DHS Needs to Strengthen Controls For

Remote Access to Its Systems and Data

(Redacted)

DEPARTMENT OF HOMELAND SECURITY

Offi ce of Inspector General

Offi ce of Information Technology

OIG-05-03 November 2004

Notice: The Department of Homeland Security, Offi ce of the Inspector General, has redacted 

this report for public release under the Freedom of Information Act, 5 U.S.C. § 552 (b)(2).

Preface

The Department of Homeland Security (DHS) Offi ce of Inspector General (OIG) was established 

by the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector 

General Act of 1978. This is one of a series of audit, inspection, investigative, and special 

reports prepared by the OIG as part of its DHS oversight responsibility to identify and prevent 

fraud, waste, abuse, and mismanagement.

This report assesses the strengths and weaknesses of controls over remote access to DHS 

resources. It is based on interviews with employees and offi cials of relevant agencies and 

institutions, direct observations, technical scans, and a review of applicable documents.

The recommendations herein have been developed to the best knowledge available to the OIG, 

and have been discussed in draft with those responsible for implementation. It is my hope that 

this report will result in more effective, effi cient, and economical operations. I express my 

appreciation to all of those who contributed to the preparation of this report.

Clark Kent Ervin

Inspector General

Offi ce of Inspector General

U.S. Department of Homeland Security

Washington, DC 20528

DHS Needs to Strengthen Controls For Remote Access Page 1

Contents

 Introduction ...............................................................................................................................3

 Results in Brief .........................................................................................................................4

 Background ...............................................................................................................................5

 Findings ....................................................................................................................................6

 Remote Access Security Procedures Have Not Been Fully Developed And Implemented . 6

 Remote Access Hosts Are Vulnerable ....................................................................................9

 Miscellaneous Issue .............................................................................................................15

 Recommendations ....................................................................................................................15

 Management Comments And Our Evaluation .........................................................................16

Appendices

 Appendix A: Purpose, Scope, and Methodology ................................................................. 18

 Appendix B: Management’s Response ................................................................................ 20

 Appendix C: User Administration Processes ...................................................................... 22

 Appendix D: Account Policy Settings ................................................................................. 23

 Appendix E: Vulnerabilities Identifi ed ................................................................................ 25

 Appendix F: Major Contributors to This Report ................................................................ 26

 Appendix G: Report Distribution ........................................................................................ 27

Abbreviations

 ATL Advanced Technology Laboratory 

 CIO Chief Information Offi cer

 CIS Bureau of Citizenship and Immigration Services

 DHS Department of Homeland Security
Page 2 DHS Needs to Strengthen Controls For Remote Access

Contents

 DHS Handbook DHS Sensitive Systems Handbook

 DHS Management DHS Management Directorate

 EP&R Emergency Preparedness and Response Directorate

 FISMA Federal Information Security Management Act of 2002

 FISCAM Federal Information System Controls Audit Manual 

 GAO Government Accountability Offi ce 

 ICE Bureau of Immigration and Customs Enforcement

 ID Identifi cation

 ISS Internet Security Systems

 ISSO Information Systems Security Offi cer

 NIST National Institute of Standards and Technology

 NSA National Security Agency 

 NT Windows New Technology (Microsoft) 

 OIG Offi ce of Inspector General

 SP Special Publication

 TSA Transportation Security Administration
DHS Needs to Strengthen Controls For Remote Access Page 3

OIG

Department of Homeland Security

Offi ce of Inspector General

Introduction 

The Offi ce of Inspector General (OIG) audited the security program of the 

Department of Homeland Security (DHS) and its components1

 to control remote 

access to DHS networks. Insofar as remote access capabilities can signifi cantly 

increase security risks to its networks, DHS must ensure strong security controls 

over remote access and dial-in capabilities. 

Our objective was to determine whether DHS had provided system security, 

integrity, and control over remote access to its computer systems and data. The 

audit focused on wire based remote access to DHS systems and resources, 

including dial-in access through modems and access through the Internet.

We interviewed DHS offi cials, reviewed remote access policy and procedure 

documents, and performed technical scans of 53 remote access hosts.2

 

Additionally, we analyzed password strength and account policy settings and 

performed modem discovery tests on 2,868 analog phone lines. 

To perform these tests, we used three commercial, off-the-shelf products: 

Internet Security Systems’ (ISS) Internet Scanner 7.0, @stake’s L0phtCrack 

5.02, and Sandstorm Enterprises’ PhoneSweep 4.0. Upon completion of the 

tests, we provided each component with technical reports detailing the specifi c 

vulnerabilities detected on their networks and the actions needed for remediation. 

Fieldwork was conducted from April through August 2004 at DHS’ Offi ce of 

the Chief Information Offi cer (CIO), fi ve DHS components, and the OIG’s 

Advanced Technology Laboratory (ATL).3 See Appendix A for purpose, scope, 

and methodology.

1

 DHS “components” are defi ned as directorates, including organizational elements and bureaus, and critical agencies. 2

 In this report we used the term “host(s)” to refer to those servers and devices providing remote access capabilities, including Microsoft 

Windows New Technology (NT) and Windows 2000 domain controllers, Microsoft Exchange Servers, Cisco Systems Access Servers, and 

virtual private network concentrators.

3

 The ATL supports DHS OIG’s capability to perform effective and effi cient technical assessments of DHS information systems and 

diverse operating environments. The ATL is a collection of hardware and software that allows the simulation, testing, and evaluation of the 

computing environments that are most commonly used within DHS. 
Page 4 DHS Needs to Strengthen Controls For Remote Access

Results in Brief

DHS does not provide adequate or effective system security controls over remote 

access to its computer systems and data. While DHS has established policy 

governing remote access, and has developed procedures for granting, monitoring, 

and removing user access, these guidelines have not been fully implemented by 

the components because they are still developing processes or they are waiting to 

obtain automated tools to assist them in performing these functions. Further, DHS 

has not established confi guration guidelines for the hosts providing remote access 

to its networks.

In addition, DHS components have not established effective system controls 

on remote access. Specifi cally: (1) remote access hosts do not provide strong 

protection against unauthorized access; (2) systems were not appropriately 

patched;4

 and (3) modems that may be unauthorized were detected on DHS 

networks. Due to these remote access exposures, there is an increased risk that 

unauthorized people could gain access to DHS networks and compromise the 

confi dentiality, integrity, and availability of sensitive information systems and 

resources.

Subsequent to the completion of our audit work, offi cials from each of the 

components said that they had taken or planned corrective action to address many 

of the vulnerabilities identifi ed in our review. However, we did not verify that the 

problems had been resolved.

Our report includes three recommendations that will assist DHS in remedying the 

defi ciencies identifi ed. Specifi cally, the CIO should: 

• Update the DHS Sensitive Systems Handbook (DHS Handbook) to 

include implementation procedures and confi guration settings for remote 

access to DHS systems.

• Ensure that procedures for granting, monitoring, and removing user 

access are fully implemented.

• Ensure that all necessary system and application patches are applied in a 

timely manner.

4

 A patch, also known as a “hotfi x” or “service pack,” is a piece of software published by the manufacturer of a software application to 

correct errors or bugs in the software. 
DHS Needs to Strengthen Controls For Remote Access Page 5

In response to our draft report, the DHS CIO concurred with our 

recommendations and stated that many of them have been incorporated into 

DHS’ planning and are now refl ected in the Department’s program objectives 

and milestones. DHS’ response is summarized and evaluated in the body of this 

report and included, in its entirety, as Appendix B.

Background

Within DHS remote access provides trusted computer users access to DHS 

networks by dialing in via modem or via the Internet. There are numerous 

advantages associated with the use of remote access. For example, remote access:

• Allows employees to have fl exible work schedules.

• Provides teleworkers or employees on travel the ability to access the 

network and resources, such as email messages, fi les, databases, and 

applications. 

• Permits administrators to identify and resolve network or system 

problems remotely.

• Increases employee productivity because of an improved work and 

home-life balance.

• Reduces operational overhead such as offi ce space, infrastructure costs, 

and less sick leave.

• Reduces traffi c congestion and commuting times.

• Provides more job opportunities and lessens the commute for 

disadvantaged workers. 

While there are several advantages associated with providing DHS employees 

remote access, there are also numerous security concerns related to granting 

and maintaining remote access to government systems and resources. Highspeed internet access technologies, such as cable modems, digital subscriber 

lines, satellites, and wireless devices, allow for increased transmission speed and 

bandwidth. These technologies make it easier for remote users to access and 

transfer large amounts of data, and allow users to be online for longer periods. 
Page 6 DHS Needs to Strengthen Controls For Remote Access

However, these technologies also increase the risk that unauthorized users will 

gain access to DHS systems and resources. 

The Federal Information Security Management Act (FISMA) of 2002,

5

 requires 

each agency to develop, document, and implement an agency-wide information 

security program to provide security for the information and information systems 

that support the operation and assets of the agency. Agency policies should ensure 

that information security is addressed throughout the life-cycle of each agency 

information system and prescribe minimally acceptable system confi guration 

requirements.

DHS Sensitive Systems Policy Publication 4300A addresses access controls, 

including remote access and dial-in capabilities. The policy requires that DHS 

components ensure that strong authentication and access controls are implemented 

for remote access. The department developed the DHS Handbook to provide 

components with specifi c techniques and procedures for implementing the 

requirements of this policy.

Findings

Remote Access Security Procedures Have Not Been Fully Developed 

And Implemented

DHS has not developed and implemented the security procedures necessary to 

control remote access to its networks adequately and effectively. While DHS 

has established a policy governing remote access and has developed procedures 

for user administration,6

 these guidelines have not been fully implemented by the 

components.7

 Further, DHS has not established implementation and confi guration 

guidelines for the hosts providing remote access to its networks. As a result, there 

is greater risk that the controls implemented to protect DHS networks may not 

prevent unauthorized access to the department’s systems and data. 

5

 Title III, E-Government Act of 2002, P.L. 107-347, December 17, 2002.

6

 According to National Institute of Standards and Technology Special Publication 800-14, user administration incorporates: (1) user 

account management, including processes for requesting, establishing, issuing, and closing user accounts; tracking users and their 

respective access authorizations; and managing these functions; (2) audit and management reviews of user account management; and, 

(3) the timely modifi cation or removal of access. 7

 See Appendix C for a detailed description of recommended procedures for user administration, including granting, monitoring, and 

removing user access.
DHS Needs to Strengthen Controls For Remote Access Page 7

Remote Access User Administration Needs Improvement

Although DHS has developed procedures for granting, monitoring, and removing 

user access, these guidelines have not been implemented fully by the components. 

Specifi cally: 

• 

 said that they had not 

implemented effective exit procedures to ensure that access is removed 

in a timely manner upon employee separation or transfer. DHS policy 

requires that components implement procedures to ensure system access 

is revoked for employees or contractors who either leave DHS or are 

reassigned to other duties. In addition, the National Institute of Standards 

and Technology (NIST) Special Publication (SP) 800-14 requires that 

a standard set of processes be implemented governing friendly and 

unfriendly8

 termination, including removal of access privileges, computer 

accounts, and authentication tokens.9 Additionally, the U.S. Government 

Accountability Offi ce’s (GAO) Federal Information System Controls 

Audit Manual (FISCAM) requires that exit processes ensure that security 

management is notifi ed immediately of terminations and that access to 

the entity’s resources and facilities, including passwords, is promptly 

removed. 

• had not implemented procedures to 

review audit trails periodically or logs of remote access activity and 

documenting the completion of such reviews. In addition, though 

offi cials from

 that they conducted periodic reviews, offi cials from these 

components said that they did not document the completion of these 

activities. According to NIST SP 800-14, audit trails should be reviewed 

periodically to provide individual accountability, reconstruction of 

events, intrusion detection, and problem identifi cation. Further, the 

8

 NIST SP 800-12 defi nes friendly termination as the removal of an employee from the organization when there is no reason to believe that 

the termination is other than mutually acceptable. Unfriendly termination is defi ned as the removal of an employee under involuntary or 

adverse conditions. NIST recommends that separate processes be developed for handling friendly and unfriendly terminations, including 

additional security controls to prevent adverse events in the cases of unfriendly terminations. 

9

 An authentication token is an object that a user possesses for the purpose of identifi cation and authentication. Tokens can be divided 

into two categories: memory tokens such as bank or credit cards, which store information; and smart tokens such as Smart Cards, which 

contain integrated circuits.
Page 8 DHS Needs to Strengthen Controls For Remote Access

DHS Handbook requires information systems security offi cers (ISSO) 

to review audit trails at least once per week or according to the system’s 

security plan. 

• 

 According to NIST 

SP 800-12, application managers or data owners should review each 

user’s access level every month and sign a formal access approval list to 

provide a written record of authorization. In addition, FISCAM requires 

that system owners periodically review access authorization listings 

and determine whether they remain appropriate. The DHS Handbook 

requires that system managers or owners revalidate all accounts at least 

annually. 

According to DHS offi cials, some of the user administration procedures noted 

above had not been implemented because the components were still developing 

auditing and management review processes, or waiting to obtain automated tools 

that would assist them in performing user administration functions. 

DHS Has Not Issued Detailed Remote Access Confi guration Guidance 

DHS has not established detailed implementation and confi guration procedures 

to ensure that remote access hosts provide strong protection against unauthorized 

access. The department plans to include detailed guidance in the DHS Handbook 

for the employment of remote access devices, user responsibilities, operating 

procedures, and other information pertaining to remote access administration. 

This section of the DHS Handbook has not been completed; however, DHS is 

still negotiating with its components to ensure that the minimum implementation 

requirements established in the guidelines are feasible. 

FISMA requires federal agencies to develop and maintain information 

security policies, procedures, and control techniques to address all applicable 

requirements. Further, FISMA requires federal agencies to develop, document, 

and implement policies and procedures that ensure compliance with the minimally 

acceptable system confi guration requirements determined by the agency. 
DHS Needs to Strengthen Controls For Remote Access Page 9

Until effective user administration and remote access confi guration procedures 

are established, DHS is at increased risk that remote access may not be adequately 

controlled and remote access devices may not be appropriately confi gured. As a 

result, the risks associated with providing remote access to DHS networks may 

not be adequately addressed. 

Remote Access Hosts Are Vulnerable

DHS has not established effective system controls on remote access hosts. To 

assess the security of remote access to DHS networks, we: (1) performed 

vulnerability assessment scans to identify confi guration weaknesses and 

vulnerabilities on the hosts providing remote access capabilities;10 (2) analyzed 

account policy settings11 to verify that remote access hosts were properly 

confi gured; (3) conducted password strength analyses to determine whether the 

use of strong passwords was enforced; and, (4) performed modem discovery tests 

to locate any unauthorized modems operating on DHS networks. In assessing the 

effectiveness of remote access controls, we identifi ed several problems related to 

remote access host confi gurations, system patching, and the control of modems. 

These control weaknesses could provide an attacker with the ability to gain 

inappropriate access to DHS information systems and resources. 

Remote Access Hosts Were Not Appropriately Confi gured

Many of the hosts that we tested were not confi gured to protect against 

unauthorized access. Specifi cally:

• DHS components did not enforce strong identifi cation or authentication 

measures according to DHS requirements, NIST guidelines, and National 

Security Agency (NSA) recommendations. For each network reviewed, 

we sampled a single remote access domain and tested for appropriate 

account policy parameter settings. With the exception of DHS 

management, each component had weak or inappropriate confi guration 

settings:12

10 The tested hosts included Microsoft Windows NT and Windows 2000 domain controllers, Microsoft Exchange Servers, Cisco Systems 

Access Servers, and virtual private network concentrators.

11 Account policy settings are a series of system security confi gurations that control almost every aspect of user passwords, including initial 

creation of the password, changing the password, and forgotten passwords. The account policy section is broken down into three different 

categories: (1) Password Policy, which confi gures the password itself, with regard to validity period, length of password, and complexity 

of the password; (2) Account Lockout policy, which confi gures how the password will react when users fail to input their correct password 

multiple times; and (3) Kerberos Policy, which controls the Kerberos ticketing for domain communications. 

12 See Appendix D for a detailed description of the parameter settings identifi ed at each component, along with a discussion of the risks 

associated with the use of those parameter settings. 
Page 10 DHS Needs to Strengthen Controls For Remote Access

 Further, had several high and medium 

risk vulnerabilities relating to account and password administration. 

These vulnerabilities included:

-- Administrator, user, and guest accounts with no password required.

-- An administrator account with a password that was the same as the 

user identifi cation (ID). 

-- Accounts with blank passwords.

-- User accounts assigned inappropriate systems privileges that could 

be used to access or modify any fi le on the system. 

 The absence of adequate identifi cation and authentication controls 

enabled users and administrators to create weak passwords on devices 

providing remote access to DHS networks. To determine the extent of 

the use of weak passwords, we sampled a single remote access domain 

at each component and ran user information, dictionary, and hybrid 

dictionary attacks14 to identify accounts with weak or missing passwords. 

13 DHS has also established confi guration guidelines for password reuse. However, these guidelines differ from the NIST and NSA 

recommendations (See Appendix D for a comparison).

14 In a user information attack, the password cracking software encrypts, i.e., hashes, data from each account’s password fi eld, such as the 

account’s user ID, and compares it to the password to determine whether any of the accounts have a password based on this information. 

In a dictionary attack, the password cracking software encrypts all the words in a dictionary fi le and compares every result with the 

password hash to determine whether there are any matches. In a third type of attack, known as a hybrid dictionary attack, numbers or 

symbols are appended to each word in the dictionary fi le. 
DHS Needs to Strengthen Controls For Remote Access Page 11

Next, we analyzed the test results to identify accounts with passwords 

that did not comply with DHS, NIST, and NSA password complexity 

requirements. Each of the components had a signifi cant number of 

accounts with weak passwords. 

The following table details the password test results for each of the 

components.

Table 1: Results Of Password Strength Analysis On Remote Access Domains

Component Number of 

Accounts 

Tested

Accounts with 

No Password

(Number and 

Percent of total)

Passwords Cracked

(Number and Percent of total)

Cracked passwords not 

meeting DHS guidelines 

and NIST/NSA 

recommended settings

(Number and Percent

of total)

User Info/ 

Dictionary 

Attack

Hybrid 

Dictionary 

Attack

Total

6,579 23

(0.35%)

61

(0.93%)

523

(7.95%)

584

(8.88%) 461 (7.01%)

41,486 8

(0.02%)

981

(2.36%) N/A(a) 981

(2.36%)(a) 939 (2.26%)(a)

4,532 0

(0%)

837 

(18.47%)

819 

(18.07%)

1,656 

(36.54%) 1,605 (35.41%)

58,287 34

(0.06%)

714

(1.22%)

4,032

(6.92%)

4,746

(8.14%) 4,451 (7.64%)

(a) Due to a technical problem involving the password auditing software and the fi le obtained from for testing, we were

not able to complete the hybrid dictionary attack portion of the password strength analysis for this component. Thus, the 

fi gures presented above for are for the dictionary and user information attacks only.

DHS policy requires that system ISSOs determine and enforce 

appropriate measures to ensure that strong passwords are used. Further, 

the DHS Handbook and NIST SP 800-18 require that passwords contain 

a combination of alphabetic, numeric, and special characters. According 

to NSA, passwords should also contain upper and lowercase characters. 

• DHS components did not properly confi gure remote access hosts.16 

For example, the remote access hosts had the following confi guration 

15

16 See Appendix E for a detailed description of the vulnerabilities identifi ed at each component, including those related to confi guration 

weaknesses and those resulting from missing or inappropriately applied system patches. 
Page 12 DHS Needs to Strengthen Controls For Remote Access

weaknesses that could allow attackers to gain valuable information or 

compromise the integrity of the system:

Table 2 illustrates the number of hosts, by component, that contained 

confi guration weaknesses.

Table 2: Confi guration Weaknesses Identifi ed

Component

Number 

of Hosts 

Tested(a)

Number of Hosts with High or Medium Risk Confi guration Weaknesses

1 

Weakness

2

Weaknesses

3

Weaknesses

4 or More

Weaknesses

Total With 1 or 

More Weaknesses

10 0 3 Hosts

(30%) 0 3 Hosts(30%)

6 Hosts

(60%)

14 1 Host

(7%) 0 2 Hosts(14%)

4 Hosts

(29%)

7 Hosts

(50%)

11 1 Host

(9%) 0 0 3 Hosts(27%)

4 Hosts

(36%)

18 0 4 Hosts

(22%) 0 2 Hosts(11%)

6 Hosts

(33%)

(a) For each network reviewed, we selected a remote access domain and conducted vulnerability scans on each of the hosts in 

the domain.

Because of weak account policy settings, passwords, and remote access host 

confi gurations, there is increased risk that an unauthorized person could obtain 

or guess a user ID and password combination to gain access to DHS networks. 

Passwords are often the fi rst lines of defense against hackers or insiders who 

may be trying to obtain unauthorized access to a computer system. The use of 

weak passwords, combined with inappropriate account policy settings and system 

confi gurations, might allow unauthorized internal users and external hackers to 
DHS Needs to Strengthen Controls For Remote Access Page 13

gain access to DHS systems. This is why it is important that DHS components 

have strong account policies, passwords, and system confi gurations. 

Component offi cials said that several of the account and confi guration weaknesses 

noted above were the result of changes that occurred during system migrations 

and were not subsequently corrected. In addition, according to a 

 the creation of strong passwords had not been enforced on 

its network because of the likelihood that users would write down their passwords 

in an accessible place, which may lead to password compromise. However, 

security training and enforcement can decrease the risk of users’ writing down 

their passwords in accessible locations.

System and Application Patches Were Not Applied

Hosts providing remote access capabilities to DHS systems and data were not 

appropriately patched. Remote access hosts at each component were vulnerable 

to buffer overfl ow attacks17 or other exploits due to missing or inappropriately 

applied security patches.18 Specifi cally, according to our tests:

According to NIST SP 800-40, patching is critical to the operational availability, 

confi dentiality, and integrity of information technology systems. Organizations 

should establish a systematic, accountable, and documented process for handling 

patches. DHS remote access hosts were highly vulnerable to attacks because

17 A buffer overfl ow occurs when a program or process tries to store more data in a buffer (temporary data storage area) than it was intended 

to hold. Since buffers are created to contain a fi nite amount of data, the extra information can overfl ow into adjacent buffers, corrupting 

or overwriting the valid data held in them. Attackers can use this vulnerability to replace valid data on the system with their own code and 

cause the system to fail or to execute their instructions. 

18 See Appendix E for the number of hosts tested and number of vulnerabilities detected at each component. 
Page 14 DHS Needs to Strengthen Controls For Remote Access

they were not appropriately patched. For example, servers at 

 were vulnerable to a buffer overfl ow in the Microsoft Windows 

Messenger service.19 By sending a 

Subsequent to the completion of our audit work, offi cials from each of the 

components said that they had taken or planned to take corrective action to 

address many of the account policy, password, confi guration, and patch issues that 

we identifi ed. However, we did not verify that these problems had been solved.

Modems On DHS Networks May Increase Risk Of Unauthorized Access

We detected possible unauthorized modems operating on DHS networks. During 

our modem discovery tests, we identifi ed modems on the analog lines of DHS 

Management, EP&R, CIS, and ICE. DHS Management and EP&R provided us 

with information regarding the mission requirement for each of the modems that 

we detected on their networks or phone lines, along with some of the controls 

implemented to reduce the risks associated with their use. 

According to an ICE offi cial, CIS and ICE were in the process of investigating 

20 modems that we identifi ed, but they were not able to provide a business 

justifi cation for 18 of them. They were not able to provide a timely response, 

according to an ICE offi cial, due in part to inaccuracies in the CIS and ICE 

database of telecommunications management information. 

An unsecured modem or other dial-in facility could provide a backdoor for 

internal and external unauthorized users to DHS networks. According to 

FISCAM, dial-in access can signifi cantly increase the risk of unauthorized access, 

and its use should be limited and the associated risks weighed against the benefi ts. 

Justifi cation for such access should be documented and approved by system 

owners. 

19 The Windows Messenger service transmits messages between client computers and servers on a network. For example, network 

administrators can use the Messenger service to send administrative alerts to network users, or it can be used by Windows to inform users 

when a print job has been completed.
DHS Needs to Strengthen Controls For Remote Access Page 15

Miscellaneous Issue

CIS Needs To Monitor Systems Security Functions

CIS does not monitor suffi ciently the security activities performed by ICE 

personnel on the systems and data supporting CIS operations. CIS and ICE 

were part of the former Immigration and Naturalization Service and continue 

to share the same network infrastructure, which is managed by ICE. However, 

CIS does not have a process to verify that ICE information technology staff is 

performing necessary security or user administration functions for CIS systems 

and personnel. Further, ICE offi cials were not able to determine whether users 

granted remote access to the network were CIS or ICE personnel based on system 

records. According to CIS and ICE offi cials, effective CIS oversight has not been 

established because the components have not completed a formal memorandum of 

agreement concerning their respective responsibilities. 

FISMA requires that senior agency offi cials provide security for the information 

and information systems that support the operations and assets under their control. 

Without an established process to monitor the quality of user administration 

performed by ICE offi cials, CIS lacks assurance that suffi cient security is 

provided for the systems and data supporting its operations.

Recommendations

To enhance DHS’ guidance for remote access implementation, we recommend 

that the CIO:

1. Update the DHS Sensitive Systems Handbook to include implementation 

and confi guration procedures for remote access to DHS systems.

To protect remote access to DHS networks effectively, we recommend that the 

CIO: 

2. Ensure that procedures for granting, monitoring, and removing user 

access are fully implemented according to DHS requirements, as well as 

NIST and FISCAM guidelines.

3. Verify that all necessary system and application patches are applied in a 

timely manner to reduce the risk of system compromise or failure.
Page 16 DHS Needs to Strengthen Controls For Remote Access

Management Comments and Our Evaluation

We obtained written comments on a draft of this report from DHS. We have 

incorporated the comments where appropriate and included a copy of the 

comments in their entirety as Appendix B. DHS generally agreed with each 

of our recommendations. Below is a summary of DHS’ response to each 

recommendation and our assessment of the response.

Recommendation 1: Update the DHS Sensitive Systems Handbook to include 

implementation and confi guration procedures for remote access to DHS 

systems.

DHS plans to update the DHS Sensitive Systems Handbook with minimum 

requirements and confi guration guidance by February 2005. It is not DHS’ intent 

to issue “one size fi ts all” procedures for the entire department. DHS agreed that 

exit procedures need to be clear and adhered to and access permissions should 

be periodically revalidated, but said that regular reviews of audit logs were not 

feasible due to the volumes of audit data and the lack of audit reduction tools. 

We accept DHS’ response to update the DHS Sensitive Systems Handbook with 

minimum requirements and confi guration guidance. We do not agree that our 

fi ndings and recommendations imply that DHS must establish “one size fi ts 

all” procedures for remote access. We maintain that procedures for granting, 

monitoring, and removing user access must be enforced; and the Department 

must establish confi guration guidelines for the hosts providing remote access 

to its networks. In addition, we also maintain that DHS should enforce the 

requirements outlined in the DHS Sensitive Systems Handbook for regular 

reviews of audit logs. As noted in the GAO FISCAM, security software should 

be implemented to analyze audit trail information and selectively identify 

unauthorized, unusual, and sensitive access activity.

Recommendation 2: Ensure that procedures for granting, monitoring, and 

removing user access are fully implemented according to DHS requirements, 

as well as NIST and FISCAM guidelines.

DHS will continue to work to enforce DHS requirements and, where appropriate, 

NIST and FISCAM guidelines. DHS also plans to reduce its reliance on 

passwords and move to stronger authentication technologies. However, where 

the use of passwords is still necessary, DHS policy requires the use of strong 

password controls, including strict limits on the number of failed logon attempts. 
DHS Needs to Strengthen Controls For Remote Access Page 17

We accept DHS’ response to move toward stronger authentication technologies. 

Nonetheless, many of the hosts we tested were not confi gured in accordance with 

DHS requirements and had weak passwords and password controls, including 

hosts that allowed an unlimited or excessive number of failed logon attempts. 

Until stronger authentication technologies are employed and as long as passwords 

are used as an identifi cation and authentication mechanism at DHS, strong 

password controls must be enforced on DHS systems.

Recommendation 3: Verify that all necessary system and application patches 

are applied in a timely manner to reduce the risk of system compromise or 

failure.

DHS indicated that it will continue to strengthen its patch management. DHS also 

noted that implementation of some of the patches was delayed so that the impact 

on their systems could be tested.

We accept DHS’ response to continue to strengthen its efforts for effective patch 

management. We agree that it is important to test the impact of system and 

application patches prior to their implementation. However, we identifi ed security 

patches that the vendor released over six months before our review that had not 

yet been implemented on some DHS systems. In addition, one host was missing 

patches that were released in 1999 and 2000.
Page 18 DHS Needs to Strengthen Controls For Remote Access

Appendix A

Purpose, Scope, and Methodology

Purpose, Scope, and Methodology

The objective of this audit was to determine whether DHS had provided system 

security, integrity, and control over remote access to its computer systems and 

data. Specifi cally, we determined whether: (1) DHS developed adequate security 

policies and procedures to grant and control remote access to system resources, 

including the administration, confi guration, and use of remote access paths to 

networks; and, (2) security controls were properly confi gured on applications 

and systems providing remote access. For some controls, we determined their 

adequacy, but we did not test their effectiveness. Our focus was on testing the 

implementation of secure confi gurations on the hosts controlling remote access to 

DHS networks.

The audit focused on wire-based remote access to DHS systems and resources, 

including dial-in access through modems and access through the internet. We 

did not examine wireless remote access, including satellite and microwave-based 

access, during this audit. We conducted fi eldwork at the following locations:

• DHS Management

• Emergency Preparedness and Response (EP&R)

• Bureau of Citizenship and Immigration Services (CIS)

• Bureau of Immigration and Customs Enforcement (ICE)

• Transportation Security Administration (TSA) 

During the audit, we used three software tools to conduct internal and external 

security tests to evaluate the effectiveness of controls implemented for remote 

access. NIST SP 800-42 identifi es the following as common testing tools:

• Internet Security Systems’ (ISS) Internet Scanner 7.0, which is a 

component of the ISS Dynamic Threat Protection platform, was used to 

detect and analyze vulnerabilities on DHS systems, including servers and 

infrastructure devices. 

• @stake’s L0phtCrack 5.02, which is a password auditing and recovery 

application, was used to analyze passwords that control remote access to 

DHS systems and resources. We analyzed encrypted system passwords 

to test for compliance with agency password policies or security best 

practices. 

• Sandstorm Enterprises’ PhoneSweep 4.0, which is a telephone 

scanner, was used for modem discovery and analysis, also known as 
DHS Needs to Strengthen Controls For Remote Access Page 19

“war dialing.”20 PhoneSweep was used to dial a range of numbers, 

provided by the selected components, to identify modems and computers 

running remote access software to bypass the corporate fi rewall. Once 

an active modem was identifi ed, we did not use PhoneSweep to establish 

a connection with the modem using standard user ID and password 

combinations.

Before the creation of DHS, both CIS and ICE were part of the former 

Immigration and Naturalization Service; these components continue to share the 

same infrastructure, which is managed by ICE. As a result, the technical scans 

for CIS and ICE were combined. Upon completion of testing, we provided each 

component the technical reports detailing the specifi c vulnerabilities detected on 

their networks and the actions needed for remediation. 

We conducted our audit between April and August 2004 under the authority of the 

Inspector General Act of 1978, as amended, and according to generally accepted 

government auditing standards. Major OIG contributors to the audit are identifi ed 

in Appendix F.

The principal OIG points of contact for the audit are Frank Deffer, Assistant 

Inspector General for Information Technology Audits, at (202) 254-4100; and 

Edward G. Coleman, Director, Information Security Audit Division, 

at (202) 254-5444. 

Appendix A

Purpose, Scope, and Methodology

20 Also synonymous with demon dialing, is a technique by which a computer would repeatedly dial a large number of telephone numbers to 

fi nd test tones, computers, voice mailboxes, private branch exchanges, and government offi ces. 
Page 20 DHS Needs to Strengthen Controls For Remote Access

Appendix B

Management’s Response
DHS Needs to Strengthen Controls For Remote Access Page 21

Appendix B

Management’s Response
Page 22 DHS Needs to Strengthen Controls For Remote Access

Appendix C

User Administration Processes

III. Account Review 

Employee Departures

(a) PersonnelOffice routinelynotifies SystemsOffice of employeedepartures to verify that access has been removed

(c) System Owners review all access levels for each user every month and sign an access approval list (b) Systems Office reviews and disables inactive accounts after a 

set period of inactivity, e.g., 90 days

Access List Access Approval List

(d) Audit trailinformation should be used to detectunauthorized, unusual,or sensitive access.Audit trails should be reviewed regularly and suspected violationsinvestigated.

Personnel

Office

System

Administrator System

Owner Security

Manager

The following user administration functions should be performed, based on NIST SP 800-12 recommendations and GAO FISCAM guidelines. Different personnel, based onthe needs of the organization, can perform several of the functions listed below. For more information, please see NIST SP 800-12, An Introduction to Computer Security:The NIST Handbook, and the FISCAM.

(1) Supervisornotifies thataccess is no longer needed

Access Removal Request

(2a) System Ownerrecords access change and notifiessystems office

(3) SystemAdministrator disablesor deletes account

Access Removal Request

Personnel

Office

Note: Separate processes should be established for 

friendly, i.e., mutually acceptable, and unfriendlyemployee separations, including additional security 

precautions to prevent adverse events in the case of unfriendly terminations.

(2b) Security Managernotified immediately,either by the personneloffice or by others Exit checklist must b

initialed by each relevant functionalmanager

e

Exit Checklist

Employee Departures Exit Checklist 

System

Owner

(4) User completesexit checklist

User’s

Supervisor

User

System

Administrator

Account Information

Security training should be provided toeach user and a Rules of Behavior document completed and maintained onfile

Transmit securely

(5) Accountinformation is transmitted to user

R.O.B. Doc.

Maintain approvedaccess requests on file (4) System

Administrator createsaccount

System

Administrator

(1) Supervisorrequests access

User’s

Supervisor

Access Approval

(3) SecurityManager reviewsapprovals forquestionable access

Security

Manager

Access Approval

(2) System Ownerreviews and approves access 

System

Owner

Request for Access Use standardized forms, and the requestshould include the level of access needed

I. Account Creation 

User

II. Account Removal

Security

Manager
DHS Needs to Strengthen Controls For Remote Access Page 23

Appendix D

Account Policy Settings

Parameter

Risk Associated 

with Weak 

Policy Setting

NIST and NSA 

Recommended 

Setting

DHS Required 

Setting

Actual Setting

 

Maximum 

password age: 

The period 

of time that a 

user is allowed 

to have a 

password 

before being 

required to 

change it.

Limiting 

password life 

reduces the 

likelihood of 

unauthorized 

access

Less than 90 days Less than 90 

days 90 days Passwords 

never expire

Passwords

never expire 45 days

Minimum 

password age: 

Specifi es how 

long a user 

must wait 

after changing 

a password 

before 

changing it 

again.

If changes 

are allowed 

immediately, 

a user could 

change their 

password, then 

immediately 

change it back 

to what it was 

before. 

At least 1 day At least 1 day 14 days

Changes 

allowed 

immediately

Changes

allowed 

immediately

Changes

allowed 

immediately

Minimum 

password 

length: The 

minimum 

number of 

characters a 

password must 

contain 

Blank 

passwords and 

shorter length 

passwords are 

easily guessed 

by password 

cracking tools. 

High risk 

environments:

12 characters

Other 

environments:

8 characters

8 characters 8 

characters 6 characters 5 characters 8 characters

Password 

uniqueness/

history: 

Prevents 

users from 

toggling among 

their favorite 

passwords

Forcing users 

to change their 

passwords 

reduces the 

likelihood 

that a hacker 

or password 

cracker will 

discover 

passwords.

24 passwords 4 to 6 

passwords

24 

passwords

5 

passwords

10 

passwords

24 

passwords

Account lockout 

after # of bad 

logon attempts: 

Specifi es the 

number of bad 

logon attempts 

that can be 

made before 

an account is 

locked out. 

Establishing 

an account 

lockout threshold 

helps prevent 

password 

cracking or 

guessing attacks 

on the system.

3 invalid

attempts or less

3 invalid

attempts or less

3 invalid 

attempts

No account 

lockout

12 invalid 

attempts

3 invalid

attempts
Page 24 DHS Needs to Strengthen Controls For Remote Access

Reset lockout 

counter after 

# of minutes: 

Specifi es the 

number of 

minutes until 

the bad logon 

count is reset.

Setting the 

number of 

minutes too low 

may reduce the 

effectiveness 

of the account 

lockout control 

15 minutes or 

more Not specifi ed 15 

minutes

No account 

lockout 30 minutes 15 minutes

Lockout 

duration: Sets 

the number 

of minutes an 

account will be 

locked out. 

Setting the 

number of 

minutes too low 

may reduce the 

effectiveness 

of the account 

lockout control 

15 minutes or 

more, but not 

forever(a)

Forever 15 

minutes

No account 

lockout Forever 15 minutes

(a) According to NSA, setting the lockout duration to forever may lead to a denial of service attack, i.e., a form of attacking another computer 

to prevent legitimate users of a system from using the computer or its services.

Appendix D

Account Policy Settings
DHS Needs to Strengthen Controls For Remote Access Page 25

Appendix E

Vulnerabilities Identifi ed

Component

Number 

of Hosts 

Tested

Number of Vulnerabilities Detected(a)

High Risk 

Vulnerabilities

Medium Risk 

Vulnerabilities Total 

10 13 12 2514 21 52 73

11

4 14 18

18

8 10 18

Component

Number 

of Hosts 

Tested

Number of Hosts with High or Medium Risk Vulnerabilities(a)

(Number and Percent)

No

Weaknesses

1 

Weakness

2

Weaknesses

3

Weaknesses

4 or More 

Weaknesses

Total with 1 

or More

10

3

(30%)

1

(10%)

0

3

(30%)

3

(30%)

7

(70%)

14

7

(50%)

1

(7%)

0 1 (7%)

5

(36%)

7

(50%)

11

7

(64%) 0 1 (9%)

0

3

(27%)

4

(36%)

18 11 (61%)

1

(6%)

4

(22%)

0

2

(11%)

7

(39%)

(a) Includes confi guration weaknesses and patch-related vulnerabilities
Page 26 DHS Needs to Strengthen Controls For Remote Access

Appendix F

Major Contributors to This Report

Information Security Audits Division

Edward G. Coleman, Director

Patrick Nadon, Audit Manager

Chiu-Tong Tsang, Audit Team Leader

Jason Bakelar, Auditor

Pedro Calderon, Auditor

Evan Portelos, Associate

Anthony Nicholson, Referencer

Advanced Technology Division

Jim Lantzy, Director

Chris Hablas, Senior Security Engineer
DHS Needs to Strengthen Controls For Remote Access Page 27

Appendix G

Report Distribution

Department of Homeland Security

Secretary

Deputy Secretary

Chief of Staff

General Counsel

Under Secretary, Management

DHS OIG Liaison

DHS Chief Information Security Offi cer

DHS Public Affairs

CIO Audit Liaison

DHS Offi ce of Security

Director, Compliance and Oversight Program, OCIO

Offi ce of Management and Budget

Chief, Homeland Security Branch

DHS OIG Budget Examiner

Congress

Appropriate Congressional Oversight and Appropriations Committees
Page 28 DHS Needs to Strengthen Controls For Remote Access

Additional Information and Copies

To obtain additional copies of this report, call the Offi ce of Inspector General (OIG) at 

(202) 254-4100, fax your request to (202) 254-4285, or visit the OIG web site at www.

dhs.gov/oig.

OIG Hotline

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal 

or noncriminal misconduct relative to department programs or operations, call the OIG 

Hotline at 1-800-323-8603; write to Department of Homeland Security, Washington, DC 

20528, Attn: Offi ce of Inspector General, Investigations Division – Hotline. The OIG 

seeks to protect the identity of each writer and caller.