# Presentation: 370362

***	******	******	******	******	******	******	******	******	***

***	******	******	******	******	****** ***
***Federal Information Security ***
***Management Act***

***Computer Security Audits &***
***Advisory Board (ISPAB)***
- PCIE Roundtable Meeting
- February 2004

***Rebecca C. Leng, CPA, CISA***
- Deputy Assistant Inspector General for
-      Information Technology and Computer Security
- Department of Transportation

- 2/04 PCIE Roundtable Meeting

## INTRODUCTION

**DOT Computer Systems Portfolio**
**DOT Computer Security Status**
**DOT/OIG Audit Approach**
**DOT/OIG Audit Report Focuses**
**Information Security and Privacy Advisory Board (ISPAB)**

- 2/04 PCIE Roundtable Meeting

## DOT COMPUTER SYSTEMS PORTFOLIO 

- DOT is responsible for one of the largest IT investment portfolios among civilian agencies, which includes safety-sensitive air traffic control systems, as well as financial systems used to disburse over $30 billion of Federal grants annually.

- (Source: OMB’s FY 2002 Report to Congress on Federal Government Information Security Reform)

- 2/04 PCIE Roundtable Meeting

## DOT COMPUTER SECURITY STATUS           

***Good Stride Made....***
- Appointed a CIO and increased the CIO’s influence.
- Enhanced defense against intrusions from the Internet and reduced web vulnerabilities.
- Developed a more reliable systems inventory.***	***
***Still A Long Way to Go...***
- Reported the information security program as a material weakness in the FMFIA report.  Only 33 percent of DOT systems completed security certification reviews as of September 2003
- Continue experiencing problems with unauthorized network connections and inadequate background checks and key personnel.

- 2/04 PCIE Roundtable Meeting

## DOT/OIG AUDIT APPROACH

- Follow GAO’s audit methodology (FISCAM) and NIST standards in doing computer security audits throughout the year.
**Use OIG staff to review operational systems security such as air traffic control systems**
**Use contractors to review financial management systems security to support CFO audits.**
- In May, assess needs for performing additional work to meet OMB reporting requirements.

- 2/04 PCIE Roundtable Meeting

## DOT/OIG AUDIT REPORT FOCUS                     

**Annual computer security reports contain two parts**
- The report reflects accumulative results of OIG work for the whole year and is written in plain English with a focus on:
***Management Controls – e.g., CIO authority, oversight, other important E-Government initiatives such as IT investment controls, etc.***
***Network Security – “keeping outsiders out”***
***Systems Security – “securing individual systems internally”***
***Issues requiring special attention (can be different every year – e.g., personnel security, web security, contingency planning, etc.***
- The attachment answers OMB questions.

- 2/04 PCIE Roundtable Meeting

## INFORMATION SECURITY AND PRIVACY ADVISORY BOARD (ISPAB) 

***Authorization***
- Established by the Computer Security Act of 1987
- Reauthorized by the Federal Information Security Management Act of 2002
**Purpose** – “to advise the Institute (NIST) and the Director of the Office of Management and Budget on information security and privacy issues pertaining to Federal Government information system, including through review of proposed standards and guidelines....”
**ISPAB** (_[http://csrc.nist.gov/](http://csrc.nist.gov/ispab)__[ispab](http://csrc.nist.gov/ispab)_) is a Federal advisory committee whose meetings are open to the public.

- 2/04 PCIE Roundtable Meeting

## INFORMATION SECURITY AND PRIVACY ADVISORY BOARD (ISPAB)

- Members appointed by the Director of NIST for four year terms
- Four members from the information technology industry.
- Four members from the information technology industry, or related disciplines, but not employed by or a representative of a producer of information equipment
- Four members from the Federal government who have information system management experience (currently represented by NSA, DHS, VA, and DOT
***IG Community Representation***
- 2003 – 2007 Rebecca Leng, Deputy AIG, Department of Transportation
- 1996 – 1999 John Layton, IG, Department of Energy
- 1989 – 1994 Bill Colvin, IG, National Aeronautics and Space  Administration

- 2/04 PCIE Roundtable Meeting

## 
U.S. DEPARTMENT OF TRANSPORTATION
OFFICE OF INSPECTOR GENERAL

REBECCA C. LENG, CPA, CISA
DEPUTY ASSISTANT INSPECTOR GENERAL
FOR IT AND COMPUTER SECURITY

NASSIF BLDG., ROOM 9228			              TEL: (202) 366-1488
400 SEVENTH STREET, S.W.                                 		FAX:(202) 366-3530
WASHINGTON, DC 20590-0001 	                 E-MAIL:rebecca.c.leng@oig.dot.gov

- U.S. DEPARTMENT OF TRANSPORTATION
- OFFICE OF INSPECTOR GENERAL
**REBECCA C. LENG, CPA, CISA**
- DEPUTY ASSISTANT INSPECTOR GENERAL
- FOR IT AND COMPUTER SECURITY
- NASSIF BLDG., ROOM 9228			              TEL: (202) 366-1488
- 400 SEVENTH STREET, S.W.                                 		FAX:(202) 366-3530
- WASHINGTON, DC 20590-0001 	                 E-MAIL:_rebecca.c.leng@oig.dot.gov_

- 2/04 PCIE Roundtable Meeting