GAO noted that: (1) Melissa is a macro virus that can affect users of Microsoft's Word 97 or Word 2000; (2) macro viruses are computer viruses that use an application's own macro programming language to reproduce themselves; (3) Melissa itself is delivered in a Word document; (4) once the Word document is opened, and the virus is allowed to run, Melissa: (a) checks to see if Word 97 or Word 2000

GAO noted that: (1) as the importance of computer security has increased, so have the rigor and frequency of federal audits in this area; (2) during the last 2 years, GAO and the agency inspectors general (IG) have evaluated computer-based controls on a wide variety of financial and nonfinancial systems supporting critical federal programs and operations; (3) the most recent set of audit results

GAO noted that: (1) the expanded amount of audit evidence that has become available since mid-1996 describes widespread and serious weaknesses in the federal government's ability to adequately protect: (a) federal assets from fraud and misuse; (b) sensitive information from inappropriate disclosure; and (c) critical operations, including some affecting public safety, from disruption; (2) signific

GAO noted that: (1) the dramatic increase in computer interconnectivity and the popularity of the Internet are offering government agencies unprecedented opportunities to improve operations by reducing paper processing, cutting costs, and sharing information; (2) at the same time, however, malicious attacks on computer systems are increasing at alarming rates and are posing serious risks to key g

GAO noted that: (1) State's information systems and the information contained within them are vulnerable to access, change, disclosure, disruption or even denial of service by unauthorized individuals; (2) GAO conducted penetration tests to determine how susceptible State's systems are to unauthorized access and found that it was able to access sensitive information; (3) moreover, GAO's penetrati

This publication supersedes AIMD-98-21, Executive Guide: Information Security Management--Learning From Leading Organizations, May 1998. GAO published a guide to assist federal agencies in establishing a management framework for exploring and reducing the information security risks associated with their operations.

This publication has been superseded by AIMD-00-21.2.8, Travel System Requirements: Checklist for Reviewing Systems Under the Federal Financial Management Improvement Act of 1996, December 1999. This publication has been superseded by AIMD-98-68, Executive Guide: Information Security Management--Learning From Leading Organizations, March 1998. GAO published a guide to assist federal agencies in e

GAO noted that: (1) GAO's on-site reviews of security at five facilities disclosed many weaknesses in eight functional areas; (2) these areas are physical security, logical security, data communications management, risk analysis, quality assurance, internal audit and security, security awareness, and contingency planning; (3) of these eight, the primary weaknesses were in the areas of physical an

GAO noted that: (1) over the last 3 years, GAO has reported on a number of computer security problems at IRS and has made recommendations for strengthening IRS' computer security management effectiveness; (2) nevertheless, IRS continues to have serious weaknesses in the controls used to safeguard IRS computer systems, facilities, and taxpayer data; (3) GAO's recent on-site reviews of security at

GAO found that: (1) recent audits and reviews indicate that weak information security is a serious governmentwide problem, with serious weaknesses reported for over two-thirds of the agencies reviewed; (2) commonly reported weaknesses include information access control problems and inadequate disaster planning; (3) at half of the agencies reviewed, information security problems remained uncorrect