Interior's financial data at risk

Weak Controls Put Interior's Financial and Other Data at Risk

Weaknesses in information systems control at the Interior Department's financial systems center is putting data and workers' privacy at risk, according to a General Accounting Office report issued this week.

Interior's National Business Center does not adequately limit access granted to authorized users, maintain software controls or secure access to its network, GAO found. The Denver-based service center operates administrative and financial systems for Interior and more than 30 other federal organizations.

GAO further noted that the center has not developed a program to routinely monitor access to its computer facilities and data or to investigate suspicious access patterns.

"The effect of these weaknesses is to place sensitive NBC-Denver financial and personnel information at risk of unauthorized disclosure, critical infrastructure operations at risk of disruption and assets at risk of loss," GAO found.

According to the report, the weaknesses affect the center's ability to:

* Prevent unauthorized changes to payroll and other payment data.

* Control access to sensitive personnel information.

* Restrict physical access to sensitive computing areas.

A comprehensive computer security program at the center, which has not been fully developed, would go a long way toward solving some of its information control problems, according to GAO.

"Such a program...would provide NBC-Denver with a solid foundation for resolving existing computer security problems and continuously managing information security risks," according to the report.

Robert Lamb, Interior acting assistant secretary for policy, management and budget, agreed with GAO's assessment in a letter included in the report. Lamb wrote that about half of GAO's recommendations to correct the outlined weaknesses have been completed and that all should be finished by Dec. 31.

In addition, all of the weaknesses outlined in two previous Interior inspector general audits, mentioned in GAO's report, have been corrected, Lamb wrote.