State relies on a variety of decentralized information systems and networks to help it carry out its responsibilities and support business functions, such as personnel, financial management, medical, visas, passports, and diplomatic agreements and communications. The data stored in these systems is sensitive enough to be attractive targets for individuals and organizations seeking monetary gain or desiring to learn about or damage State operations. For example, much of this information deals with State employees and includes American and Foreign Service National personnel records, employee and retiree pay data, and private health records. Background investigation information about employees being considered for security clearances is also processed on State’s unclassified network as is sensitive financial and procurement information. The potential consequences of misuse of this information are of major concern. For example, unauthorized deletion or alteration of data could enable dangerous individuals to enter the United States. In addition, personnel information concerning approximately 35,000 State employees could be useful to foreign governments wishing to build personality profiles on selected employees. Further, manipulation of financial data could result in over- or underpayments to vendors, banks, and individuals, and inaccurate information being provided to agency managers and the Congress. Our objectives were to (1) determine how susceptible the State Department’s automated information systems are to unauthorized access, (2) identify what the State Department is doing to address information security issues, and (3) determine what additional actions may be needed. To determine how susceptible State’s systems are to unauthorized access, we tested the department’s technical and physical controls for ensuring that data, systems, and facilities were protected from unauthorized access. We tested the operation of these controls to determine whether they existed and were operating effectively. We contracted with a major public accounting firm to assist in our evaluation and testing of these controls. We determined the scope of our contractor’s audit work, monitored its progress, and reviewed the related work papers to ensure that the resulting findings were adequately supported. During our testing, we performed controlled penetration attacks at dial-in access points, the department’s Internet gateways, and public information servers. We also performed penetration activities to access security controls on State’s major internal networks. In addition, we performed social engineeringactivities to assess user awareness, and attempted to gain physical access to two State facilities. We attempted to access State’s sensitive data and programs under conditions negotiated with State Department officials known as “rules of engagement.” These rules were developed to assist us in obtaining access to State’s facilities and information resources and to prevent damage to any systems or sensitive information. Under the rules, all testing was required to take place within the department’s headquarters building between 8:00 a.m. and 10:00 p.m. and was physically monitored by State employees and contractor personnel. In addition, State monitors were authorized to stop our testing when we obtained access to sensitive information or systems. We were also required to inform State personnel about the types of tests we planned to conduct prior to the testing. As agreed with State, we limited the scope of our testing to unclassified systems. To identify what State is doing to address the issue of unauthorized access to its information systems, we discussed with department officials their efforts to protect these systems and reviewed supporting documentation. For example, we obtained information on the department’s initiatives to improve the security of its mainframe computers and establish a centrally managed information system security officer program at headquarters. We also discussed with department officials preliminary plans to expand the use of the Internet and reviewed supporting documentation. We reviewed numerous evaluations of information security at domestic State locations and foreign posts performed by the department’s Bureau of Diplomatic Security. We reviewed recent reports submitted by State to the President and the Congress under provisions of the 1982 Federal Managers’ Financial Integrity Act, which outlined known information management and technology weaknesses and plans for corrective actions. We reviewed the department’s policy guidance on information security as contained in the Foreign Affairs Manual, Volume 1 and Volume 12, Chapter 600, and its Fiscal Year 1997-2001 Strategic and Performance Management Plan for Information Resources Management. We visited a computer security assessment center in Fairfax, Virginia, which the department uses primarily for certifying and accrediting software to be used on State information systems. To evaluate State’s security program management and formulate recommendations for improvement, we compared State’s practices to guidelines in two National Institute of Standards and Technology (NIST) publications, the “Generally Accepted Principles and Practices for Securing Information Technology Systems” and “An Introduction to Computer Security: The NIST Handbook,” as well as other guides and textbooks. In addition, we reviewed a Department of State Inspector General report on unclassified mainframe systems security. We also relied on our work to identify the best information security management practices of non-federal organizations which is presented in our Executive Guide Information Security Management: Learning From Leading Organizations (GAO/AIMD-98-21 Exposure Draft, November 1997). The guide identifies key elements of an effective information security program and practices which eight leading nonfederal organizations have adopted and details the management techniques these leading organizations use to build information security controls and awareness into their operations. We performed our audit work primarily at State Department headquarters offices from July 1996 through August 1997 in accordance with generally accepted government auditing standards. Our penetration tests revealed that State’s sensitive but unclassified information systems can be easily accessed by unauthorized users who in turn can read, delete, modify, or steal sensitive information on State’s operations. First, while simulating outside attackers without knowledge of State’s systems, we were able to successfully gain unauthorized access to State’s networks through dial-in connections to modems. Having obtained this access, we could have modified or deleted important data, shut down services, downloaded data, and monitored network traffic such as e-mail and data files. We also tested internal network security controls and found them to be inadequate. For example, we were able to gain privileged (administrator) access to host systems on several different operating platforms (such as UNIX and Windows NT). This access enabled us to view international financial data, travel arrangements, detailed network diagrams, a listing of valid users on local area networks, e-mail, and performance appraisals, among other sensitive data. Our tests also found that security awareness among State employees is problematic. We were able to gain access to State’s networks by guessing user passwords, bypassing physical security at one facility, and searching unattended areas for user account information and active terminal sessions. For example, in several instances we were able to enter a State facility without required identification. In an unlocked work area for one office, we found unattended personal computers logged onto a local area network. We also found a user identification and password taped to one of the computers. Using these terminals, we were able to download a file that contained a password list. In another unlocked area, we were able to access the local area network server and obtain supervisor-level access to a workstation. With this access, we could have added or deleted users, implemented unauthorized programs, and eliminated audit trails. Our tests of dial-in-security, internal network security, and physical security demonstrated that information critical to State’s operations as well as to the operations of other federal agencies operating overseas can be easily accessed and compromised. For example, we gained access to information that detailed the physical layout of State’s automated information infrastructure. These data would make it much easier for an outsider who had no knowledge of State’s operations or infrastructure to penetrate the department’s computer resources. In addition, we obtained information on administrative and sensitive business operations which may be attractive targets to adversaries or hackers. At the conclusion of our testing, we provided senior State managers with the test results and suggestions for correcting the specific weaknesses identified. Our tests were successful primarily because State’s computer security program is not comprehensive enough to effectively manage the risks to which its systems and networks are exposed. For example, the department does not have the information it needs to effectively manage its risks—it does not fully appreciate the sensitivity of its information, the vulnerabilities of its systems, or the costs of countermeasures. In addition, security is not managed by a strong focal point within the agency that can oversee and coordinate security activities. State also does not have the types of controls needed to ensure the security of its sensitive information, including current and complete security policies and enterprisewide incident reporting and response capability. Moreover, top managers at State have not demonstrated that they are committed to strengthening security over the systems that they rely on for nearly every aspect of State’s operations. Our study of information security management at leading organizations identified the following five key activities that are necessary in order to effectively manage security risks. A strong framework with a central management focal point and ongoing processes to coordinate efforts to manage information security risks. Risk assessment procedures that are used by business managers to determine whether risks should be tolerated or mitigated and to select appropriate controls. Comprehensive and current written policies that are effectively implemented and then updated to address new risks or clarify areas of misunderstanding. Steps to increase the awareness of users concerning the security risks to information and systems and their responsibilities in safeguarding these assets. Ability to monitor and evaluate the effectiveness of policy and other controls. Furthermore, each of these activities should be linked in a cycle to help ensure that business risks are continually monitored, policies and procedures are regularly updated, and controls are in effect. Perhaps the single most important factor in prompting the establishment of an effective information security program is commitment from top management. Ultimately, it is top managers who ensure that the agency embraces all elements of good security and who drive the risk management cycle of activity. However, State’s top managers are not demonstrating the commitment necessary to practice good security and State’s information security program does not fully incorporate any of the activities described above.