aspects. In addition,  the director told us that AAC had augmented its security management  organization by hiring two additional security experts in May 1999.  A  comprehensive computer security planning and management program  should provide AAC with a solid foundation for ensuring that appropriate  controls are designed, implemented, and operating effectively.
subsections: section_title: Risk Assessments Were Not Performed When Significant Changes Occurred
paragraphs: Periodically assessing risk is an important element of computer security  planning because it provides the foundation for the other aspects of  computer security management.  Risk assessments not only help  management determine which controls will most effectively mitigate risks,  but also increase awareness and, thus, generate support for adopted  policies and controls.  An effective risk assessment framework generally  includes procedures that link security to business needs and provide for  continually managing risk.
VA policy requires that risk assessments be performed when significant  changes are made to a facility or its computer systems, but at least every 3 years.  AAC had not formally reassessed risk since 1996 even though  significant changes to the facility and its systems had occurred.  For  example, AAC management told us that the center had replaced its  mainframe computer, implemented a new mainframe operating system,  and expanded the facility to accommodate a VA finance center in 1998.   Although the director of AAC told us in March 1999 that changes in  computer security risks were considered by implementation teams  responsible for these events, documentation of such considerations were  not available.  Formal risk assessments should be performed for such  significant changes.  The director of AAC also told us that management  would perform a risk assessment later in 1999 to comply with VA policy.
One reason that AAC had not formally assessed risks when these  significant changes occurred was that the center had not developed a  framework for assessing and managing risk on a continuing basis.  In  March 1999, the director of AAC told us that a risk assessment framework  would be developed and added to the AAC security handbook.  According  to the director, this planned risk assessment framework will define the types of changes that require a risk assessment; specify risk assessment procedures that can be adapted to different indicate who should conduct the assessment, preferably a mix of  individuals with knowledge of business operations, security controls,  and technical aspects of the computer systems involved; and describe requirements for documenting the results of the assessment.
section_title: Information System Controls Were Not Routinely Evaluated
paragraphs: In addition to assessing risk to identify appropriate controls, it is also  important to determine if the controls in place are operating as intended to  reduce risk. Our May 1998 study of security management best practices  found that an effective control evaluation program includes processes for  (1) monitoring compliance with established information system control  policies and guidelines, (2) testing the effectiveness of information system  controls, and (3) improving information system controls based on the  results of these activities.  AAC had not established a program to routinely  monitor and evaluate the effectiveness of information system controls.   Such a program would allow AAC to ensure that policies remain  appropriate and that controls accomplish their intended purpose.
Although AAC had substantially corrected previously identified computer  security weaknesses, we tested additional access and system software  controls and found weaknesses that posed risks of unauthorized  modification, disclosure, or destruction of financial and sensitive veteran  medical and benefit information.  These weaknesses included inadequately  limiting access of authorized users to sensitive data and programs,  maintaining the system software environment, and reviewing network  security.  Several of these weaknesses could have been identified and  corrected if AAC had been monitoring compliance with established  procedures.  For example, periodically reviewing AAC user access  authority to ensure that it was limited to the minimum required access level  based on job requirements would have allowed AAC to discover and fix the  types of additional access control weaknesses we identified.  Likewise,  routinely evaluating the technical implementation of its system software  would have permitted AAC to eliminate or mitigate the additional system  software exposures we identified.
A program to regularly test information system controls would also have  allowed AAC to detect additional network security weaknesses.  For  example, using network analysis software designed to detect network  vulnerabilities, we determined that intrusion attempts on 2 of the 10  network access control paths would not be detected.  Although AAC fixed  this problem before our fieldwork was completed, AAC staff could have  identified and corrected this exposure using similar network analysis  software available to them.  AAC staff told us that they also plan to begin  evaluating the intrusion detection system periodically.
In addition, AAC had not established a process to test network security  when major changes to the network occur.  Although AAC had used  network analysis software to detect network vulnerabilities earlier in  October 1998, we determined that both a production and a development  network system had a system program with vulnerabilities commonly  known to the hacker community.  These vulnerabilities could have  provided the opportunity to bypass security controls and gain unlimited  access to AAC network systems.  Although AAC staff determined that the  vulnerable programs were no longer needed and deleted them before our  fieldwork was completed, these vulnerabilities could have been prevented  had network security been reassessed when the network environment  changed.
section_title: Certain User Access Activities Were Not Adequately Monitored
paragraphs: AAC was also not adequately monitoring certain user access activity.  A  comprehensive user access monitoring program would include routinely  reviewing user access activity to identify and investigate both failed  attempts to access sensitive data and resources and unusual or suspicious  patterns of successful access to sensitive data and resources.  Such a  program is critical to ensuring that improper access to sensitive  information would be detected.
Because the volume of security information available is likely to be too  voluminous to review routinely, the most effective monitoring efforts are  those that selectively target unauthorized, unusual, and suspicious patterns  of access to sensitive data and resources, such as security software, system  software, application programs, and production data.  AAC had begun  reviewing failed attempts to access sensitive data and resources, but had  not established a program to monitor successful access to these resources  for unusual or suspicious activity.  In March 1999, the director of AAC told  us that the center is expanding its user access activity monitoring to  identify and investigate unusual or suspicious patterns of access to  sensitive resources, such as updates to security files that were not made by security staff, changes to sensitive system files that were not performed by system modifications to production application programs that were not  initiated by production control staff, revisions to production data that were completed by system or deviations from normal patterns of access to sensitive veteran medical  and benefit data.
section_title: Additional Computer Security Weaknesses Were Identified
paragraphs: In addition to the access activity monitoring and computer security  program planning and management weaknesses that remain open from  1997, we identified 16 additional issues during our 1998 review.  For  example, AAC had not restricted access to certain sensitive data and programs based on job routinely reviewed access authorities granted to employees to ensure  that they were still appropriate, adequately reviewed certain components of its operating system to  ensure continued system integrity, adequately documented changes to network servers, documented testing of certain emergency changes to its financial issued technical security standards for maintaining the integrity of  system and security software for certain operating system  environments.
AAC had corrected 6 of the 16 additional issues identified in 1998 before we  completed our site visit in Austin.  Addressing the remaining additional  issues should help AAC ensure that an effective computer security  environment is achieved and maintained. We discussed these issues with  AAC management and staff and were told that they would be addressed by  September 1999.
section_title: Conclusions
paragraphs: AAC had made substantial progress in improving information system  general controls.  In addition to correcting most of the access control,  system software, segregation of duties, and service continuity weaknesses  we had previously identified, AAC had strengthened its computer security  planning and management program by creating a centralized computer  security group, developing a comprehensive security policy, and promoting  security awareness.  Until AAC completes implementing its computer  security planning and management program by establishing a framework  for continually assessing risks and routinely monitoring and evaluating the  effectiveness of information system controls, it will not have adequate  assurance that appropriate controls are established and operating  effectively.
We identified additional access, system software, and application change  control weaknesses that continued to place financial and sensitive veteran  medical and benefit information on AAC systems at risk of improper  modification, disclosure, or destruction and assets at risk of loss.   Unauthorized access may not be detected because AAC had not begun  identifying and investigating unusual or suspicious patterns of successful  access to sensitive data and resources.  AAC could have identified and  corrected these types of weaknesses, which could also adversely affect  other agencies that depend on AAC for computer processing support, had it  fully implemented an effective computer security planning and  management program.
section_title: Recommendations
paragraphs: We recommend that the Acting VA Chief Information Officer (CIO) work  with the director of AAC to implement policies and procedures for assessing and managing risk on a establish processes for (1) monitoring compliance with established  information system control policies and procedures, (2) testing the  effectiveness of information system controls, and (3) improving  information system controls based on the results of these activities; and expand the center’s user access activity monitoring program to identify  and investigate unusual or suspicious patterns of successful access to  sensitive data and resources for unauthorized access.
We also recommend that the Acting VA CIO coordinate with the director of  AAC to ensure that the remaining computer security weaknesses are  corrected.  These weaknesses are summarized in this report and detailed in  a separate report, which is designated for “Limited Official Use,” also  issued today.
section_title: Agency Comments
paragraphs: In commenting on a draft of this report, VA agreed to implement our  recommendations by September 30, 1999.  Specifically, VA stated that AAC  would update its security handbook to include a risk assessment  framework, establish a program to routinely monitor and evaluate the  effectiveness of controls, and complete procedures for monitoring  successful access to sensitive computer resources by the end of September  1999.  VA also informed us that AAC had taken action to correct all but  three of the other weaknesses we identified and plans to address the  remaining weaknesses by September 30, 1999.
Within 60 days of the date of this letter, we would appreciate receiving a  statement on actions taken to address our recommendations.
We would like to thank AAC for the courtesy and cooperation extended to  our audit team.  We are sending copies of this report to Senator Arlen  Specter, Senator Ted Stevens, Senator Robert C. Byrd, Senator Fred  Thompson, Senator Joseph Lieberman, Senator John D. Rockefeller IV,  Representative C. W. Bill Young, Representative Lane Evans, III,  Representative Bob Stump, Representative David Obey, Representative  Dan Burton, and Representative Henry A. Waxman in their capacities as  Chairmen or Ranking Minority Members of Senate and House Committees.  We are also sending copies to Togo D. West, Jr., Secretary of Veterans  Affairs and the Honorable Jacob J. Lew, Director of the Office of  Management and Budget. In addition, copies will be made available to  others upon request.
If you have any questions or wish to discuss this report, please contact me  at (202) 512-3317. Major contributors to this report are listed in appendix II.
section_title: Comments From the Department of Veterans Affairs
section_title: Major Contributors to This Report
subsections: section_title: Accounting and Information Management Division
section_title: Dallas Field Office
paragraphs: David W. Irvin, Assistant Director Debra M. Conner, Senior EDP Auditor Shannon Q. Cross, Senior Evaluator Charles M. Vrabel, Senior EDP Auditor The first copy of each GAO report and testimony is free. Additional copies are $2 each.  Orders should be sent to the  following address, accompanied by a check or money order made  out to the Superintendent of Documents, when necessary, VISA and  MasterCard credit cards are accepted, also.
Orders for 100 or more copies to be mailed to a single address are  discounted 25 percent.
U.S. General Accounting Office P.O. Box 37050 Washington, DC  20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537.
Each day, GAO issues a list of newly available reports and  testimony.  To receive facsimile copies of the daily list or any list  from the past 30 days, please call (202) 512-6000 using a touchtone  phone.  A recorded menu will provide information on how to obtain  these lists.