VA’s mission is to promote the health, welfare, and dignity of all veterans in recognition of their service to the nation by ensuring that they receive medical care, benefits, social support, and memorials. According to VA, its employees maintain the largest integrated health care system in the nation for approximately 6 million patients, provide compensation and benefits for about 4 million veterans and beneficiaries, and maintain about 3 million gravesites at 164 properties. The use of information technology (IT) is crucial to the department’s ability to provide these benefits and services, but without adequate protections, VA’s systems and information are vulnerable to those with malicious intentions who wish to exploit the information. The evolving array of cyber-based threats can jeopardize the confidentiality, integrity, and availability of federal information systems and the information they contain. These threats can be unintentional or intentional. Unintentional threats can be caused by natural disasters; defective equipment; or the actions of careless, inattentive, or untrained employees that inadvertently disrupt systems. Intentional threats include both targeted and untargeted attacks from a variety of sources. These include disgruntled employees, criminal groups, hackers, and foreign nations engaged in espionage and information warfare. Such threat sources vary in terms of the types and capabilities of the actors, their willingness to act, and their motives. These threat sources make use of various techniques to compromise information or adversely affect computers, software, networks, an organization’s operation, an industry, or the Internet itself. Such techniques include, among others, denial-of-service attacks and malicious software codes or programs. The unique nature of cyber-based attacks can vastly enhance their reach and impact, resulting in the loss of sensitive information and damage to economic and national security, the loss of privacy, identity theft, and the compromise of proprietary information or intellectual property. The increasing number of incidents reported by federal agencies has further underscored the need to manage and bolster the security of the government’s information systems. The number of incidents affecting VA’s information, computer systems, and networks has generally risen over the last several years. Specifically, in fiscal year 2007, the department reported 4,834 information security incidents to US-CERT; in fiscal year 2013, it reported 11,382 incidents. These included incidents related to unauthorized access, denial-of- service attacks; installation of malicious code; improper usage of computing resources; and scans, probes, and attempted access, among others. Figure 1 shows the overall increase in the total number of incidents VA reported to US-CERT for fiscal year 2007 through 2013. In addition, reports of incidents affecting VA’s systems and information highlight the serious impact that inadequate information security can have on, among other things, the confidentiality, integrity, and availability of veterans’ personal information. For example: According to a VA official, in January 2014 a software defect in VA’s eBenefits system improperly allowed users to view the personal information of other veterans. According to this official, this defect potentially allowed almost 5,400 users to view data of over 1,300 veterans and/or their dependents. In May 2010, it was reported that VA officials had notified lawmakers of breaches involving the personal data of thousands of veterans, which had resulted from the theft of an unencrypted laptop computer from a VA contractor and a separate incident at a VA facility. To help protect against threats to federal systems, the Federal Information Security Management Act of 2002 (FISMA) sets forth a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. The framework creates a cycle of risk management activities necessary for an effective security program. In order to ensure the implementation of this framework, FISMA assigns specific responsibilities to agencies, the Office of Management and Budget (OMB), the National Institute of Standards and Technology (NIST), and agency inspectors general. Specifically, each agency is required to develop, document, and implement an agency-wide information security program and to report annually to OMB, selected congressional committees, and the Comptroller General on the adequacy of its information security policies, procedures, practices, and compliance with requirements. For its part, OMB is required to develop and oversee the implementation of polices, principles, standards, and guidelines on information security in federal agencies. It is also responsible for reviewing, at least annually, and approving or disapproving agency information security programs. NIST’s responsibilities include the development of security standards and guidance. Finally, inspectors general are required to evaluate annually the information security program and practices of their agency and submit the results to OMB. Further, Congress enacted the Veterans Benefits, Health Care, and Information Technology Act of 2006that year revealed weaknesses in VA’s handling of personal information. Under the act, VA’s chief information officer is responsible for establishing, maintaining, and monitoring department-wide information security policies, procedures, control techniques, training, and inspection requirements as elements of the department’s information security program. It also reinforced the need for VA to establish and carry out the responsibilities outlined in FISMA, and included provisions to further after a serious loss of data earlier protect veterans and service members from the misuse of their sensitive personal information and to inform Congress regarding security incidents involving the loss of that information. Information security remains a long-standing challenge for the department. Specifically, VA has consistently had weaknesses in major information security control areas. For fiscal years 2007 through 2013, deficiencies were reported in each of the five major categories of information security controls as defined in our Federal Information System Controls Audit Manual. Access controls ensure that only authorized individuals can read, alter, or delete data. Configuration management controls provide assurance that only authorized software programs are implemented. Segregation of duties reduces the risk that one individual can independently perform inappropriate actions without detection. Contingency planning includes continuity of operations, which provides for the prevention of significant disruptions of computer-dependent operations. Security management includes an agency-wide information security program to provide the framework for ensuring that risks are understood and that effective controls are selected and properly implemented. In fiscal year 2013, for the 12th year in a row, VA’s independent auditor reported that inadequate information system controls over financial systems constituted a material weakness. Specifically, the auditor noted that while VA had made improvements in some aspects of its security program, it continued to have control deficiencies in security management, access controls, configuration management, and contingency planning. In particular, the auditor identified significant technical weaknesses in databases, servers, and network devices that support transmitting financial and sensitive information between VA’s medical centers, regional offices, and data centers. According to the auditor, this was the result of an inconsistent application of vendor patches that could jeopardize the data integrity and confidentiality of VA’s financial and sensitive information. In addition, the VA OIG reported in 2013 that development of an effective information security program and system security controls continued to be a major management challenge for the department. The OIG noted that VA had taken steps to, for example, establish a program for continuous monitoring and implement standardized security controls across the enterprise. However, the OIG continued to identify weaknesses in the department’s security controls and noted that improvements were needed in key controls to prevent unauthorized access, alteration, or destruction of major applications and general support systems. These more recent findings are consistent with the challenges VA has historically faced in implementing an effective information security program. In a number of products issued beginning in 1998, we have identified wide-ranging, often recurring deficiencies in the department’s information security controls. These weaknesses existed, in part, because VA had not fully implemented key components of a comprehensive information security program. The persistence of similar weaknesses over 16 years later indicates the need for stronger, more focused management attention and action to ensure that VA fully implements a robust security program. In addition, we have recently reported on issues regarding the protection of personally identifiable information (PII) at federal agencies, including VA. In December 2013, we issued a report on our review of agency practices in responding to data breaches involving PII. determined the extent to which selected agencies had developed and implemented policies and procedures for responding to breaches involving PII. Regarding VA, we found that the department had addressed relevant management and operational practices in its data breach response policies and procedures. In addition, it had implemented its policies and procedures by preparing breach reports and performing risk assessments for cases of data breach. However, VA had not documented the rationale for all its risk determinations, documented the number of individuals affected by breaches, consistently notified individuals affected by high- risk breaches, consistently offered credit monitoring to affected individuals, or consistently documented lessons learned from PII breaches. Accordingly, we recommended that VA take specific steps to address these weaknesses. VA agreed with some, but not all, of these recommendations. We maintained that all our recommendations were warranted. GAO, Information Security: Agency Responses to Breaches of Personally Identifiable Information Need to Be More Consistent, GAO-14-34 (Washington, D.C.: Dec. 9, 2013). the computerized matching of personal information for purposes of determining eligibility for federal benefits programs. Under these amendments, agencies are required to establish formal agreements with other agencies to share data for computer matching, conduct cost-benefit analyses of such agreements, and establish data integrity boards to review and report on agency computer matching activities. Specifically regarding VA, we found that the department generally established computer matching agreements for its matching activities and conducted cost-benefit analyses of proposed matching programs. However, the completeness of these analyses varied in that they did not always include key costs and benefits needed to determine the value of a computer matching program. We noted that VA’s guidance for developing cost-benefit guidance did not call for including key elements. We recommended that VA revise its guidance on cost-benefit analyses and ensure that its data integrity board review the analyses to make sure they include cost savings information. VA concurred and described steps it would take to implement our recommendations. The Subcommittee is considering draft legislation that is intended to improve VA’s information security. The draft bill addresses governance of the department’s information security program and security controls for the department’s information systems. It requires the Secretary of Veterans Affairs to improve the transparency and coordination of the information security program and to ensure the security of the department’s critical network infrastructure, computers and servers, operating systems, and web applications, as well as its Veterans Health Information Systems and Technology Architecture system, from vulnerabilities that could affect the confidentiality of veterans’ sensitive personal information. For each of these elements of VA’s computing environment, the draft bill identifies specific security-related actions and activities that VA is required to perform. Many of the actions and activities specified in the proposed legislation are sound information security practices and consistent with federal guidelines, if implemented on a risk-based basis. FISMA requires agencies to implement policies and procedures that are based on risk assessments, cost-effectively reduce information security risks to an acceptable level, and ensure that information security is addressed throughout the life cycle of each agency information system. The provisions in the draft bill may prompt VA to refocus its efforts on actions that are necessary to improve the security over its information systems and information. In a dynamic environment where innovations in technology and business practices supplant the status quo, control activities that are appropriate today may not be appropriate in the future. Emphasizing that specific security-related actions should be taken based on risk could help ensure that VA is better able to meet the objectives outlined in the draft bill. Doing this would allow for the natural evolution of security practices as circumstances warrant and may also prevent the department from focusing exclusively on performing the specified actions in the draft bill to the detriment of performing other essential security activities. In summary, VA’s history of long-standing challenges in implementing an effective information security program has continued, with the department exhibiting weaknesses in all major categories of security controls in fiscal year 2013. These challenges have been further highlighted by recent determinations that weaknesses in information security have contributed to a material weakness in VA’s internal controls over financial reporting and continue to constitute a major management challenge for the department. While the draft legislation being considered by the Subcommittee may prod VA into taking needed corrective actions, emphasizing that these should be taken based on risk can provide the flexibility needed to respond to an ever-changing technology and business environment. Chairman Coffman, Ranking Member Kirkpatrick, and Members of the Subcommittee, this concludes my statement today. I would be happy to answer any questions you may have. If you have any questions concerning this statement, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov or Nabajyoti Barkakati at (202) 512-4499 or barkakatin@gao.gov. Other individuals who made key contributions to this statement include Jeffrey L. Knott and Anjalique Lawrence (assistant directors), Jennifer R. Franks, Lee McCracken, and Tyler Mountjoy. Computer Matching Act: OMB and Selected Agencies Need to Ensure Consistent Implementation. GAO-14-44. Washington, D.C.: January 13, 2014. Information Security: Agency Responses to Breaches of Personally Identifiable Information Need to Be More Consistent. GAO-14-34. Washington, D.C.: December 9, 2013. Federal Information Security: Mixed Progress in Implementing Program Components; Improved Metrics Needed to Measure Effectiveness. GAO-13-776. Washington, D.C.: September 26, 2013. Cybersecurity Human Capital: Initiatives Need Better Planning and Coordination. GAO-12-8. November 29, 2011. Information Technology: Department of Veterans Affairs Faces Ongoing Management Challenges. GAO-11-663T. Washington, D.C.: May 11, 2011. Information Security: Federal Agencies Have Taken Steps to Secure Wireless Networks, but Further Actions Can Mitigate Risk. GAO-11-43. Washington, D.C.: November 30, 2010. Information Security: Veterans Affairs Needs to Resolve Long-Standing Weaknesses. GAO-10-727T. Washington, D.C.: May 19, 2010. Information Security: Federal Guidance Needed to Address Control Issues with Implementing Cloud Computing. GAO-10-513. May 27, 2010. Information Security: Agencies Need to Implement Federal Desktop Core Configuration Requirements. GAO-10-202. Washington, D.C.: March 12, 2010. Veterans: Department of Veterans Affairs’ Implementation of Information Security Education Assistance Program. GAO-10-170R. Washington, D.C.: December 18, 2009. Department of Veterans Affairs: Improvements Needed in Corrective Action Plans to Remediate Financial Reporting Material Weaknesses. GAO-10-65. Washington, D.C.: November 16, 2009. Information Security: Protecting Personally Identifiable Information. GAO-08-343. Washington, D.C.: January 25, 2008. Information Security: Sustained Management Commitment and Oversight Are Vital to Resolving Long-Standing Weaknesses at the Department of Veterans Affairs. GAO-07-1019. Washington, D.C.: September 7, 2007. Privacy: Lessons Learned about Data Breach Notification. GAO-07-657. Washington, D.C.: April 30, 2007. Information Security: Veterans Affairs Needs to Address Long-Standing Weaknesses. GAO-07-532T. February 28, 2007. Veterans Affairs: Leadership Needed to Address Information Security Weaknesses and Privacy Issues. GAO-06-866T. Washington, D.C.: June 14, 2006. Veterans Affairs: The Critical Role of the Chief Information Officer Position in Effective Information Technology Management. GAO-05-1017T. Washington, D.C.: September 14, 2005. Information Security: Weaknesses Persist at Federal Agencies Despite Progress Made in Implementing Related Statutory Requirements. GAO-05-552. Washington, D.C.: July 15, 2005. Veterans Affairs: Sustained Management Attention Is Key to Achieving Information Technology Results. GAO-02-703. Washington, D.C.: June 12, 2002. VA Information Technology: Progress Made, but Continued Management Attention Is Key to Achieving Results. GAO-02-369T. Washington, D.C.: March 13, 2002. VA Information Technology: Important Initiatives Begun, Yet Serious Vulnerabilities Persist. GAO-01-550T. Washington, D.C.: April 4, 2001. VA Information Technology: Progress Continues Although Vulnerabilities Remain. T-AIMD-00-321. Washington, D.C.: September 21, 2000. VA Information Systems: Computer Security Weaknesses Persist at the Veterans Health Administration. AIMD-00-232. Washington, D.C.: September 8, 2000. Information Security: Serious and Widespread Weaknesses Persist at Federal Agencies. AIMD-00-295. Washington, D.C.: September 6, 2000. Information Technology: VA Actions Needed to Implement Critical Reforms. AIMD-00-226. Washington, D.C.: August 16, 2000. Information Systems: The Status of Computer Security at the Department of Veterans Affairs. AIMD-00-5. Washington, D.C.: October 4, 1999. VA Information Systems: The Austin Automation Center Has Made Progress in Improving Information System Controls. AIMD-99-161. Washington, D.C.: June 8, 1999. Major Management Challenges and Program Risks: Department of Veterans Affairs. OCG-99-15. Washington, D.C.: January 1, 1999. Information Systems: VA Computer Control Weaknesses Increase Risk of Fraud, Misuse, and Improper Disclosure. AIMD-98-175. Washington, D.C.: September 23, 1998. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The use of information technology is crucial to VA's ability to carry out its mission of ensuring that veterans receive medical care, benefits, social support, and memorials. However, without adequate security protections, VA's systems and information are vulnerable to exploitation by an array of cyber-based threats, potentially resulting in, among other things, the compromise of veterans' personal information. GAO has identified information security as a government-wide high-risk area since 1997. The number of information security incidents reported by VA has more than doubled over the last several years, further highlighting the importance of securing the department's systems and the information that resides on them. GAO was asked to provide a statement discussing the challenges VA has experienced in effectively implementing information security, as well as to comment on a recently proposed bill aimed at improving the department's efforts to secure its systems and information. In preparing this statement GAO relied on previously published work as well as a review of recent VA inspector general and other reports related to the department's security program. GAO also analyzed the draft legislation in light of existing federal requirements and best practices for information security. The Department of Veterans Affairs (VA) continues to face long-standing challenges in effectively implementing its information security program. Specifically, from fiscal year 2007 through 2013, VA has consistently had weaknesses in key information security control areas (see table). In addition, in fiscal year 2013, the department's independent auditor reported, for the 12th year in a row, that weaknesses in information system controls over financial systems constituted a material weakness. Further, the department's inspector general has identified development of an effective information security program and system security controls as a major management challenge for VA. These findings are consistent with challenges GAO has identified in VA's implementation of its security program going back to the late 1990s. More recently, GAO has reported and made recommendations on issues regarding the protection of personally identifiable information at federal agencies, including VA. These were related to developing and implementing policies and procedures for responding to data breaches, and implementing protections when engaging in computerized matching of data for the purposes of determining individuals' eligibility for federal benefits. Draft legislation being considered by the Subcommittee addresses the governance of VA's information security program and security controls for the department's systems. It would require the Secretary of VA to improve transparency and coordination of the department's security program and ensure the security of its critical network infrastructure, computers and servers, operating systems, and web applications, as well as its core veterans health information system. Toward this end, the draft legislation prescribes specific security-related actions. Many of the actions and activities specified in the bill are sound information security practices and consistent with federal guidelines. If implemented on a risk-based basis, they could prompt VA to refocus its efforts on steps needed to improve the security of its systems and information. At the same time, the constantly changing nature of technology and business practices introduces the risk that control activities that are appropriate in the department's current environment may not be appropriate in the future. In light of this, emphasizing that actions should be taken on the basis of risk may provide the flexibility needed for security practices to evolve as changing circumstances warrant and help VA meet the security objectives in the draft legislation.