Audit of the Railroad Retirement Board's Medicare Major Application System

OFFICE OF INSPECTOR GENERAL Audit Report Audit of the Railroad Retirement Board’s Medicare Major Application System Report No. 09-06 September 30, 2009 RAILROAD RETIREMENT BOARD TABLE OF CONTENTS Introduction Background ................................................................................................................. 1 Objective...................................................................................................................... 2 Scope .......................................................................................................................... 2 Methodology ................................................................................................................ 2 Results of Review Dataset Rules Do Not Enforce Least Privilege ............................................................ 4 Access Controls that Enforce Least Privilege Need Improvement............................... 6 Accountability over ACF2 Audit Logs Needs Improvement ......................................... 7 Audit Log Content Needs Expansion........................................................................... 9 Audit Log of Security Violations is Misleading ........................................................... 10 Appendices Appendix I Bureau of Information Services Management’s Response ..................... 11 Appendix II Office of Programs Management’s ...