All Topics » Information Security
Information Security (31 - 40 of 425 items) in Custom Date Range
Cybersecurity: Actions Needed to Address Challenges Facing Federal Systems
GAO-15-573T: Published: Apr 22, 2015. Publicly Released: Apr 22, 2015.
Federal and contractor systems face an evolving array of cyber-based threats. These threats can be unintentional—for example, from equipment failure, careless or poorly trained employees; or intentional—targeted or untargeted attacks from criminals, hackers, adversarial nations, or terrorists, among others. Threat actors use a variety of attack techniques that can adversely affect federal info...
Air Traffic Control: FAA Needs a More Comprehensive Approach to Address Cybersecurity As Agency Transitions to NextGen
GAO-15-370: Published: Apr 14, 2015. Publicly Released: Apr 14, 2015.
As the agency transitions to the Next Generation Air Transportation System (NextGen), the Federal Aviation Administration (FAA) faces cybersecurity challenges in at least three areas: (1) protecting air-traffic control (ATC) information systems, (2) protecting aircraft avionics used to operate and guide aircraft, and (3) clarifying cybersecurity roles and responsibilities among multiple FAA office...
Information Security: FDIC Implemented Many Controls over Financial Systems, but Opportunities for Improvement Remain
GAO-15-426: Published: Apr 9, 2015. Publicly Released: Apr 9, 2015.
The Federal Deposit Insurance Corporation (FDIC) has implemented numerous information security controls intended to protect its key financial systems; nevertheless, weaknesses remain that place the confidentiality, integrity, and availability of financial systems and information at risk. During 2014, the corporation implemented 27 of the 36 GAO recommendations pertaining to previously reported sec...
Information Security: IRS Needs to Continue Improving Controls over Financial and Taxpayer Data
GAO-15-337: Published: Mar 19, 2015. Publicly Released: Mar 19, 2015.
The Internal Revenue Service (IRS) made progress in implementing information security controls; however, weaknesses limit their effectiveness in protecting the confidentiality, integrity and availability of financial and sensitive taxpayer data. During fiscal year 2014, IRS continued to devote attention to securing its information systems that process sensitive taxpayer and financial information....
Information Security: FAA Needs to Address Weaknesses in Air Traffic Control Systems
GAO-15-221: Published: Jan 29, 2015. Publicly Released: Mar 2, 2015.
While the Federal Aviation Administration (FAA) has taken steps to protect its air traffic control systems from cyber-based and other threats, significant security control weaknesses remain, threatening the agency's ability to ensure the safe and uninterrupted operation of the national airspace system (NAS). These include weaknesses in controls intended to prevent, limit, and detect unauthorized a...
Federal Facility Cybersecurity: DHS and GSA Should Address Cyber Risk to Building and Access Control Systems
GAO-15-6: Published: Dec 12, 2014. Publicly Released: Jan 12, 2015.
The Department of Homeland Security (DHS) has taken preliminary steps to begin to understand the cyber risk to building and access controls systems in federal facilities. For example, in 2013, components of DHS's National Protection and Programs Directorate (NPPD) conducted a joint assessment of the physical security and cybersecurity of a federal facility. However, significant work remains.Lack o...
Information Security: Additional Actions Needed to Address Vulnerabilities That Put VA Data at Risk
GAO-15-220T: Published: Nov 18, 2014. Publicly Released: Nov 18, 2014.
The Department of Veterans Affairs (VA) has taken actions to mitigate previously identified vulnerabilities, but it has not fully addressed these weaknesses:Incident response: VA took actions to contain and eradicate the effects of a network intrusion detected in 2012, but it could not show that these actions were fully effective. Specifically, the department's Network and Security Operations Cent...
Information Security: VA Needs to Address Identified Vulnerabilities
GAO-15-117: Published: Nov 13, 2014. Publicly Released: Nov 17, 2014.
While the Department of Veterans Affairs (VA) has taken actions to mitigate previously identified vulnerabilities, it has not fully addressed these weaknesses. For example, VA took actions to contain and eradicate a significant incident detected in 2012 involving a network intrusion, but these actions were not fully effective:The department's Network and Security Operations Center (NSOC) analyzed...
Identity Theft: Additional Actions Could Help IRS Combat the Large, Evolving Threat of Refund Fraud
GAO-14-633: Published: Aug 20, 2014. Publicly Released: Sep 22, 2014.
Based on preliminary analysis, the Internal Revenue Service (IRS) estimates it paid $5.2 billion in fraudulent identity theft (IDT) refunds in filing season 2013, while preventing $24.2 billion (based on what it could detect). The full extent is unknown because of the challenges inherent in detecting IDT refund fraud.IDT refund fraud takes advantage of IRS's “look-back” compliance model. Under...
Healthcare.gov: Information Security and Privacy Controls Should Be Enhanced to Address Weaknesses
GAO-14-871T: Published: Sep 18, 2014. Publicly Released: Sep 18, 2014.
Enrollment through Healthcare.gov is supported by the exchange of information among many systems and entities. The Department of Health and Human Services' (HHS) Centers for Medicare & Medicaid Services (CMS) has overall responsibility for key information technology (IT) systems supporting Healthcare.gov. These include, among others, the Federally Facilitated Marketplace (FFM) system, which facili...