VA is responsible for administering health care and other benefits, such as compensation and pensions, life insurance protection, and home mortgage loan guarantees, that affect the lives of more than 25 million veterans and approximately 44 million members of their families. In providing these benefits and services, VA collects and maintains sensitive medical record and benefit payment information for veterans and their family members. AAC is one of VA’s three centralized data centers. It maintains the department’s financial management and other departmentwide systems, including centralized accounting, payroll, vendor payment, debt collection, benefits delivery, and medical systems. AAC also provides, for a fee, information technology services to other government agencies. As of November 1998, the center either provided or had entered into contracts to provide information technology services, including batch and online processing and workers’ compensation and financial management computer applications, for nine other federal agencies. In fiscal year 1998, the VA's payroll was more than $11 billion and the centralized accounting system processed more than $7 billion in administrative payments. AAC also maintains medical information for both inpatient and outpatient care. For example, AAC systems document admission, diagnosis, surgical procedure, and discharge information for each stay in a VA hospital, nursing home, or domiciliary. In addition, AAC systems contain information concerning each of the guaranteed or insured loans closed by VA since 1944, including about 3.5 million active loans. As one of VA’s three centralized data centers, AAC is part of a vast array of computer systems and telecommunication networks that VA relies on to support its operations and store the sensitive information the department collects in carrying out its mission. The remaining two data centers support VA’s compensation, pension, education, and life insurance benefit programs. In addition to the three centralized data centers, the Veterans Health Administration operates 172 hospitals at locations across the country that operate local financial management and medical support systems on their own computer systems. These data centers and hospitals are interconnected, along with 58 Veterans Benefits Administration regional offices, the VA headquarters office, and customer organizations such as non-VA hospitals and medical universities, through a wide area network. All together, VA’s network services over 700 locations nationwide, including Puerto Rico and the Philippines. Our objective was to evaluate and test the effectiveness of information system general controls over the financial systems maintained and operated by VA at AAC. General controls, however, also affect the security and reliability of nonfinancial information, such as veteran medical and loan data, maintained at this processing center. Specifically, we evaluated information system general controls intended to protect data, files, programs, and equipment from unauthorized access, modification, and destruction; prevent the introduction of unauthorized changes to application and provide adequate segregation of duties involving application programming, system programming, computer operations, security, and quality assurance; ensure recovery of computer processing operations in case of a disaster or other unexpected interruption; and ensure that an effective computer security planning and management program is in place. We restricted our evaluation to AAC because VA's Office of Inspector General was planning to review information system general controls for fiscal year 1998 at the Hines and Philadelphia benefits delivery centers. To evaluate information system general controls, we identified and reviewed AAC's general control policies and procedures. We also tested and observed the operation of information system general controls over AAC's information systems to determine whether they were in place, adequately designed, and operating effectively. In addition, we determined the status of previously identified computer security weaknesses, but did not perform any follow-up penetration testing. We performed our review from October 1998 through March 1999, in accordance with generally accepted government auditing standards. Our evaluation was based on the guidance provided in our Federal Information System Controls Audit Manual (FISCAM) and the results of our May 1998 study of security management best practices at leading organizations. After we completed our fieldwork, the director of AAC provided us with updated information regarding corrective actions. We did not verify these corrective actions but plan to do so as part of future reviews. VA provided us with written comments on a draft of this report, which are discussed in the “Agency Comments” section and reprinted in appendix I. AAC has made substantial progress in addressing the computer security issues we previously identified. At the time of our review in 1998, AAC had corrected 40 of the 46 weaknesses that we discussed with the director of AAC and summarized in our September 1998 report on VA computer security. AAC had addressed most of the access control, system software, segregation of duties, and service continuity weaknesses we identified in 1997 and had improved computer security planning and management. For example, AAC had reduced the number of users with access to the computer room, restricted access to certain sensitive libraries, audit information, and established password and dial-in access controls, developed a formal system software change control process, expanded tests of its disaster recovery plan, and established a centralized computer security group. AAC was also proactive in addressing additional computer security issues we identified during our current review. We identified a continuing risk of unauthorized access to financial and sensitive veteran medical and benefit information because the center had not fully implemented a comprehensive computer security planning and management program. If properly designed, such a program should identify and correct the types of additional access control and system software weaknesses that we found. In addition, AAC risks certain types of unauthorized access not being detected because it had not completely corrected the user access monitoring weaknesses we previously identified. Our May 1998 study of security management best practices found that a comprehensive computer security planning and management program is essential to ensure that information system controls work effectively on a continuing basis. Under an effective computer security planning and management program, staff (1) periodically assess risks, (2) implement comprehensive policies and procedures, (3) promote security awareness, and (4) monitor and evaluate the effectiveness of the computer security environment. In addition, a central security staff is important for providing guidance and oversight for the computer security planning and management program to ensure an effective information system control environment. AAC had established a solid foundation for its computer security planning and management program by creating a centralized computer security group, developing a comprehensive security policy, and promoting security awareness. However, AAC had not yet instituted a framework for continually assessing risks or routinely monitoring and evaluating the effectiveness of information system controls. In March 1999, the director of AAC told us that the center plans to expand its computer security planning and management program to include these aspects. In addition, the director told us that AAC had augmented its security management organization by hiring two additional security experts in May 1999. A comprehensive computer security planning and management program should provide AAC with a solid foundation for ensuring that appropriate controls are designed, implemented, and operating effectively. Periodically assessing risk is an important element of computer security planning because it provides the foundation for the other aspects of computer security management. Risk assessments not only help management determine which controls will most effectively mitigate risks, but also increase awareness and, thus, generate support for adopted policies and controls. An effective risk assessment framework generally includes procedures that link security to business needs and provide for continually managing risk. VA policy requires that risk assessments be performed when significant changes are made to a facility or its computer systems, but at least every 3 years. AAC had not formally reassessed risk since 1996 even though significant changes to the facility and its systems had occurred. For example, AAC management told us that the center had replaced its mainframe computer, implemented a new mainframe operating system, and expanded the facility to accommodate a VA finance center in 1998. Although the director of AAC told us in March 1999 that changes in computer security risks were considered by implementation teams responsible for these events, documentation of such considerations were not available. Formal risk assessments should be performed for such significant changes. The director of AAC also told us that management would perform a risk assessment later in 1999 to comply with VA policy. One reason that AAC had not formally assessed risks when these significant changes occurred was that the center had not developed a framework for assessing and managing risk on a continuing basis. In March 1999, the director of AAC told us that a risk assessment framework would be developed and added to the AAC security handbook. According to the director, this planned risk assessment framework will define the types of changes that require a risk assessment; specify risk assessment procedures that can be adapted to different indicate who should conduct the assessment, preferably a mix of individuals with knowledge of business operations, security controls, and technical aspects of the computer systems involved; and describe requirements for documenting the results of the assessment. In addition to assessing risk to identify appropriate controls, it is also important to determine if the controls in place are operating as intended to reduce risk. Our May 1998 study of security management best practices found that an effective control evaluation program includes processes for (1) monitoring compliance with established information system control policies and guidelines, (2) testing the effectiveness of information system controls, and (3) improving information system controls based on the results of these activities. AAC had not established a program to routinely monitor and evaluate the effectiveness of information system controls. Such a program would allow AAC to ensure that policies remain appropriate and that controls accomplish their intended purpose. Although AAC had substantially corrected previously identified computer security weaknesses, we tested additional access and system software controls and found weaknesses that posed risks of unauthorized modification, disclosure, or destruction of financial and sensitive veteran medical and benefit information. These weaknesses included inadequately limiting access of authorized users to sensitive data and programs, maintaining the system software environment, and reviewing network security. Several of these weaknesses could have been identified and corrected if AAC had been monitoring compliance with established procedures. For example, periodically reviewing AAC user access authority to ensure that it was limited to the minimum required access level based on job requirements would have allowed AAC to discover and fix the types of additional access control weaknesses we identified. Likewise, routinely evaluating the technical implementation of its system software would have permitted AAC to eliminate or mitigate the additional system software exposures we identified. A program to regularly test information system controls would also have allowed AAC to detect additional network security weaknesses. For example, using network analysis software designed to detect network vulnerabilities, we determined that intrusion attempts on 2 of the 10 network access control paths would not be detected. Although AAC fixed this problem before our fieldwork was completed, AAC staff could have identified and corrected this exposure using similar network analysis software available to them. AAC staff told us that they also plan to begin evaluating the intrusion detection system periodically. In addition, AAC had not established a process to test network security when major changes to the network occur. Although AAC had used network analysis software to detect network vulnerabilities earlier in October 1998, we determined that both a production and a development network system had a system program with vulnerabilities commonly known to the hacker community. These vulnerabilities could have provided the opportunity to bypass security controls and gain unlimited access to AAC network systems. Although AAC staff determined that the vulnerable programs were no longer needed and deleted them before our fieldwork was completed, these vulnerabilities could have been prevented had network security been reassessed when the network environment changed. AAC was also not adequately monitoring certain user access activity. A comprehensive user access monitoring program would include routinely reviewing user access activity to identify and investigate both failed attempts to access sensitive data and resources and unusual or suspicious patterns of successful access to sensitive data and resources. Such a program is critical to ensuring that improper access to sensitive information would be detected. Because the volume of security information available is likely to be too voluminous to review routinely, the most effective monitoring efforts are those that selectively target unauthorized, unusual, and suspicious patterns of access to sensitive data and resources, such as security software, system software, application programs, and production data. AAC had begun reviewing failed attempts to access sensitive data and resources, but had not established a program to monitor successful access to these resources for unusual or suspicious activity. In March 1999, the director of AAC told us that the center is expanding its user access activity monitoring to identify and investigate unusual or suspicious patterns of access to sensitive resources, such as updates to security files that were not made by security staff, changes to sensitive system files that were not performed by system modifications to production application programs that were not initiated by production control staff, revisions to production data that were completed by system or deviations from normal patterns of access to sensitive veteran medical and benefit data. In addition to the access activity monitoring and computer security program planning and management weaknesses that remain open from 1997, we identified 16 additional issues during our 1998 review. For example, AAC had not restricted access to certain sensitive data and programs based on job routinely reviewed access authorities granted to employees to ensure that they were still appropriate, adequately reviewed certain components of its operating system to ensure continued system integrity, adequately documented changes to network servers, documented testing of certain emergency changes to its financial issued technical security standards for maintaining the integrity of system and security software for certain operating system environments. AAC had corrected 6 of the 16 additional issues identified in 1998 before we completed our site visit in Austin. Addressing the remaining additional issues should help AAC ensure that an effective computer security environment is achieved and maintained. We discussed these issues with AAC management and staff and were told that they would be addressed by September 1999. AAC had made substantial progress in improving information system general controls. In addition to correcting most of the access control, system software, segregation of duties, and service continuity weaknesses we had previously identified, AAC had strengthened its computer security planning and management program by creating a centralized computer security group, developing a comprehensive security policy, and promoting security awareness. Until AAC completes implementing its computer security planning and management program by establishing a framework for continually assessing risks and routinely monitoring and evaluating the effectiveness of information system controls, it will not have adequate assurance that appropriate controls are established and operating effectively. We identified additional access, system software, and application change control weaknesses that continued to place financial and sensitive veteran medical and benefit information on AAC systems at risk of improper modification, disclosure, or destruction and assets at risk of loss. Unauthorized access may not be detected because AAC had not begun identifying and investigating unusual or suspicious patterns of successful access to sensitive data and resources. AAC could have identified and corrected these types of weaknesses, which could also adversely affect other agencies that depend on AAC for computer processing support, had it fully implemented an effective computer security planning and management program. We recommend that the Acting VA Chief Information Officer (CIO) work with the director of AAC to implement policies and procedures for assessing and managing risk on a establish processes for (1) monitoring compliance with established information system control policies and procedures, (2) testing the effectiveness of information system controls, and (3) improving information system controls based on the results of these activities; and expand the center’s user access activity monitoring program to identify and investigate unusual or suspicious patterns of successful access to sensitive data and resources for unauthorized access. We also recommend that the Acting VA CIO coordinate with the director of AAC to ensure that the remaining computer security weaknesses are corrected. These weaknesses are summarized in this report and detailed in a separate report, which is designated for “Limited Official Use,” also issued today. In commenting on a draft of this report, VA agreed to implement our recommendations by September 30, 1999. Specifically, VA stated that AAC would update its security handbook to include a risk assessment framework, establish a program to routinely monitor and evaluate the effectiveness of controls, and complete procedures for monitoring successful access to sensitive computer resources by the end of September 1999. VA also informed us that AAC had taken action to correct all but three of the other weaknesses we identified and plans to address the remaining weaknesses by September 30, 1999. Within 60 days of the date of this letter, we would appreciate receiving a statement on actions taken to address our recommendations. We would like to thank AAC for the courtesy and cooperation extended to our audit team. We are sending copies of this report to Senator Arlen Specter, Senator Ted Stevens, Senator Robert C. Byrd, Senator Fred Thompson, Senator Joseph Lieberman, Senator John D. Rockefeller IV, Representative C. W. Bill Young, Representative Lane Evans, III, Representative Bob Stump, Representative David Obey, Representative Dan Burton, and Representative Henry A. Waxman in their capacities as Chairmen or Ranking Minority Members of Senate and House Committees. We are also sending copies to Togo D. West, Jr., Secretary of Veterans Affairs and the Honorable Jacob J. Lew, Director of the Office of Management and Budget. In addition, copies will be made available to others upon request. If you have any questions or wish to discuss this report, please contact me at (202) 512-3317. Major contributors to this report are listed in appendix II. David W. Irvin, Assistant Director Debra M. Conner, Senior EDP Auditor Shannon Q. Cross, Senior Evaluator Charles M. Vrabel, Senior EDP Auditor The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary, VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 37050 Washington, DC 20013 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (202) 512-6061, or TDD (202) 512-2537. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a legislative requirement, GAO assessed the effectiveness of information system general controls at the Department of Veterans Affairs' (VA) Austin Automation Center (AAC). GAO noted that: (1) AAC had made substantial progress in correcting specific computer security weaknesses that GAO identified in its previous evaluation of information system controls; (2) AAC had established a solid foundation for its computer security planning and management program by creating a centralized computer security group, developing a comprehensive security policy, and promoting security awareness; (3) however, AAC had not yet established a framework for continually assessing risks and routinely monitoring and evaluating the effectiveness of information system controls; (4) GAO also identified additional computer security weaknesses that increased the risk of inadvertent or deliberate misuse, fraudulent use, improper disclosure, and destruction of financial and sensitive veteran medical and benefit information on AAC systems; (5) an effective computer security planning and management program would have allowed AAC to identify and correct the types of additional weaknesses that GAO identified; (6) in addition, AAC continues to run the risk that unauthorized access may not be detected because it had not established a program to identify and investigate unusual or suspicious patterns of successful access to sensitive data and resources; (7) these weaknesses could also affect other agencies that depend on AAC information technology services; (8) AAC was very responsive to addressing new security exposures identified and corrected several weaknesses before GAO's fieldwork was completed; (9) the Acting Assistant Secretary for Information Technology said VA would implement all of GAO's recommendations by September 30, 1999; and (10) addressing the remaining issues will help ensure that an effective computer security environment is achieved and maintained.