The dramatic increase in computer interconnectivity and the popularity of the Internet are offering government agencies unprecedented opportunities to improve operations by reducing paper processing, cutting costs, and sharing information. At the same time, however, malicious attacks on computer systems are increasing at alarming rates and are posing serious risks to key government operations. Thus, the ultimate success of agencies’ ability to use interconnected systems to carry out critical governmental functions depends in large part on their ability to protect the integrity, privacy, and availability of the data and systems they rely upon. This Committee has long been concerned about the need to protect sensitive information in federal computer systems. These concerns are well-founded. At the request of you, Mr. Chairman, and Senator Glenn, we have undertaken a large body of work to address the issue, including reviews of most of the federal government’s largest departments’ and agencies’ computer security programs. In conjunction with our financial statement audit focus and high-risk reviews, this work has revealed a disturbing picture of our government’s lack of success in protecting federal assets from fraud and misuse, sensitive information from inappropriate disclosure, and critical operations from disruption. For example: In May 1996, we reported that computer hackers had penetrated Department of Defense computer systems; obtained and corrupted sensitive information; shut down and crashed entire systems and networks; and denied service to users who depend on automated systems to help meet critical missions, including weapons and supercomputer research, logistics, procurement, and military health. Our recommendations focused on the need for Defense to assign clear responsibility and accountability for the successful implementation of its security program, improve its security policies and procedures, increase security awareness, and implement more proactive technical protection and monitoring systems.In September 1996, we reported that, over the previous 2 years, serious weaknesses had been reported for 10 of the largest federal agencies, concluding that poor information security was a widespread federal problem with potentially devastating consequences. In that report, we recommended that the Office of Management and Budget (OMB) play a more proactive role in overseeing agency practices and managing improvements, in part through its role as chair of the Chief Information Officers (CIO) Council. In February 1997, we identified information security across all government agencies as a high-risk area. We found management and system controls to be largely inadequate, leaving critical operations at many agencies highly vulnerable to unauthorized access.In three 1997 reports, we identified a wide range of continuing serious weaknesses in Internal Revenue Service (IRS) systems, including inadequate controls over employee browsing of taxpayer records.In March 1998, in our report on the federal government’s consolidated financial statements, we emphasized that pervasive computer control weaknesses were placing enormous amounts of federal assets at risk of fraud and misuse, financial information at risk of inappropriate disclosure, and critical operations at risk of disruption. Also at your request, we are currently (1) examining computer security programs at other selected agencies including the National Aeronautics and Space Administration, (2) developing a comprehensive and detailed analysis of information security problems at the largest federal agencies, and (3) producing an updated summary of actions taken by OMB and the CIO Council to address these problems from a governmentwide perspective. Today, the Committee is releasing the redacted versions of our reports on computer security at State and FAA. These reviews resulted in many findings that are too sensitive to discuss in today’s open setting and, accordingly, detailed reports have been provided to this Committee and to appropriate agency officials under separate covers. However, we will describe the types of weaknesses found and the risks they posed to critical systems and information. Last year, this Committee asked us to assess whether the State Department’s unclassified automated information systems were susceptible to unauthorized access. State relies on a variety of decentralized information systems and networks to help it carry out its responsibilities and support business functions, such as personnel, financial management, medical, visas, passports, and diplomatic agreements and communications. The data stored in these systems, although unclassified, are sensitive enough to be attractive targets for individuals and organizations seeking monetary gain or desiring to learn about or damage State operations. For example, much of this information deals with employees working for the department and includes American and Foreign Service National personnel records, employee and retiree data, and private health records. Background investigation information about employees being considered for security clearances is also processed on State’s unclassified network. The potential consequences of misuse of this information are of major concern. For example, unauthorized deletion or alteration of data could enable known criminals, terrorists, and other dangerous individuals to enter the United States. Personnel information concerning approximately 35,000 State employees could be useful to foreign governments wishing to build personality profiles on selected employees. Manipulation of financial data could result in overpayments or underpayments to vendors, banks, and individuals, and inaccurate information being provided to agency managers and the Congress. Furthermore, the overseas activities of other federal agencies may be jeopardized to the extent they are supported by State systems. To determine State’s vulnerability to computer attacks, we tested the department’s technical and physical controls for ensuring that data, systems, and facilities are protected from unauthorized access. We designed our tests to simulate two security penetration scenarios: (1) an unauthorized individual who has no knowledge of State’s automated information infrastructure (for example, a hacker or terrorist organization) and (2) a mid-level internal user with limited access privileges and some specific computer related information (for example, a State employee) exceeding his or her limited privileges. In simulating these scenarios, we wanted to know whether an unauthorized user could compromise—that is, improperly access, modify, disclose, or destroy—sensitive data if he or she successfully penetrated State’s computer resources. During our testing, we performed controlled penetration attacks at dial-in access points, internal network security controls, the department’s Internet gateways, and public information servers. We also attempted to gain unauthorized physical access to certain State facilities and assessed users’ awareness by attempting to get them to reveal sensitive information, such as their passwords. Such techniques, sometimes referred to as social engineering, can be used by attackers to easily bypass an organization’s existing physical and logical security controls. Unfortunately, our penetration tests were largely successful. They demonstrated that State’s computer systems and the information contained within them are very susceptible to hackers, terrorists, or other unauthorized individuals seeking to damage State operations or reap financial gain by exploiting the department’s information security weaknesses. For example, without any passwords or specific knowledge of State’s systems, we successfully gained access to State’s networks through dial-in connections to modems. Having obtained this access, we could have modified, stolen, downloaded, or deleted important data; shut down services; and monitored network traffic, such as e-mail and data files. In addition, by posing as a trusted inside computer user, we were able to circumvent State’s internal network security controls and access information and sensitive data that would normally be off limits to most employees. For example, after we gained (administrator) access to host systems on several different operating platforms, such as UNIX and Windows NT, we viewed international financial information, travel arrangements, detailed network diagrams, a listing of valid users on local area networks, employees’ e-mail, performance appraisals, and other sensitive data. Our tests also showed that security awareness among State employees was problematic. For example, many computer users at State had weak passwords that were easily guessed, indicating that they were unaware of, or insensitive to, the need for secure passwords. One way to prevent password guessing is to ensure that users choose complex passwords, such as those composed of alphanumeric, upper- and lower-case characters. However, we found no evidence that State was training its users to employ these techniques. We also found little evidence that State was training its users to refrain from disclosing sensitive information. For example, we called a user under the pretense that we were systems maintenance personnel and were able to convince her to disclose her password. We also obtained access to State’s networks by breaching physical security at one facility, and finding user account information and active terminal sessions in unattended areas. For example, in several instances we were able to enter a State facility without required identification. In an unlocked office, we found unattended personal computers logged onto a local area network. We also found a user identification and password taped to one of the computers. Using these terminals, we were able to download a file that contained a password list. This list could have been used later to help hack into State’s systems. In another unlocked area, we were able to access the local area network server and obtain supervisor-level access to a workstation, which would have allowed us to even more easily circumvent controls and hide any traces of our activities. Internet security was the only area in which we found that State’s controls were currently adequate. We attempted to gain access to internal State networks by going through and around State’s Internet gateways or exploiting information servers from the outside via the Internet, but we were not able to gain access to State’s systems. State’s protection in this area was adequate, in part, because the department currently limits use and access to the Internet. However, State officials have been requesting greater Internet access and the department is considering various options for providing it. Expansion of Internet services would provide more pathways and additional tools for an intruder to attempt to enter unclassified computer resources and therefore increase the risk to State systems. Recognizing this, State conducted an analysis of the risks involved with increasing Internet use. However, the department has not yet decided to what extent it will accept and/or address these new risks. Until it does so, State will not be in a good position to expand its Internet use. The primary reason why our penetration tests were successful is that State, like many federal agencies, lacks the basic building blocks necessary to effectively manage information security risks. First, State did not have a central focal point to oversee and coordinate security activities.