DEPARTMENT OF HOMELAND SECURITY 

Office of Inspector General 

Enhanced Configuration Controls and 

Management Policies Can Improve 

USCG Network Security 

(Redacted)

Notice: The Department of Homeland Security, Office of Inspector General, has redacted 

this report for public release. A review under the Freedom of Information Act will be 

conducted upon request. 

1 

OIG-08-82 August 2008

Background 

A system’s network connections are the primary targets of most information technology 

(IT) security attacks. Network connectivity has become an intrinsic part of conducting 

business; thus, making security planning and controls very important. Network security 

encompasses remote access, network tuning and monitoring, external connections, 

boundary protection, internet usage, electronic mail security, and vulnerability 

management. Sound network security practice dictates that all network connections be 

identified and that threats and vulnerabilities associated with these connections be 

analyzed. The network infrastructure is the first line of defense between the Internet and 

networked information systems. Network security monitoring, detection, and analysis 

are key functions and are critical to maintaining the security of networked information 

systems. Vulnerability management, which is a combination of detection, assessment, 

and mitigation of weaknesses, is critical to reducing the risks associated with 

unauthorized access to network devices, systems, and data. 

Information systems and networks are necessary for USCG business. Communications 

capabilities are needed by USCG personnel stationed on land, as well as those individuals 

that are at sea on its cutters. The Coast Guard Data Network Plus (CGDN+) supports 

USCG’s sensitive, operational, and administrative information systems, as well as 

unclassified e-mail transmission and delivery. The CGDN+ Backbone is a modern 

common-user Transmission Control Protocol/Internet Protocol routed wide area network 

(WAN). The Backbone allows the transfer of sensitive information across the WAN. 

The Backbone design supports all Coast Guard districts and major commands. The 

network infrastructure extends across the continental U.S., and includes Alaska and 

Hawaii. 

The CGDN+ backbone consists of 

. The CGDN+ system infrastructure includes 

 systems. Four point of 

presence (POP) sites control access to CGDN+. Each POP supports external routers that 

provide for the transfer of sensitive but unclassified operational and administrative 

information. The firewall provides filtering of network traffic to protect against security 

intrusions, as well as controlling and authenticating access to each POP. The POP sites 

are: 

• USCG Commandant (COMDT), located in . 

• USCG Financial Center (FINCEN), located in . 

• USCG Operations Systems Command (OSC), located in . 

• USCG Electronics Systems Support Unit (ESU), located in . 

Coast Guard cutters in port are provided pier side connectivity to CGDN+ by their 

respective supporting stations, via a T1 capable link. When at sea, minimal connectivity 

to CGDN+ is provided through a commercial satellite link, which must employ 

 for transmission security. The shipboard network connections generally 

2 
consist of a router, switch, virtual private network, servers, and workstations. Network 

and system security patches and updates are deployed when the cutters . 

The USCG’s Telecommunications and Information Systems Command (TISCOM) 

centrally manages CGDN+ and the POPs. Additionally, cutter connectivity to CGDN+ is 

entirely under the purview of TISCOM. TISCOM is responsible for all issues relating to 

the security of CGDN+, including the configuration management of the 

, providing guidance to the POP sites when policy changes require 

modification of the , maintaining and replacing cutter network devices, 

managing backups, alert notifications, and incident response. The POP site teams are 

responsible for providing and maintaining remote access service engineering support for 

access to CGDN+ 24 hours a day/7 days a week. 

In addition to assessing the security of the for CGDN+ at the POPs and 

aboard four selected USCG cutters, we conducted wireless scans for possible rogue 

network access points at the POP sites and aboard the cutters. We also interviewed 

TISCOM personnel regarding network administration and evaluated access control and 

other security policies implemented to protect its network devices, systems, and data. 

The diagram below depicts an overview of CGDN+, and the devices and locations where 

we performed testing. 

Source: 

3 
Results of Audit 

The overall security posture of the CGDN+ infrastructure is good. Network 

security are effectively protecting USCG’s network and data. Redundant 

firewalls are protecting each of the POP sites. firewalls are configured to block 

connection attempts to scan the network. Auditing and logging is performed by a syslog 

server, and firewall logs are monitored daily for intrusion attacks. TISCOM employs two 

intrusion detection applications, which run simultaneously and are used to actively 

monitor and analyze incoming and outgoing network traffic 24 hours a day/7 days a 

week. No rogue network access points were discovered. We verified that USCG cutter 

network devices and system connections are patched when they ; and 

physical access to network devices aboard the cutters is restricted. Overall, the USCG’s 

management of its network security is consistent with a majority of the policies, 

practices, and controls required by the Department of Homeland Security’s (DHS) 4300A 

Sensitive Systems Handbook, DHS’ CISCO Router Secure Baseline Configuration Guide, 

and the National Institute of Standards and Technology Special Publication 800-53, 

Recommended Security Controls for Federal Information Systems. 

While USCG has been vigilant in its efforts to secure its network infrastructure, we 

identified system vulnerabilities and areas of noncompliance with DHS’ configuration 

on its network . If these issues are not addressed, they may 

compromise USCG’s security. In addition, important policies and procedures 

related to network access controls have not been developed. The additional measures we 

are recommending can be easily implemented without affecting USCG operations and 

will decrease the risks associated with the issues we identified. 

Should Be Addressed 

A number of management, operational, and technical controls impact network security, 

including identification and authentication controls, audit logging, integrity controls, and 

periodic reviews of programs/systems to determine whether changes that could adversely 

affect security have occurred. While USCG has implemented the majority of these 

controls, we identified several configuration 

 on its network security that could 

adversely impact the security of its network infrastructure. Specifically, we identified: 

•

. 

•

. 

•

. 

• . 

• . 

•

. 

4
 
• . 

• . 

•

. 

Per DHS guidance, firewalls, when used in concert with a variety of additional security 

controls, such as IDSs and authentication procedures, provide a level of assurance that 

unauthorized personnel will be unable to access departmental systems and have proven to 

be an effective means for securing a network. DHS requires that: 

•

. 

• . 

• . 

•

. 

•

. 

• . 

• . 

• . 

•

. 

• . 

The use of are inherently critical 

high-risk vulnerabilities. While the risk to USCG’s network infrastructure for the 

majority of the vulnerabilities identified above could be considered low, together they 

present a medium to high risk because they can potentially provide an attacker with the 

means to gain unauthorized access to USCG’s network. For example, an attacker can use 

and gain 

unauthorized access to the USCG network. The unauthorized or the non-intended use of 

 poses a potential avenue for unfettered or even covert access to other 

devices or systems within the infrastructure. The use of is 

associated with numerous vulnerabilities from attackers gaining access to 

 with network 

. USCG needs to address these 

involving the configuration allowed on CGDN+ to 

better protect the confidentiality, integrity, and availability of its systems and data, and 

comply with DHS requirements. 

5
 
Additional Policies and Procedures Should Be Developed 

USCG has implemented guidelines and procedures pertaining to wireless access, standard 

configurations for workstations, patch management, and incident detection and response. 

However, USCG has not developed an access control policy or remote access policy to 

govern employees’ access to the USCG network via modem or accessing the USCG 

network via the Internet. Additionally, USCG management acknowledged that its 

employees are 

. 

Per DHS policy, components are required to implement access control measures that 

provide protection from unauthorized alteration, loss, unavailability, destruction, or 

disclosure of information. Access control policies are designed to reduce the risk of an 

individual acting alone from engaging in fraudulent or malicious behavior. Data 

communication connections via modem are to be limited and tightly controlled because 

these connections can be used to circumvent security controls intended to protect DHS 

networks. Data communication connections are not allowed unless the component’s 

Information Systems Security Manager has authorized them. Furthermore, DHS policy 

does not allow the 

 DHS information and systems. 

There are significant security risks associated with remote access and dial-in capabilities. 

Proper procedures and management of network connections are vital in mitigating these 

risks. If untrusted or uncleared persons obtain unauthorized access, they can violate the 

integrity, confidentiality, and availability standards of the department. Furthermore, 

though USCG uses to ensure that its 

. For example, USCG does not verify that 

 to reduce the risks of compromising 

CGDN+. Therefore, USCG has no reasonable assurance that the employees’ personal 

 to the level that is acceptable in accordance with DHS security 

policy and practices. 

Recommendations 

We recommend that the Coast Guard Commandant direct the Chief Information Officer 

(CIO) to: 

Recommendation #1: or otherwise address the configuration 

 in accordance with DHS policy, including the 

use of . 

Recommendation #2: 

. 

6 
Recommendation #3: Ensure that 

, are . 

Recommendation #4: Develop and implement security procedures for quarterly 

firewall testing, perimeter security testing, access control, and remote access. 

Recommendation #5: Prohibit the use 

 DHS information and systems. 

Management Comments and OIG Analysis 

We obtained written comments on a draft of the report from Chief of Staff for USCG. 

We have included a copy of the comments in Appendix A. The Chief of Staff concurred 

with four of the five recommendations. The Chief of Staff for the USCG partially 

concurred with recommendation #5 because USCG will request a waiver from the DHS 

requirements. We reviewed the USCG management’s response and agree that the steps 

USCG plans to take satisfy the recommendations. 

********************* 

We conducted our audit from October 2007 to May 2008 under the authority of the 

Inspector General Act of 1978, as amended, and according to generally accepted 

government auditing standards. 

7 
Appendix A 

Management Response 

8 
Appendix A 

Management Response 

9 
Appendix A 

Management Response 

10 
Appendix B 

Major Contributors to This Report 

Information Security Audits Division 

Edward G. Coleman, Director 

Barbara Bartuska, Audit Manager 

Tarsha Cary, Senior Auditor 

Michael Horton, IT Officer 

Thomas Rohrback, IT Specialist 

Erin Dunham, Referencer 

Advanced Technology Division 

Richard Saunders, Director 

Steve Matthews, Manager 

Vincent Feaster, Electrical Engineer, SPAWAR 

David Phelps, Computer Scientist, SPAWAR 

Chad Cravens, Computer Scientist, SPAWAR 

Birdie Rueangvivatanakij, Senior Security Analyst, Devine 

Consulting 

11 
Appendix C 

Report Distribution

Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

General Counsel 

Executive Secretary 

Under Secretary, Management 

Assistant Secretary for Policy 

Assistant Secretary for Public Affairs 

Assistant Secretary for Legislative Affairs 

Chief Information Officer 

Chief Information Security Officer 

DHS Audit Liaison 

Chief Information Officer, USCG 

Deputy Chief Information Officer, USCG 

Chief, Office of Communications Systems, USCG 

Information Systems Security Manager, USCG 

Audit Liaison, USCG 

Office of Management and Budget 

Chief, Homeland Security Branch 

DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as 

appropriate 

12 
Additional Information and Copies 

To obtain additional copies of this report, call the Office of Inspector General 

(OIG) at (202) 254-4199, fax your request to (202) 254-4305, or visit the OIG web 

site at www.dhs.gov/oig. 

OIG Hotline 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of 

criminal or noncriminal misconduct relative to department programs or 

operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, Attention: 

Office of Investigations - Hotline, 245 Murray Drive, SW, Building 410, 

Washington, DC 20528. 

The OIG seeks to protect the identity of each writer and caller.