Summary: Although the Social Security Administration recently spent about $500,000 to install a new security system for its computer operation, the central computer facility is still not secure. Unauthorized personnel have access to the computer room and tape vault. Magnetic tapes, disc packs, and other property can be removed without proper authorization. In addition, blank and valid social security and medicare cards can be taken without question.
Adequate security procedures have not been established, and Social Security has not made an in-depth study of its security needs for the central computer facility. An additional potential problem must be addressed: preventing the fraudulent and malicious acts of people who work inside the central computer facility. To avoid unauthorized access to and exits from the central computer facility, security guards should be positioned in full view of the turnstiles and should be required to verify pictures on authorization badges; the security system should be modified to allow only one temporary authorization badge to be valid for a person at any given time; and emergency exit wiring and connectors should be secured to prevent unauthorized entrances and exits. To improve controls over magnetic tapes and disc packs, the use of the tape dispatch pass should be discontinued and a transmittal sheet should be established to show authorization for removal of tapes and discs, and security guards should be reminded of the need to search notebooks, lunch containers, and briefcases. Supplies of blank social security and medicare cards should be secured; effective procedures should be established to ensure that nonissuable cards are destroyed; and all identification cards should be controlled and accountable.
