Date: 01 July 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Known Vulnerabity

An audit of a major Environmental Protection Agency contract management system uncovered significant security lapses that, if exploited by hackers, could have serious consequences for the agency's operations, assets and personnel. The audit focused on lack of monitoring for known vulnerabilities on these systems.

References:

• Security gaps found in EPA contracting system [GovExec]
• Information Security Series: Security Practices - Integrated Contract Management System [EPA]