Electronic information is essential to the achievement of government organizational objectives. Its reliability, integrity, and availability are significant concerns in most audits. The use of computer networks, particularly the Internet, is revolutionizing the way government conducts business. While the benefits have been enormous and vast amounts of information are now literally at our fingertips, these interconnections also pose significant risks to computer systems, information, and to the critical operations and infrastructures they support. Infrastructure elements such as telecommunications, power distribution, national defense, law enforcement, and government and emergency services are subject to these risks. The same factors that benefit operations—speed and accessibility—if not properly controlled, can leave them vulnerable to fraud, sabotage, and malicious or mischievous acts. In addition, natural disasters and inadvertent errors by authorized computer users can have devastating consequences if information resources are poorly protected. Recent publicized disruptions caused by virus, worm,and denial of service attacks on both commercial and governmental Web sites illustrate the potential for damage.
Computer security is of increasing importance to all levels of government in minimizing the risk of malicious attacks from individuals and groups. These risks include the fraudulent loss or misuse of government resources, unauthorized access to release of sensitive information such as tax and medical records, disruption of critical operations through viruses or hacker attacks, and modification or destruction of data. The risk that information attacks will threaten vital national interests increases with the following developments in information technology:
• Monies are increasingly transferred electronically between and among
governmental