HHS is the federal government’s principal agency responsible for protecting the health of all Americans and providing essential human services, especially for those who are least able to help themselves. The department manages more than 300 programs covering a wide spectrum of activities that include health and social science research, disease prevention, food and drug safety, health information technology, health insurance for elderly and disabled Americans (Medicare), health insurance for low-income people (Medicaid), and comprehensive health services for Native Americans. Other services provided by the department include financial assistance to low-income families, pre-school education programs such as Head Start, child abuse and domestic violence programs, substance abuse treatment and prevention programs, and programs to help older Americans, such as providing home-delivered meals. HHS has 14 operating divisions (see app. III for a description of each division) to manage its programs and administered more grant dollars than all other federal agencies combined. HHS employs about 67,000 employees and is responsible for managing a fiscal year 2005 budget of approximately $581 billion. Each year HHS handles more than a billion health care claims, supports over 38,000 research projects focusing on diseases, provides funding to treat more than 650,000 persons with serious substance abuse or mental health problems, and serves more than 900,000 pre-school children. The Centers for Medicare & Medicaid Services (CMS) is an HHS operating division responsible for administering two major health programs. It administers the Medicare program, the nation’s largest health insurance program, which covers more than 42 million Americans. This program was enacted to extend affordable health insurance coverage to the elderly and was later expanded to cover the disabled. In partnership with the states, CMS also administers Medicaid, a means-tested health care program for low-income Americans. Medicaid is the primary source of health care for a large population of medically vulnerable Americans, including poor families, the disabled, and persons with developmental disabilities requiring long-term care. In coordination with the Medicaid program, the State Children’s Health Insurance Program provides health care coverage for children. CMS employs about 4,900 employees and has a fiscal year 2005 budget of approximately $480 billion or 83 percent of the HHS budget, as shown in figure 1. HHS relies extensively on computerized systems to support its mission critical operations and store the sensitive information it collects. It uses these systems to support the department’s financial and management functions, maintain sensitive employee personnel information, and process financial and medical data for millions of health care recipients. Its local and wide area networks interconnect these systems. In addition, HHS relies on contractor-owned systems to process departmental information and support its mission. For fiscal year 2005, HHS planned to spend nearly $5 billion on information technology—more than any other federal agency except the Department of Defense. A significant amount of these funds will be spent to facilitate the processing and payment of Medicare claims processed by CMS or its Medicare contractors. Information system controls are a critical consideration for any organization that depends on computerized systems and networks to carry out its mission or business. Without proper safeguards, there is risk that individuals and groups with malicious intent may intrude into inadequately protected systems and use this access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. In December 2002, Congress enacted the Federal Information Security Management Act of 2002 (FISMA) to strengthen security of information and information systems within federal agencies. FISMA requires each agency to develop, document, and implement an agencywide information security program to provide information security for the information and systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. In addition, FISMA provides that the Secretary of HHS is responsible for, among other things, (1) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the agency’s information systems and information; (2) ensuring that senior agency officials provide information security for the information and information systems that support the operations and assets under their control; and (3) delegating to the agency CIO the authority to ensure compliance with the requirements imposed on the agency under the act. HHS’s CIO is responsible for developing, promoting, and coordinating the departmentwide information security program; developing, promulgating, and enforcing department information resource management policies, standards, and guidelines; and appointing the HHS chief information security officer. Each operating division, including CMS, is responsible for complying with the requirements of FISMA and departmentwide security-related policies, procedures, and standards; reporting on the effectiveness of its information security program; and ensuring that information systems operated by or on its behalf by contractors provide adequate risk-based security safeguards. HHS and CMS in particular have significant weaknesses in electronic access controls and other information system controls designed to protect the confidentiality, integrity, and availability of information and information systems. A key reason for these weaknesses is that the department has not yet fully implemented a departmentwide information security program. As a result, HHS’s medical and financial information systems are vulnerable to unauthorized access, use, modification, and destruction that could disrupt the department’s operations. A basic management objective for any organization is to protect the resources that support its critical operations from unauthorized access. Organizations accomplish this objective by designing and implementing electronic controls that are intended to prevent, limit, and detect unauthorized access to computing resources, programs, and information. Inadequate electronic access controls diminish the reliability of computerized information and increase the risk of unauthorized disclosure, modification, and destruction of sensitive information and disruption of service. Electronic access controls include those related to network management, user accounts and passwords, user rights and file permissions, and auditing and monitoring of security-related events. Our analysis of reports issued by the OIG and independent auditors disclosed that HHS did not consistently implement effective electronic access controls in each of these areas. Networks are collections of interconnected computer systems and devices that allow individuals to share resources such as computer programs and information. Because sensitive programs and information are stored on or transmitted along networks, effectively securing networks is essential to protecting computing resources and data from unauthorized access, manipulation, and use. Organizations secure their networks, in part, by installing and configuring network devices that permit authorized network service requests, deny unauthorized requests, and limit the services that are available on the network. Devices used to secure networks include (1) firewalls that prevent unauthorized access to the network, (2) routers that filter and forward data along the network, (3) switches that forward information among segments of a network, and (4) servers that host applications and data. Network services consist of protocols for transmitting data between network devices. Insecurely configured network services and devices, including those without current software patches, can make a system vulnerable to internal or external threats, such as denial-of-service attacks. Because networks often include both external and internal access points for electronic information assets, failure to adequately secure these access points increases the risk of unauthorized disclosure and modification of sensitive information or disruption of service. HHS policy requires that all incoming and outgoing connections from departmental systems and networks to the Internet, intranets, and extranets be made through a firewall and that effective technical controls be implemented to protect computing resources connected to the network. Our analysis found that HHS did not consistently configure network services and devices securely to prevent unauthorized access to and ensure the integrity of computer systems operating on its networks. The reports we reviewed identified weaknesses in the way that HHS operating divisions and contractors restricted network access, managed antivirus software, configured network devices, and protected information traversing the HHS networks. For example, System administrative access was not always adequately restricted, and unnecessary services were available on several network devices, increasing the risk that unauthorized individuals could gain access to the operating system. Antivirus software was not always installed or up-to-date on the operating divisions’ and contractors’ workstations, increasing the risk that viruses could infect HHS systems and potentially disable or disrupt system operations. Key network devices were not securely configured to prevent unauthorized individuals from gaining access to sensitive system configuration files and router access control lists. These weaknesses could allow an external attacker to circumvent network controls and thereby gain unauthorized access to the internal network. HHS did not encrypt certain information traversing its networks. Instead, it used clear text protocols that make network traffic susceptible to eavesdropping. HHS’s operating divisions and contractors did not consistently patch their computer systems and network devices in a timely manner. For example, the OIG reported that approximately 25 percent (287 of 1,129) of the systems tested at one operating division did not have up-to-date patches installed on them. Thirty of the machines tested were missing nine or more software patches that had been rated as critical by the vendor. At another operating division, over 90 high-risk software patch management vulnerabilities were outstanding from June 1999 through April 2005. Failure to keep system patches up-to-date could lead to denial-of-service attacks or to individuals gaining unauthorized access to network resources. According to the HHS chief information security officer, a patch management subcommittee was formed to address this issue and has formulated and published an approach to the department’s patch management problems. A computer system must be able to identify and differentiate among users so that activities on the system can be linked to specific individuals. When an organization assigns unique user accounts to specific users, the system is able to distinguish one user from another—a process called identification. The system must also establish the validity of a user’s claimed identity by requesting some kind of information, such as a password, that is known only by the user—a process known as authentication. The combination of identification and authentication— such as user account and password combinations—provides the basis for establishing individual accountability and for controlling access to the system.