GAO: Software changes reveal lapses
When making software changes, agencies are failing to take steps to prevent weaknesses in security
Federal agencies are failing to follow the proper procedures to ensure that
software changes do not introduce security weaknesses, according to a May
4 letter from the General Accounting Office.
GAO started its look at federal software change controls last year,
following a request from Rep. Stephen Horn (R-Calif.), chairman of the House
Subcommittee on Government Management, Information and Technology.
While originally focusing on the potential of creating security holes
during Year 2000 remediation, the audit of 16 agencies and 128 of their
offices found inadequate policies across the board, said David McClure,
associate director of governmentwide and defense information systems, in
a letter to Horn on May 4.
"Formally documented policies and procedures did not exist or did not
meet the requirements of federal criteria," McClure wrote. "For example,
eight of 16 agencies had not established formal, agencywide policies for
software change management, and 50 of 128 agency components had not established
formal procedures or adopted agency-level guidance."
GAO is putting together recommendations regarding these shortcomings
for the Office of Management and Budget to incorporate into its revisions
to Circular A-130, the central guidance for federal information system management.
NEXT STORY: Treasury baiting better financial data