Computer Security_2.txt

                                     United States General Accounting Office
          ___________________________________________________________________
          GAO                         Report to the Chairman, Committee on
                                      Science, Space, and Technology,
                                      House of Representatives

          ___________________________________________________________________
          May 1990                    COMPUTER SECURITY

                                      Governmentwide Planning Process
                                      Had Limited Impact




          ___________________________________________________________________
          GAO/IMTEC-90-48













         This U.S. General Accounting Office (GAO) report is 1 of 7
         available over the Internet as part of a test to determine
         whether there is sufficient interest within this community to
         warrant making all GAO reports available over the Internet.
         The file REPORTS at NIH lists the 7 reports.

         So that we can keep a count of report recipients, and your
         reaction, please send an E-Mail message to KH3@CU.NIH.GOV and
         include, along with your E-Mail address, the following
         information:

              1)   Your organization.

              2)   Your position/title and name (optional).

              3)   The title/report number of the above reports you have
                   retrieved electronically or ordered by mail or phone.

              4)   Whether you have ever obtained a GAO report before.

              5)   Whether you have copied a report onto another bulletin
                   board--if so, which report and bulletin board.

              6)   Other GAO report subjects you would be interested in.
                   GAO's reports cover a broad range of subjects such as
                   major weapons systems, energy, financial institutions,
                   and pollution control.

              7)   Any additional comments or suggestions.

         Thank you for your time.


         Sincerely,

         Jack L. Brock, Jr.
         Director,
         Government Information and Financial
         Management Issues
         Information Management and Technology Division










                 B-238954


                 May 10, 1990


                 The Honorable Robert A. Roe
                 Chairman, Committee on Science,
                   Space, and Technology
                 House of Representatives

                 Dear Mr. Chairman:

                 This report responds to your June 5, 1989, request and
                 subsequent agreements with your office that we review the
                 governmentwide computer security planning and review process
                 required by the Computer Security Act of 1987.  The act
                 required federal agencies to identify systems that contain
                 sensitive information and to develop plans to safeguard
                 them.  As agreed, we assessed the (1) planning process in 10
                 civilian agencies as well as the extent to which they
                 implemented planned controls described in 22 selected plans
                 and (2) National Institute of Standards and Technology
                 (NIST)/National Security Agency (NSA) review of the plans.

                 This is the fifth in a series of reports on implementation
                 of the Computer Security Act that GAO has prepared for your
                 committee.  Appendix I details the review's objectives,
                 scope, and methodology.  Appendix II describes the systems
                 covered by the 22 plans we reviewed.

                 RESULTS IN BRIEF
                 ----------------
                 The planning and review process implemented under the
                 Computer Security Act did little to strengthen computer
                 security governmentwide.  Although agency officials believe
                 that the process heightened awareness of computer security,
                 they typically described the plans as merely "reporting
                 requirements" and of limited use in addressing agency-
                 specific problems.

                 Officials cited three problems relating to the design and
                 implementation of the planning process:  (1) the plans
                 lacked adequate information to serve as management tools and
                 some agencies already had planning processes in place, (2)
                 managers had little time to prepare the plans, and (3) the
                 Office of Management and Budget (OMB) planning guidance was
                 sometimes unclear and misinterpreted by agency officials.



                                          1










                 B-238954

                 Although a year has passed since the initial computer
                 security plans were completed, agencies have made little
                 progress in implementing planned controls.  Agency officials
                 said that budget constraints and inadequate top management
                 support--in terms of resources and commitment--were key
                 reasons why controls had not been implemented.

                 Based on the results of the planning and review process,
                 OMB--in conjunction with NIST and NSA--issued draft security
                 planning guidance in January 1990.  The draft guidance
                 focuses on agency security programs and calls for NIST, NSA,
                 and OMB to visit agencies to discuss their security programs
                 and problems, and provide advice and technical assistance.
                 We believe that efforts directed toward assisting agencies
                 in solving specific problems and drawing top management
                 attention to computer security issues have greater potential
                 for improving computer security governmentwide.

                 BACKGROUND
                 ----------
                 The Computer Security Act of 1987 (P.L. 100-235) was passed
                 in response to concerns that the security of sensitive
                 information was not being adequately addressed in the
                 federal government.1  The act's intent was to improve the
                 security and privacy of sensitive information in federal
                 computer systems by establishing minimum security practices.
                 The act required agencies to (1) identify all developmental
                 and operational systems with sensitive information, (2)
                 develop and submit to NIST and NSA for advice and comment a
                 security and privacy plan for each system identified, and
                 (3) establish computer security training programs.

                 OMB Bulletin 88-16, developed with NIST and NSA assistance,
                 provides guidance on the computer security plans required by
                 the act.  To be in compliance, approximately 60 civilian
                 agencies submitted almost 1,600 computer security plans to a
                 NIST/NSA review team in early 1989.  Nearly all of these
                 plans followed, to some degree, the format and content
                 requested by the bulletin.  The bulletin requested that the
                 following information be included in each plan:


                1The act defines sensitive information as any unclassified
                 information that in the event of loss, misuse, or
                 unauthorized access or modification, could adversely affect
                 the national interest, conduct of a federal program, or the
                 privacy individuals are entitled to under the Privacy Act of
                 1974 (5 U.S.C. 552a).

                                          2










                 B-238954

                 -- Basic system identification:  agency, system name and
                    type, whether the plan combines systems, operational
                    status, system purpose, system environment, and point of
                    contact.

                 -- Information sensitivity:  laws and regulations affecting
                    the system, protection requirements, and description of
                    sensitivity.

                 -- Security control status:  reported as "in place,"
                    "planned," "in place and planned" (i.e., some aspects of
                    the control are operational and others are planned), or
                    "not applicable," and a brief description of and expected
                    operational dates for controls that are reported as
                    planned.2  (Appendix V lists the controls.)

                 Appendix III presents a composite security plan that we
                 developed for this report as an example of the civilian
                 plans we reviewed.  It is representative of the content,
                 format, and common omissions of the plans.

                 PLANS HAD LIMITED IMPACT ON
                 ---------------------------
                 AGENCY COMPUTER SECURITY PROGRAMS
                 ---------------------------------
                 The goals of the planning process were commendable--to
                 strengthen computer security by helping agencies identify
                 and evaluate their security needs and controls for sensitive
                 systems.  According to agency officials, the process yielded
                 some benefits, the one most frequently cited being increased
                 management awareness of computer security.  Further, some
                 officials noted that the planning process provided a
                 framework for reviewing their systems' security controls.

                 However, problems relating to the design and implementation
                 of the planning process limited its impact on agency
                 security programs.  Specifically, (1) the plans lacked
                 adequate information to serve as effective management tools,
                 (2) managers had little time to prepare the plans, and (3)
                 the OMB guidance was sometimes unclear and misinterpreted by
                 the agencies.  Consequently, most agency officials viewed
                 the plans as reporting requirements, rather than as
                 management tools.


                2In this report, we are using the term "planned controls" to
                 include controls that agencies listed as "planned" or "in
                 place and planned" in their January 1989 plans.  Both
                 categories indicated that the controls were not fully in
                 place.


                                          3










                 B-238954


                 Plans Lacked Adequate Information to
                 ------------------------------------
                 Serve as Effective Management Tools
                 -----------------------------------
                 Although agency officials said that security planning is
                 essential to the effective management of sensitive systems,
                 the plans lacked important information that managers need in
                 order to plan, and to monitor and implement plans.  The
                 plans did not include this information, in part, because
                 they were designed not only to help agencies plan, but also
                 to facilitate NIST/NSA's review of the plans and to minimize
                 the risks of unauthorized disclosure of vulnerabilities.
                 For example:

                 -- Many plans provided minimal descriptions (a sentence or
                    nothing at all) of system sensitivity and planned
                    security controls.  Detailed descriptions would have
                    made the plans more useful in setting priorities for
                    implementing planned controls.

                 -- The plans did not assign responsibility for each planned
                    control.  It was not clear, therefore, who was
                    accountable for implementing the control (e.g., who would
                    be performing a risk assessment).

                 -- The plans did not include resource estimates needed to
                    budget for planned actions.

                 -- The plans generally did not refer to computer security-
                    related internal control weaknesses, although such
                    information can be important in developing plans.

                 Finally, officials from about one-third of the agencies said
                 that they already had more comprehensive planning processes
                 to help them identify and evaluate their security needs.  As
                 a result, the governmentwide process was largely superfluous
                 for these agencies.  Officials at such agencies said that
                 their plans, which included information such as detailed
                 descriptions of security controls, already met the
                 objectives of the governmentwide planning process.  Many
                 officials said that what they needed was assistance in areas
                 such as network security.

                 Managers Had Little
                 -------------------
                 Time to Prepare the Plans
                 -------------------------
                 Officials had little time to adequately consider their
                 security needs and prepare plans, further limiting the
                 usefulness of the plans.  OMB Bulletin 88-16 was issued July
                 6, 1988, 27 weeks before the plans were due to the NIST/NSA

                                          4










                 B-238954

                 review team, as required by the Computer Security Act.
                 However, less than 14 weeks was left after most agencies
                 issued guidance on responding to the OMB request.  Within
                 the remaining time, instructions were sent to the component
                 agencies and from there to the managers responsible for
                 preparing the plans, meetings were held to discuss the
                 plans, managers prepared the plans, and the plans were
                 reviewed by component agencies and returned to the agencies
                 for review.  As a result, some managers had only a few days
                 to prepare plans.

                 Guidance Was Sometimes Unclear
                 ------------------------------
                 and Misinterpreted by Agencies
                 ------------------------------
                 Many agency officials misinterpreted or found the guidance
                 unclear as to how systems were to be combined in the plans,
                 the definition of some key terms (e.g., "in place"), the
                 level of expected detail, and the need to address
                 telecommunications.  For example, some plans combined many
                 different types of systems--such as microcomputers and
                 mainframes--having diverse functions and security needs,
                 although the guidance specified that only similar systems
                 could be combined.  When dissimilar systems were combined,
                 the plan's usefulness as a management tool was limited.

                 Further, for plans that combined systems, some agencies
                 reported that a security control was in place for the entire
                 plan, although it was actually in place for only a few
                 systems.  Agency officials stated that they combined systems
                 in accordance with their understanding of the OMB guidance
                 and NIST/NSA verbal instructions.

                 In addition, officials were confused about how much detail
                 to include in the plans and whether to address
                 telecommunications issues (e.g., network security).  For
                 example, they said that although the guidance asked for
                 brief descriptions of systems and information sensitivity,
                 NIST/NSA reviewers frequently commented that plans lacked
                 adequate descriptions.  NIST officials said they expected
                 that the plans would be more detailed and discuss the
                 vulnerabilities inherent in networks.  They said, in
                 retrospect, that it would have been helpful if the guidance
                 had provided examples and clarified the level of expected
                 detail.

                 AGENCIES HAVE NOT IMPLEMENTED
                 -----------------------------
                 MOST PLANNED SECURITY CONTROLS
                 ------------------------------
                 Although a year has passed since the initial computer
                 security plans were completed, agencies have made little

                                          5










                 B-238954

                 progress in implementing planned controls.3  The 22 plans we
                 reviewed contained 145 planned security controls.  According
                 to agency officials, as of January 1990, only 38 percent of
                 the 145 planned controls had been implemented.

                 Table 1 shows the number and percentage of planned security
                 controls that had been implemented as of January 1990.

          Table 1:  Implementation of Security Controls in 22 Plans

                                                                    Percent
          Security control           Planned        Implemented     implemented
          ----------------           -------        -----------     -----------
          Assignment of security
          responsibility              7              7               100

          Audit and variance
          detection                   7              7               100

          Confidentiality
          controls                    3              3               100

          User identification
          and authentication          2              2               100

          Personnel selection
          and screening               7              6                86

          Security measures for
          support systems             9              5                56

          Security awareness and
          training measures          20             12                60

          Authorization/access
          controls                    4              2                50

          Contingency plans          11              5                45

          Data integrity and
          validation controls         8              2                25

          Audit trails and
          maintaining
          journals                   12              2                17



                3Only 4 percent of the security controls had implementation
                 dates beyond January 1990.

                                          6










                 B-238954

          Production, input/
          output controls             8              1                13

          Risk/sensitivity
          assessment                 11              1                 9

          Security specifications    10              0                 0

          Design review and
          testing                    11              0                 0

          Certification/
          accreditation              14              0                 0

          Software controls           1              0                 0

          Total                     145             55                 -


                 According to many agency officials, budget constraints and
                 lack of adequate top management support--in terms of
                 resources and commitment--were key reasons why security
                 controls had not yet been implemented.

                 Although some officials stated that the planning process has
                 raised management awareness of computer security issues,
                 this awareness has, for the most part, apparently not yet
                 resulted in increased resources for computer security
                 programs.  A number of officials said that security has been
                 traditionally viewed as overhead and as a target for budget
                 cuts.  Some officials noted that requests for funding of
                 contingency planning, full-time security officers, and
                 training for security personnel and managers have a low
                 approval rate.

                 NIST/NSA REVIEW FEEDBACK WAS GENERAL
                 ------------------------------------
                 AND OF LIMITED USE TO AGENCIES
                 ------------------------------
                 Agency officials said that the NIST/NSA review comments and
                 recommendations on their plans were general and of limited
                 use in addressing specific problems.  However, because the
                 plans were designed to be brief and minimize the risks of
                 unauthorized disclosure, they had little detailed
                 information for NIST and NSA to review.  Thus, the NIST/NSA
                 review team focused their comments on (1) the plans'
                 conformity with the OMB planning guidance and (2)
                 governmentwide guidance (e.g., NIST Federal Information
                 Processing Standards publications) relating to planned
                 security controls.  (Appendix IV provides an example of
                 typical NIST/NSA review comments and recommendations.)

                                          7










                 B-238954


                 Despite the limited agency use of the feedback, NIST
                 officials said that the information in the plans will be
                 useful to NIST in identifying broad security weaknesses and
                 needs.  During the review process, the NIST/NSA review team
                 developed a data base that included the status of security
                 controls for almost 1,600 civilian plans.  NIST intends to
                 use statistics from the data base to support an upcoming
                 report on observations and lessons learned from the planning
                 and review process.  Noting that the data have limitations--
                 for example, varying agency interpretations of "in place"--
                 NIST officials said that areas showing the greatest
                 percentage of planned controls indicated areas where more
                 governmentwide guidance might be needed.  Appendix V shows
                 the status of security controls in the civilian plans,
                 according to our analysis of the NIST/NSA data base.4

                 REVISED GUIDANCE PROVIDES
                 -------------------------
                 FOR AGENCY ASSISTANCE
                 ---------------------
                 The 1990 draft OMB security planning guidance calls for
                 NIST, NSA, and OMB to provide advice and technical
                 assistance on computer security issues to federal agencies
                 as needed.  Under the guidance, NIST, NSA, and OMB would
                 visit agencies and discuss (1) their computer security
                 programs, (2) the extent to which the agencies have
                 identified their sensitive computer systems, (3) the quality
                 of their security plans, and (4) their unresolved internal
                 control weaknesses.  NIST officials said that the number of
                 agencies visited in fiscal year 1991 will depend on that
                 year's funding for NIST's Computer Security Division, which
                 will lead NIST's effort, and the number of staff provided by
                 NSA.

                 In addition, under the 1990 draft guidance, agencies would
                 develop plans for sensitive systems that are new or
                 significantly changed, did not have a plan for 1989, or had
                 1989 plans for which NIST and NSA could not provide comments
                 because of insufficient information.  Agencies would be
                 required to review their component agency plans and provide
                 independent advice and comment.

                 CONCLUSIONS
                 -----------
                 The government faces new levels of risk in information
                 security because of increased use of networks and computer


                4NIST and NSA deleted agency and system names from the data
                 base provided to us.

                                          8










                 B-238954

                 literacy and greater dependence on information technology
                 overall.  As a result, effective computer security programs
                 are more critical than ever in safeguarding the systems that
                 provide essential government services.

                 The planning and feedback process was an effort to
                 strengthen computer security by helping agencies identify
                 and assess their sensitive system security needs, plans, and
                 controls.  However, the plans created under the process were
                 viewed primarily as reporting requirements, and although the
                 process may have elevated management awareness of computer
                 security, as yet it has done little to strengthen agency
                 computer security programs.

                 OMB's draft planning security guidance creates the potential
                 for more meaningful improvements by going beyond planning
                 and attempting to address broader agency-specific security
                 problems.  However, although NIST, NSA, and OMB assistance
                 can provide an impetus for change, their efforts must be
                 matched by agency management commitment and actions to make
                 needed improvements.  Ultimately, it is the agencies'
                 responsibility to ensure that the information they use and
                 maintain is adequately safeguarded and that appropriate
                 security measures are in place and tested.  Agency
                 management of security is an issue we plan to address in our
                 ongoing review of this important area.


                                        ---  --- ---

                 As requested, we did not obtain written agency comments on
                 this report.  We did, however, discuss its contents with
                 NIST, OMB, and NSA officials and have included their
                 comments where appropriate.  We conducted our review between
                 July 1989 and March 1990, in accordance with generally
                 accepted government auditing standards.

                 As arranged with your office, unless you publicly release
                 the contents of this report earlier, we plan no further
                 distribution until 30 days after the date of this letter.
                 At that time we will send copies to the appropriate House
                 and Senate committees, major federal agencies, OMB, NIST,
                 NSA, and other interested parties.  We will also make copies
                 available to others on request.

                 This report was prepared under the direction of Jack L.
                 Brock, Jr., Director, Government Information and Financial
                 Management, who can be reached at (202) 275-3195.  Other
                 major contributors are listed in appendix VI.


                                          9










                 B-238954

                 Sincerely yours,





                 Ralph V. Carlone
                 Assistant Comptroller General



                                         10










                 B-238954

                                          CONTENTS                     Page
                                          ---------                    ----

                 LETTER                                                  1


                 APPENDIX

                    I     Objectives, Scope, and Methodology             12

                    II    Plans GAO Reviewed                             14

                    III   Computer Security and Privacy Plan             16

                    IV    NIST/NSA Feedback on Computer Security Plans   21

                    V     Status of Security Controls in 1,542 Plans     22

                    VI    Major Contributors to This Report              24

                 Related GAO Products                                    25

                 TABLE

                    1     Implementation of Security Controls in 22       6
                          Plans

                                        ABBREVIATIONS
                                        -------------
                 GAO      General Accounting Office
                 IMTEC    Information Management and Technology Division
                 NIST     National Institute of Standards and Technology
                 NSA      National Security Agency
                 OMB      Office of Management and Budget


                                         11










                 APPENDIX I                                        APPENDIX I


                             OBJECTIVES, SCOPE, AND METHODOLOGY
                             ----------------------------------
                 In response to a June 5, 1989, request of the Chairman,
                 House Committee on Science, Space, and Technology, and
                 subsequent agreements with his office, we assessed the
                 impact of the computer security planning and review process
                 required by the Computer Security Act of 1987.

                 As agreed, we limited our review primarily to 10 civilian
                 agencies in the Washington, D.C. area:  the Departments of
                 Agriculture, Commerce, Energy, Health and Human Services,
                 the Interior, Labor, Transportation, the Treasury, and
                 Veterans Affairs and the General Services Administration.
                 As agreed, the Department of Defense was excluded from our
                 review because the plans it submitted differed
                 substantially in format and content from the civilian plans.


                 Specifically, we

                 --assessed the computer security planning process and
                 NIST/NSA review comments on the security plans developed as
                 a result of the process,

                 --determined the extent to which the 10 agencies implemented
                 planned control measures reported in 22 selected plans, and

                 --developed summary statistics using a NIST/NSA data base
                 covering over 1,500 civilian computer security plans.

                 To assess the impact of the planning and review process on
                 agencies' security programs, we interviewed information
                 resource management, computer security, and other officials
                 from the 10  agencies listed above.  In addition, we
                 interviewed officials from NIST, NSA, and OMB who were
                 involved in the planning process, to gain their perspectives
                 on the benefits and problems associated with the process.

                 We analyzed 22 computer security plans developed by the 10
                 agencies and the NIST/NSA review feedback relating to the
                 plans.  Most plans addressed groups of systems.  (See app.
                 II for a description of the systems.)  We selected the
                 systems primarily on the basis of their sensitivity,
                 significance, and prior GAO, President's Council on
                 Integrity and Efficiency, and OMB reviews.  We also reviewed
                 federal computer security planning and review guidance,
                 department requests for agency component plans, and
                 department and agency computer security policies.


                                         12










                 APPENDIX I                                        APPENDIX I

                 To determine the extent to which planned computer security
                 controls have been implemented, we reviewed the 22 plans and
                 discussed with agency officials the status of these
                 controls.  To develop security plan statistics, we used the
                 NIST/NSA data base, which contains data on the status of
                 controls for over 1,500 plans.  We did not verify the status
                 of the planned controls as reported to us by agency
                 officials, the accuracy of the plans, or the data in the
                 NIST/NSA data base.



                                         13










                 APPENDIX II                                      APPENDIX II

                                     PLANS GAO REVIEWED
                                     ------------------
                 Organization                     Plan
                 ------------                     ----
                 Farmers Home Administration      Automated Field Management
                                                  System

                                                  Accounting Systems

                 Patent and Trademark Office      Patent and Trademark
                                                  Automation Systems

                 Social Security Administration   Benefit Payment System

                                                  Social Security Number
                                                  Assignment System

                                                  Earnings Maintenance System

                                                  Access Control Event
                                                  Processor System

                 Bureau of Labor Statistics       Economic Statistics System

                 Employment Standards             Federal Employees'
                 Administration                   Compensation System
                                                  Level I

                 U.S. Geological Survey           National Digital
                                                  Cartographic Data Base

                                                  National Earthquake
                                                  Information Service

                 Federal Aviation Administration  En Route and Terminal Air
                                                  Traffic Control System

                                                  Maintenance and Operations
                                                  Support Systems

                                                  Interfacility
                                                  Communications System

                                                  Ground-to-Air Systems

                                                  Weather and Flight
                                                  Services Systems




                                         14











                 APPENDIX II                                      APPENDIX II

                 Organization                     Plan
                 ------------                     ----
                 Internal Revenue Service         Compliance Processing
                                                  System

                                                  Tax Processing System

                 Customs Service                  Automated Commercial
                                                  System

                 Veterans Affairs Austin Data     Mainframe Equipment
                 Processing Center                Configuration

                 General Services Administration  FSS-19 Federal Supply
                                                  System

                 Department of Energy Strategic   Mainframe Computer and PC
                 Petroleum Reserve Project        Sensitive Systems
                 Management Office

                 Note: Summary information describing each of the above
                 systems has been omitted from this version of the report.
                 Call GAO report distribution at 202-275-6241 to obtain a
                 complete copy of this report.




                                         15










                 APPENDIX III                                    APPENDIX III

                          COMPUTER SECURITY AND PRIVACY PLAN
                          ----------------------------------
          We developed this composite security plan to show what most
          civilian plans contained, their format, and some common omissions.
          Notes in parentheses show common deviations from the OMB guidance.


                          Computer Security and Privacy Plan

          1.   BASIC SYSTEM IDENTIFICATION

               Reporting Department or Agency - Department of X

               Organizational Subcomponent - Subagency  Y

               Operating Organization - Organization Z

               System Name/Title - Automated Report Management System (ARMS)

               System Category

               [X] Major Application
               [ ] General-Purpose ADP Support System

               Level of Aggregation

               [X] Single Identifiable System
               [ ] Group of Similar Systems

               Operational Status

               [X] Operational
               [ ] Under Development


               General Description/Purpose - The primary purpose of ARMS is
               to retrieve, create, process, store, and distribute data.
               (Note:  The description and purpose is incomplete.  OMB
               Bulletin 88-16 required a one or two paragraph description of
               the function and purpose of the system.)

               System Environment and Special Considerations - System is
               controlled by a ABC series computer which is stored in the
               computer room.  (Note:  The environment is not adequately
               described.  OMB Bulletin 88-16 requested a description of
               system location, types of computer hardware and software
               involved, types of users served, and other special
               considerations.)

               Information Contact - Security Officer, J. Doe, 202/275-xxxx

                                         16










                 APPENDIX III                                    APPENDIX III

          2. SENSITIVITY OF INFORMATION

               General Description of Information Sensitivity

               The data ARMS maintains and uses are those required to provide
               a total management information function.  (Note:  This
               description is inadequate.  OMB Bulletin 88-16 requested that
               the plans describe, in general terms, the nature of the system
               and the need for protective measures.)


               Applicable Laws or Regulations Affecting the System

               5 U.S.C. 552a, "Privacy Act," c. 1974.



               System Protection Requirements

               The Protection Requirement is:

                                    Primary  Secondary  Minimal/NA
               [X] Confidentiality    [X]       [ ]         [ ]
               [X] Integrity          [X]       [ ]         [ ]
               [X] Availability       [ ]       [X]         [ ]



          3.   SYSTEM SECURITY MEASURES

               Risk Assessment - There currently exists no formal large scale
               risk assessment covering ARMS.  We are scheduling a formal
               risk analysis.

               Applicable Guidance - FIPS PUBS No. 41, Computer Security
               Guidelines for Implementing the Privacy Act of 1974;
               FIPS PUB No. 83, Guidelines on User Authentication Techniques
               for Computer Network Access Control.




                                         17










                 APPENDIX III                                    APPENDIX III


                                   SECURITY MEASURES
                                   -----------------

               MANAGEMENT CONTROLS
                                                            In Place
                                     In Place    Planned    & Planned   N/A
                                     --------    -------    ---------   ---
               Assignment of Security
               Responsibility            [X]         [ ]         [ ]     [ ]

               Risk/Sensitivity
               Assessment                [ ]         [ ]         [X]     [ ]

               A formal risk analysis program will be used to update the
               current assessment.  (Note:  An expected operational date is
               not included.  OMB Bulletin 88-16 states that there should be
               expected operational dates for controls that are planned or
               in place and planned.)

               Personnel Selection
               Screening                 [ ]         [ ]         [X]     [ ]

               National Agency Check Inquiries (NACI) are required for all
               employees but have not been completed for everyone having
               access to sensitive information.  Expected operational date -
               October 1989.


               DEVELOPMENT CONTROLS

                                                            In Place
                                     In Place    Planned    & Planned   N/A
                                     --------    -------    ---------   ---
               Security
               Specifications            [X]         [ ]         [ ]      [ ]

               Design Review
               & Testing                 [ ]         [ ]         [ ]      [X]

               Certification/
               Accreditation             [ ]         [X]         [ ]      [ ]

               (Note:  No information is given for certification/
               accreditation.  OMB Bulletin 88-16 states that a general
               description of the planned measures and expected operational
               dates should be provided.)




                                         18










                 APPENDIX III                                    APPENDIX III

               OPERATIONAL CONTROLS

                                                             In Place
                                      In Place    Planned    & Planned   N/A
                                      --------    -------    ---------   ---

               Production, I/O Controls  [X]         [ ]         [ ]      [ ]

               Contingency Planning      [ ]         [X]         [ ]      [ ]

               A contingency plan is being developed in compliance with
               requirements established by the agency's security program.
               Completion date - November 1990.

               Audit and Variance
               Detection                 [ ]         [ ]         [X]      [ ]

               Day-to-day procedures are being developed for variance
               detection.  Audit reviews are also being developed and will be
               conducted on a monthly basis.  Completion date - June 1989.

               Software Maintenance
               Controls                  [X]         [ ]         [ ]      [ ]

               Documentation             [X]         [ ]         [ ]      [ ]


               SECURITY AWARENESS AND TRAINING

                                                              In Place
                                       In Place    Planned    & Planned   N/A
                                       --------    -------    ---------   ---
               Security Awareness and
               Training Measures         [ ]         [ ]         [X]      [ ]

               Training for management and users in information and
               application security will be strengthened, and security
               awareness training provided for all new employees beginning in
               June 1989.



                                         19










                 APPENDIX III                                    APPENDIX III

               TECHNICAL CONTROLS

                                                              In Place
                                       In Place    Planned    & Planned   N/A
                                       --------    -------    ---------   ---
               User Identification and
               Authentication            [X]         [ ]         [ ]      [ ]

               Authorization/Access
               Controls                  [X]         [ ]         [ ]      [ ]

               Data Integrity &
               Validation Controls       [X]         [ ]         [ ]      [ ]

               Audit Trails & Journaling [X]         [ ]         [ ]      [ ]



               SUPPORT SYSTEM SECURITY MEASURES

                                                              In Place
                                       In Place    Planned    & Planned   N/A
                                       --------    -------    ---------   ---
               Security Measures for
               Support Systems           [X]         [ ]         [ ]      [ ]


          4.   NEEDS AND ADDITIONAL COMMENTS

               (Note:  This section was left blank in most plans.  OMB
               Bulletin 88-16 stated that the purpose of this section was to
               give agency planners the opportunity to include comments
               concerning needs for additional guidance, standards, or other
               tools to improve system protection.)




                                         20










          APPENDIX IV                                             APPENDIX IV

                     NIST/NSA FEEDBACK ON COMPUTER SECURITY PLANS
                     --------------------------------------------

          The following example shows typical NIST/NSA comments and
          recommendations.

          COMPUTER SECURITY PLAN REVIEW PROJECT COMMENTS AND RECOMMENDATIONS

                                     REF. NO. 0001

          AGENCY NAME:  Department of X
                        Subagency Y

          SYSTEM NAME:  Automated Report Management System


          The brevity of information in the information sensitivity, general
          system description, and the system environment sections made it
          difficult to understand the security needs of the system.
          Information on the physical, operational, and technical environment
          and the nature of the sensitivity is essential to understanding the
          security needs of the system.

          For some controls, such as security training and awareness,
          expected operational dates are not indicated as required by OMB
          Bulletin 88-16.

          The plan refers to the development control, design review and
          testing, as not applicable.  Even in an operational system,
          development controls should be addressed as historical security
          measures and as ongoing measures for changing hardware and
          software.

          The plan notes that a more formal risk assessment is being planned.
          This effort should help your organization more effectively manage
          risks and security resources.  National Institute of Standards and
          Technology Federal Information Processing Standards Publication 65,
          "Guideline for Automatic Data Processing Risk Analysis," and 73,
          "Guideline for the Security of Computer Applications" may be of
          help in this area.




                                         21










          APPENDIX V                                               APPENDIX V


                      STATUS OF SECURITY CONTROLS IN 1,542 PLANS
                      ------------------------------------------
                                                          Planned &
                                 Plan         In place    in place    Planned
                                 ----         --------    ---------   -------
    Security controls            responses#a  (percent)   (percent)   (percent)

    Management controls

    Assignment of security
    responsibility               1,448        91           5          4

    Personnel selection and
    screening                    1,268        84          11          5

    Risk analysis and
    sensitivity assessment       1,321        71          13         17

    Development controls

    Design review and testing      728        82          10          8

    Certification and
    accreditation                  948        66          10         24

    Security and acquisition
    specifications               1,093        83          10          7

    Operational controls

    Audit and variance
    detection                    1,177        81           7         12

    Documentation                1,375        83          10          8

    Emergency, backup, and
    contingency planning         1,381        69          14         17

    Physical and environmental
    protection                     450        87          10          4

    Production and input/
    output controls              1,290        87           7          7

    Software maintenance
    controls                     1,327        87           7          7

    Security training and
    awareness measures           1,408        58          27         15


                                         22










          APPENDIX V                                               APPENDIX V

    Technical controls

    Authorization/access
    controls                     1,389        87           6          7

    Confidentiality controls       357        84           7          9

    Audit trail mechanisms       1,194        83           8          9

    Integrity controls           1,220        85           8          7

    User identification
    and authentication           1,370        87           7          6


    Weighted average               --         81          10         10


    Note:  The status of security controls is based on information reported
    in 1,542 civilian plans in early 1989 and contained in the NIST/NSA data
    base.  Missing and not applicable answers were not included in the
    percentages.  Some percentages do not add up to 100 due to rounding.

   a"Plan responses" is the number of plans, out of 1,542, that addressed
    each control.



                                         23










    APPENDIX VI                                                   APPENDIX VI
                        MAJOR CONTRIBUTORS TO THIS REPORT
                        ---------------------------------

    INFORMATION MANAGEMENT AND TECHNOLOGY DIVISION, WASHINGTON, D.C.
    ----------------------------------------------------------------
    Linda D. Koontz, Assistant Director
    Jerilynn B. Hoy, Assignment Manager
    Beverly A. Peterson, Evaluator-in-Charge
    Barbarol J. James, Evaluator

    (510465)



                                         24










                              RELATED GAO PRODUCTS
                              --------------------
    Computer Security:  Identification of Sensitive Systems Operated on
    Behalf of Ten Agencies (GAO/IMTEC-89-70, Sept. 27, 1989).

    Computer Security:  Compliance With Security Plan Requirements of the
    Computer Security Act (GAO/IMTEC-89-55, June 21, 1989).

    Computer Security:  Compliance With Training Requirements of the
    Computer Security Act of 1987 (GAO/IMTEC-89-16BR, Feb. 22, 1989).

    Computer Security:  Status of Compliance With the Computer Security Act
    of 1987 (GAO/IMTEC-88-61BR, Sept. 22, 1988).


                                         25