GAO

United States General Accounting Office

Report to the Chairman, Committee on

Commerce, House of Representatives

July 2000 INFORMATION

SECURITY

Fundamental

Weaknesses Place EPA

Data and Operations

at Risk

GAO/AIMD-00-215

Page 1 GAO/AIMD-00-215 EPA Information Security

Contents

Letter 3

Appendixes Appendix I: Objectives, Scope, and Methodology 24

Appendix II: Comments From the Environmental Protection

Agency 26

Appendix III: GAO Contact and Staff Acknowledgments 39

Figures Figure 1: The Risk Management Cycle 15

Abbreviations

EPA Environmental Protection Agency

IG Inspector General

NIST National Institute of Standards and Technology

OEI Office of Environmental Information

OMB Office of Management and Budget
Page 2 GAO/AIMD-00-215 EPA Information Security
Page 3 GAO/AIMD-00-215 EPA Information Security

United States General Accounting Office

Washington, D.C. 20548

Accounting and Information

Management Division

B-285625 Letr

July 6, 2000

The Honorable Tom Bliley

Chairman

Committee on Commerce

House of Representatives

Dear Mr. Chairman:

This report responds to your August 18, 1999, request that we evaluate the

Environmental Protection Agency’s (EPA) information security program. It

expands on our February 17, 2000, statement, which provided our initial

findings;1 discusses EPA’s actions since mid-February to address the

weaknesses we identified; and recommends needed corrective actions. On

June 16, 2000, we issued a “Limited Official Use” report to you that detailed

specific technical weaknesses found during our tests. Due to their

sensitivity, those details are not included in this version of the report for

public release.

In 1997 and again in 1999, EPA’s Inspector General (IG) reported serious

inadequacies in the agency’s information security planning, control of

Internet services, and monitoring of network activities as well as an

absence of formal firewall technologies to protect EPA from outside

intruders.2 Your request for our evaluation was based largely on your

concerns about EPA’s progress in addressing these problems. Specifically,

you asked that we (1) evaluate EPA’s computer-based controls,

(2) determine the extent and impact of computer security incidents at EPA,

and (3) evaluate the agency’s information security program management.

Our objectives, scope, and methodology are discussed in more detail in

appendix I. We performed our work in accordance with generally accepted

government auditing standards.

1

Information Security: Fundamental Weaknesses Place EPA Data and Operations at Risk

(GAO/T-AIMD-00-97, February 17, 2000).

2

EPA’s Internet Connectivity Controls, Office of Inspector General Report of Audit

(Redacted Version), September, 5, 1997, and Audit of EPA’s Fiscal 1998 Financial

Statements, Office of Inspector General Audit Report Number 99B0003, September 28, 1999.
B-285625

Page 4 GAO/AIMD-00-215 EPA Information Security

Results in Brief Our review found serious and pervasive problems that essentially rendered

EPA’s agencywide information security program ineffective. Our tests of

computer-based controls concluded that the computer operating systems

and the agencywide computer network that support most of EPA’s missionrelated and financial operations were riddled with security weaknesses. Of

particular concern is that many of the most serious weaknesses we

identified—those related to inadequate protection from intrusions via the

Internet and poor security planning—had been previously reported to EPA

management in 1997 by EPA’s IG.

The negative effects of such weaknesses are illustrated by EPA’s own

records, which show several serious computer security incidents since

early 1998 that have resulted in damage and disruption to agency

operations. In addition, we identified deficiencies in EPA’s incident

detection and handling capabilities that limited EPA’s ability to fully

understand or assess the nature of or damage due to intrusions into and

misuse of its computer systems. As a result of these weaknesses, EPA’s

computer systems and the operations that rely on these systems were

highly vulnerable to tampering, disruption, and misuse from both internal

and external sources. Moreover, EPA could not ensure the protection of

sensitive business and financial data maintained on its larger computer

systems or supported by its agencywide network.

Since the close of our audit in mid-February, EPA has moved aggressively

to reduce the exposure of its systems and data and to correct the

weaknesses we identified. These efforts, which include both short-term

and long-term improvements to system access controls, are still underway,

and we have not tested their effectiveness. However, EPA’s actions show

that the agency is taking a comprehensive and systematic approach that

should help ensure that its efforts are effective.

Sustaining these improvements in today’s dynamic computing environment

will require continuing vigilance and management attention. Our review of

EPA security program planning and management found that EPA’s existing

practices were largely a paper exercise that had done little to substantively

identify, evaluate, and mitigate risks to the agency’s data and systems.

Accordingly, ensuring that corrective actions are effective on a continuing

basis and that new risks are promptly identified and addressed will entail

implementing significant improvements in the way EPA plans for and

manages its information security program. In January 2000, EPA’s Principal

Deputy Assistant Administrator for the Office of Environmental
B-285625

Page 5 GAO/AIMD-00-215 EPA Information Security

Information (OEI) issued a memorandum outlining planned improvements

in the way EPA centrally manages its information security program. These

planned management improvements, if effectively implemented, will begin

to address many of the deficiencies we identified. However, implementing

them will require a major adjustment in the way EPA’s program and

technical staff manage the agency’s information security risks.

We are recommending that the EPA Administrator take a number of steps

to strengthen access controls associated with EPA’s major computer

operating systems and agencywide network, enhance incident

management efforts, and improve security program management and

planning. In comments to a draft of this report, EPA concurred with our

recommendations and described related corrective actions.

National Concern

About Information

Security Is Growing

Information security is an important consideration for any organization

that depends on information systems and computer networks to carry out

its mission or business. Computer security risks are significant, and they

are growing. The dramatic expansion in computer interconnectivity and

the exponential increase in the use of the Internet are changing the way our

government, the nation, and much of the world communicate and conduct

business. However, without proper safeguards, these developments pose

enormous risks that make it easier for individuals and groups with

malicious intentions to intrude into inadequately protected systems and

use such access to obtain sensitive information, commit fraud, disrupt

operations, or launch attacks against other organizations’ sites. Further, the

number of individuals with computer skills is increasing, and intrusion, or

“hacking,” techniques are readily available and relatively easy to use. The

rash of cyber attacks launched in February 2000 against major Internet

firms are illustrative of the risks associated with this new electronic age.
B-285625

Page 6 GAO/AIMD-00-215 EPA Information Security

Computer-supported federal operations are also at risk. Our previous

reports, and those of agency IGs, describe persistent computer security

weaknesses that place a variety of critical federal operations at risk of

disruption, fraud, and inappropriate disclosures.3 This body of audit

evidence led us, in 1997 and again in 1999, to designate computer security

as a governmentwide high-risk area in reports to the Congress.4 Our most

recent summary analysis found that significant computer security

weaknesses had been identified in 22 of the largest federal agencies,

including EPA.5

How well federal agencies are addressing these risks is a topic of

increasing interest in both the Congress and the executive branch. This is

evidenced by recent hearings on information security, proposed legislation

intended to strengthen information security, and the President’s January

2000 National Plan for Information Systems Protection.6 As outlined in this

plan, a number of new, centrally managed entities have been established

and projects have been initiated to assist agencies in strengthening their

security programs and improving federal intrusion detection capabilities.

In addition, on March 3, 2000, in response to recent Internet disruptions,

the President issued a memorandum to the heads of executive departments

and agencies urging them to renew their efforts to safeguard their

computer systems against denial-of-service attacks from the Internet.

EPA Is a Major Steward

of National

Environmental

Information

EPA’s mission is to protect human health and safeguard the environment.

The need to manage its programs for results substantially increases EPA’s

demand for high-quality environmental information. Such information is

also required to identify and respond to emerging problems before

significant damage is done to the environment. To fulfill its mission, EPA

and the states collect a wealth of environmental data under various

statutory and regulatory requirements. In addition, EPA conducts research

3

Information Security: Serious Weaknesses Place Critical Federal Operations and Assets at

Risk (GAO/AIMD-98-92, September 23, 1998).

4

High-Risk Series: Information Management and Technology (GAO/HR-97-9, February 1997)

and High-Risk Series: An Update (GAO/HR-99-1, January 1999).

5

Critical Infrastructure Protection: Comprehensive Strategy Can Draw on Year 2000

Experiences (GAO/AIMD-00-1, October 1, 1999).

6

Defending America’s Cyberspace: National Plan for Information Systems Protection: An

Invitation to a Dialogue, issued by the President on January 7, 2000.
B-285625

Page 7 GAO/AIMD-00-215 EPA Information Security

on environmental issues and collects data through its own environmental

monitoring activities.

EPA’s major program offices—the offices of Water; Air and Radiation;

Research and Development; Solid Waste and Emergency Response; and

Prevention, Pesticides and Toxic Substances—are responsible for

implementing pertinent statutes, such as the Clean Air Act and the Clean

Water Act. An assistant administrator heads each program office. Ten

regional offices, headed by regional administrators, assist in executing the

agency’s programs and determine regional needs within selected states.

Also, administrative offices, including the Office of the Chief Financial

Officer and OEI, headed by assistant administrators or their equivalents,

support the overall mission of the agency.

EPA has spent significant time and resources to develop its information

systems and computer networks to assist in carrying out its mission—

reportedly $435 million and $403 million in fiscal years 1998 and 1999,

respectively, for data collection and information management and

technology operations and investments. The integrity and availability of the

information maintained on EPA computers is important since it is used to

support EPA’s analyses, research, and regulatory activities.

Because of the nature of its mission, EPA collects, oversees, and

disseminates data of varying sensitivity. EPA makes much of its

information available to the public through Internet access in order to

encourage public awareness and participation in managing human health

and environmental risks and to meet statutory requirements. EPA also

maintains confidential data from private businesses, data of varying

sensitivity on human health and environmental risks, financial and contract

data, and personal information on its employees. Consequently, EPA’s

information security program must accommodate the often competing

goals of making much of its environmental information widely accessible

while maintaining data integrity, availability, and appropriate

confidentiality.

Like many other organizations, EPA’s computer environment has changed

over the last few years from one involving a centralized mainframe with a

highly controlled network to one involving many large computers on a

network with nearly unlimited access, including public access through the

Internet. This new environment is beneficial because it provides EPA

opportunities for streamlining operations and it has provided public access

to significant amounts of information. However, this increasingly
B-285625

Page 8 GAO/AIMD-00-215 EPA Information Security

interconnected computing environment also significantly elevates the risks

of inappropriate access to sensitive and critical data. These risks include

exposing EPA computers and data to individuals with malicious or criminal

intentions, who may want to disrupt or misuse EPA’s systems for purposes

such as fraud, sabotage, or obtaining sensitive business or personnel data.

As a result, EPA, like many other private and government organizations,

faces the challenge of balancing the benefits of new technology and

Internet use with the new risks such technology introduces. Because such

risks cannot be completely eliminated, this balancing act requires a

proactive approach to managing information security risks that is dynamic

and constantly attentive to changing threats.

EPA’s System Access

Controls Were

Ineffective

Computer systems access controls are key to ensuring that only authorized

individuals can gain access to sensitive and critical agency data. They

include a variety of tools such as passwords, which are intended to

authenticate authorized users; access control software, which is used to

specify individual users’ privileges on the system (e.g., read, alter, copy, or

delete files); and firewalls, which are to serve as barriers for filtering out

unwanted access.

Our tests showed that EPA’s access controls were ineffective in adequately

reducing the risk of intrusions and misuse. Using widely available software

tools, we demonstrated that EPA’s network was highly susceptible to

intrusions through the Internet and that user and system administrator

passwords could be easily accessed, read, or guessed. In addition, we

identified weaknesses in all of EPA’s computer operating systems that

made it possible for intruders, as well as EPA employees or contractors, to

bypass or disable computer access controls and undertake a wide variety

of inappropriate or malicious acts. These acts could include tampering with

data; browsing sensitive information; using EPA’s computer resources for

inappropriate purposes, such as launching attacks on other organizations;

and seriously disrupting or disabling computer-supported operations.

Because the weaknesses we identified were associated with the operating

systems of EPA’s main computers and agencywide network—resources

that are referred to as “general support systems”—they affected the

security of all of the EPA operations that rely on them. These operations

include computer applications that EPA’s individual units rely on to carry

out their day-to-day operations, such as gathering data on pollutants,

research, regulatory enforcement, and financial management.
B-285625

Page 9 GAO/AIMD-00-215 EPA Information Security

In short, we identified weaknesses that if exploited, could have allowed us

to control individual EPA computer applications and the data used by these

applications. As such, we could have copied, changed, deleted, or

destroyed information, thus rendering any security controls implemented

for software applications used in specific EPA office networks virtually

ineffective. The most significant problems identified by our work are

discussed below.

Ineffective Perimeter

Defenses

A firewall and similar perimeter defenses are an organization’s first line of

defense from outside intrusion. Put simply, a firewall is a software package

that controls the content of inbound and outbound computer network

traffic, allowing only authorized traffic through its filters. If a firewall is not

properly deployed, it may be overly restrictive, thus unnecessarily

hindering the flow of network traffic, or it may be too weak, thus providing

little or no protection. EPA’s firewall and other perimeter defenses

(referred to as screening routers)—designed largely to protect agency

systems from unauthorized access from the Internet—were not effective in

preventing such intrusions because of weaknesses in their configuration

and deployment. In our tests, we simulated the type of attacks that might

be employed by a computer hacker intruding via the Internet and readily

breached and took control of EPA’s firewall and other perimeter defenses,

thereby gaining access to EPA’s agencywide network.

Weak Network and

Operating System Controls

In addition to having ineffective perimeter defenses, EPA did not have

adequate controls over access to key network components. During our

tests, we were able to move throughout the network unimpeded and could

have diverted, altered, or disrupted network traffic. Further, we gained

access to EPA’s major computer systems and the applications supported by

them. As a result, by intruding from the Internet, we could have browsed,

altered, or deleted data associated with these applications or disrupted

their operation.

Poor Password Protections Passwords are EPA’s primary means of ensuring that access to key network

components is appropriately restricted to authorized personnel. However,

we identified serious weaknesses in EPA’s controls over the confidentiality

and integrity of its passwords. For example, we were able to guess many of

EPA’s passwords based on our knowledge of commonly used passwords,

and we were able to decrypt encrypted password files by using commonly

available “password-cracking” software. While on the network, we
B-285625

Page 10 GAO/AIMD-00-215 EPA Information Security

eavesdropped on computer users’ activities, observed them keying in

passwords, and used these passwords to obtain “high level” system

administration privileges. Such privileges would have allowed us to

(1) change system access and other rules, (2) potentially read, alter, delete,

or redirect network traffic, and (3) read or tamper with files maintained on

EPA’s larger computers.

Recent Remediation Efforts Our audit has provided EPA’s senior management with specific information

on individual control weaknesses, and EPA has moved promptly to address

these weaknesses. In a meeting with senior OEI management and technical

staff in December 1999, we alerted EPA to significant security

vulnerabilities identified by our testing, which, because of their severity,

warranted immediate remediation by EPA. This interaction was productive

and resulted in quick corrective actions.

Further, in mid-February, EPA began a series of more comprehensive

efforts to supplement its information security controls and ensure the

effectiveness of those in place. In addition, as an interim step to reduce its

risks, EPA temporarily disabled its link to the Internet and discontinued

certain services and access privileges while it (1) assessed the relative

criticality and sensitivity of its computer-supported operations,

(2) reevaluated the agency’s and its customers’ needs for access to data,

and (3) implemented strengthened controls. While we have not retested

EPA controls and, therefore, cannot attest to the effectiveness of its recent

improvement efforts, EPA’s actions demonstrate that it is moving in the

right direction and taking a systematic, risk-based approach. Such an

approach is important in helping to ensure that improvement efforts are

effective and appropriate. As discussed later in this report, it is important

that these efforts to strengthen technical controls be supported by

improvements in the way EPA manages information security on an ongoing

basis.

EPA’s Systems and

Data Have Been

Compromised and

Misused

EPA’s records show that vulnerabilities, such as those just described, have

been exploited by both external and internal sources. In some cases, these

vulnerabilities were exploited because EPA had not corrected known

vulnerabilities and properly managed user accounts. Further, those records

illustrate deficiencies in EPA’s ability to detect, respond to, and document

security incidents affecting its systems.
B-285625

Page 11 GAO/AIMD-00-215 EPA Information Security

The records we analyzed consist primarily of security-related problem

reports for 1998 and 1999 that EPA extracted for us from a computerized

database maintained at its National Computer Center. By analyzing the

database and related records, we identified about two dozen instances

where security weaknesses were exploited and EPA systems were

compromised or misused. EPA’s records, while incomplete for many

incidents, show that some incidents resulted in damage, disruption, and

criminal investigations. In addition, the records showed that EPA was the

subject of repeated systematic probes from a variety of domestic and

foreign sources. Both the nature and routine pattern of these probes are

characteristic of attempts to identify vulnerabilities in EPA’s computer

network. Such activity raises concerns that intruders may be preparing for

future penetrations.

Some examples that illustrate the types of intrusions and misuse we

identified follow. These examples were taken from EPA’s records; we did

not independently investigate them. For many of the examples, we could

not determine the full extent of any damage caused by the incidents or how

the incidents were resolved because this information had not been

documented in EPA’s records. For other examples, details cannot be

publicly disclosed because the incidents are currently under investigation.

• Ιn June 1998, EPA was notified that one of its computers was used by a

remote intruder as a means of gaining unauthorized access to a state

university’s computers. The problem report stated that vendor-supplied

software updates were available to correct the vulnerability, but EPA

had not installed them.

• In July 1999, a “chat room” was set up on a network server at one of

EPA’s regional financial management centers for hackers to post notes

and, in effect, conduct on-line electronic conversations. According to

EPA, this incident was still under investigation in mid-January of this

year.

• In February 1999, a sophisticated penetration affected three of EPA’s

computers. EPA was unaware of this penetration until notified by the

Federal Bureau of Investigation.

• In June 1999, an intruder penetrated an Internet web server at EPA’s

National Computer Center by exploiting a control weakness specifically

identified by EPA about 3 years earlier during a previous penetration on

a different system. The vulnerability continued to exist because EPA had

not implemented vendor software updates (patches), some of which had

been available since 1996.
B-285625

Page 12 GAO/AIMD-00-215 EPA Information Security

• On two occasions during 1998, extraordinarily large volumes of network

traffic—synonymous with a commonly used denial-of-service hacker

technique—affected computers at one of EPA’s field offices. In one case,

an Internet user significantly slowed EPA’s network activity and

interrupted network service for over 450 EPA computer users. In a

second case, an intruder used EPA computers to successfully launch a

denial-of-service attack against an Internet service provider.

• In September 1999, an individual gained access to an EPA computer and

altered the computer’s access controls, thereby blocking authorized

EPA employees from accessing files. This individual was no longer

officially affiliated with EPA at the time of the intrusion, indicating a

serious weakness in EPA’s process for applying changes in personnel

status to computer accounts.

Poor Intrusion

Detection and Incident

Response Capabilities

Further Impair EPA’s

Security

Even strong controls may not block all intrusions and misuse, but

organizations can reduce the risks associated with such events if they

promptly take steps to detect intrusions and misuse before significant

damage can be done. In addition, accounting for and analyzing security

problems and incidents are effective ways for organizations to gain a better

understanding of threats to their information and of the costs of their

security-related problems. Such analyses can pinpoint vulnerabilities that

need to be addressed to help ensure that they will not be exploited again. In

this regard, problem and incident reports can provide valuable input for

risk assessments, help in prioritizing security improvement efforts, and be

used to illustrate risks and related trends in reports to senior management.

During our reviews of technical controls and of EPA’s security problem and

incident records, we identified a number of deficiencies in EPA’s incident

detection and handling capabilities.

• EPA’s capabilities for detecting intrusions and misuse were very limited.

The automated detection tools EPA had implemented were not

effectively deployed, and in some instances, logs of computer activities

were not promptly analyzed to identify unusual or suspicious events or

patterns. The effect of these limitations was illustrated by the fact that

EPA did not recognize and record much of the activity associated with

our test activities. While 23 problem reports were recorded, indicating

knowledge about our intrusion testing, none of them recognized the

magnitude of our activity or the severity of the security breaches we

initiated.
B-285625

Page 13 GAO/AIMD-00-215 EPA Information Security

• For most of the instances where security weaknesses were actually

exploited, EPA had not fully documented the extent of resulting damage

or disclosure. Such information is helpful in better understanding

security risks and in determining how much to spend on related

controls.

• EPA did not routinely analyze problem reports to identify trends and

vulnerabilities and apply lessons learned to other units throughout the

agency.

• EPA did not fully follow up on problems to ensure that they were

resolved and that identified vulnerabilities were not repeatedly

exploited.

• Problem listings were not protected from browsing. Such protection is

important to ensure that intruders or others cannot gain detailed

information on security vulnerabilities awaiting correction or monitor

the investigations of incidents that they may have originated.

• EPA had not established adequate standards, controls, responsibilities,

and procedures to ensure uniform and complete management of

security problems and responses or clearly differentiated government

and contractor responsibilities.

• EPA had not routinely summarized and reported security problems and

their resolutions to senior EPA managers so that they were aware of the

magnitude of the problems and related trends.

EPA’s incident recordkeeping procedures provide a beginning for more

robust incident handling and analysis practices. However, the weaknesses

described above diminish the value of these records and of related followup activities.

Security Program

Planning and

Management Are

Fundamentally Weak

It is imperative that EPA correct the specific weaknesses we identified.

However, ensuring that computer security controls remain effective on an

ongoing basis will require substantial changes to the way EPA approaches

information security, especially in regard to (1) assessing risk and

determining security needs and (2) ensuring that existing controls are

operating effectively. Our review of EPA’s security planning and

management process found that OEI, which includes EPA’s Chief

Information Officer, and EPA’s program and support offices were not

adequately working together to ensure that information security risks were

fully understood and addressed.

The need for federal agencies to protect sensitive and critical, but

unclassified, data has been recognized for years in various laws, including
B-285625

Page 14 GAO/AIMD-00-215 EPA Information Security

the Privacy Act of 1974, the Paperwork Reduction Act of 1980, and the

Computer Security Act of 1987. In particular, the Computer Security Act of

1987 requires federal agencies to establish security plans for all federal

computer systems that contain sensitive information. Also, the Office of

Management and Budget (OMB) Circular A-130, Appendix III, Security of

Federal Automated Information Resources, notes that all agency systems

merit some level of protection and requires agencies to implement controls

commensurate with risk. It also requires agencies to ensure that these

controls are reviewed at least every 3 years and directs senior program

managers to formally authorize use of each system prior to its

implementation and periodically thereafter.

Our own study of leading security management practices used in

commercial and nonfederal settings serves to help pinpoint the significant

weaknesses in EPA’s computer security program management.7 We found

that these leading organizations manage their information security risks

through a cycle of risk management activities. The basic framework—built

on 16 specific practices—provides for risk management through an

ongoing cycle of activities coordinated by a central focal point. This

management process, shown in figure 1, involves

• assessing risk to determine information security needs,

• developing and implementing policies and controls that meet these

needs,

• promoting awareness to ensure that risks and responsibilities are

understood, and

• instituting an ongoing program of tests and evaluations to ensure that

policies and controls are appropriate and effective.

7

Information Security Management: Learning From Leading Organizations (GAO/AIMD-98-

68, May 1998).
B-285625

Page 15 GAO/AIMD-00-215 EPA Information Security

Figure 1: The Risk Management Cycle

This process is generally consistent with OMB and National Institute of

Standards and Technology (NIST) guidance on information security

program management, and it has been endorsed by the federal Chief

Information Officers Council as a useful resource for agency managers. By

adopting the risk management principles and practices recommended by

our guide, agencies can better protect their systems, detect attacks, and

react to security breaches.

Risks Not Fully Considered Conversely, EPA’s security planning and management practices have been

largely a paperwork exercise that has done little to substantively identify,

evaluate, and mitigate risks. EPA’s policies require each of its major

program and support offices to

• determine what levels of protection are appropriate for data and

systems supporting their mission-related operations;

• ensure that appropriate controls have been effectively implemented

before systems become operational;

Central

Focal

Point

Assess Risk

& Determine

Needs

Promote

Awareness

Monitor &

Evaluate

Implement

Policies &

Controls
B-285625

Page 16 GAO/AIMD-00-215 EPA Information Security

• describe information security program roles, responsibilities, and

procedures consistent with the office’s mission, including assigning

responsibility to knowledgeable staff; and

• ensure that staff are provided security awareness training.

According to EPA policy, each unit’s strategy for meeting these

requirements is to be documented in information security program plans.

Placing such responsibilities with EPA’s individual program and support

offices is appropriate because individual units are the most familiar with

the sensitivity and criticality of their data and have the most to lose if poor

security negatively affects their operations. Our review of individual office

security plans and discussions with responsible officials found that many

of EPA’s major offices did not fully consider information security risks,

clearly define the level of protection needed for their operations, or ensure

that controls were implemented effectively. In particular, most offices did

not adequately consider the security risks associated with the operating

systems and agencywide network upon which their individual applications

and information systems heavily rely. Nor did they consider other factors

affecting the security of their individual systems, such as interfaces with

other users’ systems. For example, information security plans for some

financial applications did not address the risks associated with other

financial systems or other program offices’ applications that transmit

sensitive financial information.

In addition, EPA offices did not consistently apply the data risk categories,

or sensitivity levels, described in EPA policy as the basis for determining

what information security controls were needed. Some offices applied

other categories or only partially applied EPA’s guidance. For example, at

the six offices for which security plans had been finalized, none identified

the overall system sensitivity rating required to determine which set of

minimum control requirements outlined in EPA agencywide guidance was

appropriate for the systems.

Further, senior officials authorized some systems for processing without

testing access controls to ensure that they had been implemented and were

operating effectively. Twenty-eight of the 54 system security plans we

reviewed had received no management authorization. Such authorizations

are important because, according to OMB and EPA guidance, they are

intended to represent management’s determination that the security of the

systems supporting their operations is adequate.
B-285625

Page 17 GAO/AIMD-00-215 EPA Information Security

Central Security

Management Functions Are

Inadequate

While EPA program and mission-support offices bear much of the

responsibility for ensuring that systems supporting their operations are

adequately and effectively protected, EPA’s OEI, which encompasses

agency-level information technology management and information security

activities, has an essential role in providing the needed technical expertise

and in effectively implementing technical controls.8 Our studies of security

practices at leading organizations have shown that information security is a

responsibility that must be shared by both technical and program staff.

This is because, while program offices are in the best position to identify

their most sensitive and critical operations and assets, they usually need

assistance from technical personnel and security specialists who have

current knowledge of the latest threats and of the range of technical

controls that can be applied. As in many organizations, most of EPA’s

technical staff and security specialists who support the agencywide

network are organizationally placed under the Assistant Administrator of

OEI, who also serves as EPA’s Chief Information Officer.

We found that OEI and its predecessor organization, which was under the

Office of Administration and Resources Management, had not proactively

monitored the effectiveness of information security efforts throughout the

agency or provided adequate assistance to program offices. While an office

within OEI had developed agencywide security policies and conducted

some security-related training, neither that office nor any other EPA office

has undertaken the role of facilitating and coordinating implementation of

EPA’s security policies throughout the agency or ensuring that all systems

are periodically tested to ensure that controls are operating effectively.

Our study of leading organizations found that a strong central focal point

was important to ensuring that policies were consistently understood and

implemented and that risks, including those associated with agencywide

networks and other broadly used support systems, were fully understood

and considered in individual office plans. In its current formulation, OEI’s

structural organization and staffing capacity simply do not adequately

8

The Paperwork Reduction Act of 1995 and the Clinger-Cohen Act of 1996 stipulate that

agency heads are directly responsible for information technology management, including

ensuring that the information security policies, procedures, and practices of their agencies

are adequate. These acts also require the appointment of chief information officers for all

federal agencies to help provide the expertise needed to implement effective information

resources management.
B-285625

Page 18 GAO/AIMD-00-215 EPA Information Security

address the requisite elements of an effective agencywide security

program.

While the agencywide information security policy and guidance developed

by OEI generally complied with OMB guidance, we identified several areas

where it could be supplemented and clarified to help ensure more effective

security program management at both the individual office level and EPAwide. Specifically, EPA’s information security policy, procedures, and

guidance did not

• clearly distinguish between mandatory and optional requirements;

• define practical risk assessment procedures;

• clearly define responsibilities of Senior Information Resource

Management Officers, system managers, information managers, or

application owners, or describe staff’s responsibility and involvement in

plan development;

• establish an entitywide or office self-assessment process; or

• establish an entitywide process for monitoring resolution of identified

security vulnerabilities.

These deficiencies are in addition to those previously described related to

EPA incident handling capabilities.

EPA Has an

Opportunity to Build

on Its Ongoing

Information Security

Initiatives

The problems we identified pose significant challenges for EPA’s entire

executive and senior management ranks. The agency established OEI in

October 1999 to improve the way it generally manages the large amounts of

information it collects and maintains. While this reorganization may result

in benefits in other areas of information management, at the close of our

review, it had not yet significantly changed the way information security

was being managed and addressed throughout the agency.

Planned improvements to the way EPA manages information security were

outlined in a January 28, 2000, memorandum to EPA executives from the

Principal Deputy Assistant Administrator for OEI. These included (1) an

effort by the Office of Information Collection within OEI to take a broader

look at the agency’s information protection policies, particularly how the

sensitivity of information is determined, and (2) establishment of a

“Technical Information Security Staff” to rapidly enhance EPA’s technical

approach to information security. The memorandum identified the new

security staff’s key functions as
B-285625

Page 19 GAO/AIMD-00-215 EPA Information Security

• developing technical approaches and implementation policies,

• researching and synthesizing best practices,

• supporting senior managers in understanding and carrying out their

information security roles,

• educating users and technical staff,

• developing processes and procedures for tracking and reporting

security incidents, and

• overseeing the auditing and effectiveness of security programs.

These provisions address many of the management deficiencies we

identified, and we encourage EPA to move forward in implementing them.

However, effective implementation will require joint efforts by both

program and technical staff and a major adjustment in the way EPA

considers information security risks and in its management approach. The

Technical Information Security Staff will face major challenges in

facilitating communication and cooperation among EPA’s (1) National

Computer Center staff, (2) program, financial, and regional officials, and

(3) the various components of OEI. It will be essential that the new security

staff proactively oversee and coordinate security-related activities

throughout EPA and ensure that controls are periodically tested, especially

those controls that protect the most sensitive and critical of EPA’s data.

Conclusion EPA is confronted with significant computer security problems that

threaten its operations and data. Many of these problems pertain to specific

technical control issues and EPA’s security incident handling capabilities.

These weaknesses require immediate attention, and EPA has begun steps

to address them. However, like other organizations—public and private—

ensuring that these improvements continue to be effective and

implementing a sustainable information security program will require top

management support and leadership, disciplined processes, consistent

oversight, and, perhaps, additional levels of technical and funding support.

EPA has also begun efforts to implement these important management

practices. It is important that these efforts be institutionalized and

sustained in the long term.
B-285625

Page 20 GAO/AIMD-00-215 EPA Information Security

Recommendations

Control Weaknesses We recommend that the EPA Administrator direct EPA’s Principal Deputy

Assistant Administrator for the Office of Environmental Information to

complete efforts to develop and implement an action plan for strengthening

access controls associated with EPA’s major computer operating systems

and agencywide network. This will require ongoing cooperative efforts

between EPA’s Office of Environmental Information and EPA’s program and

regional offices. We provided EPA a detailed list of these control

weaknesses and related recommendations in the Limited Official Use

report.

Incident Handling We recommend that the Administrator direct EPA’s Principal Deputy

Assistant Administrator for the Office of Environmental Information, the

assistant administrators, and the regional administrators to

• implement policy and procedures for monitoring suspicious activity in

log files and audit trails on a regular schedule commensurate with

current threats and potential impact of damage or disruption and

• restrict access to security incident data so that only those individuals

involved in monitoring and investigating incidents can view such data.

To strengthen EPA’s ongoing security posture and incident management

efforts, we recommend that the Administrator direct EPA’s Principal

Deputy Assistant Administrator for the Office of Environmental

Information to

• develop, document, and enforce standards, controls, and procedures for

security intrusion and misuse detection, recording, response, follow-up,

analysis, and reporting, including clear assignment of responsibilities

for government and contractor employees to ensure appropriate

oversight of security functions;

• analyze existing and future problem reports to identify deficiencies in

system controls, incident records, and problem responses; and

• periodically report summaries of security incidents and responses to

senior EPA and application managers in order to raise awareness of

security risks, ensure that response actions and control improvements

are appropriately managed, and ensure that the related risks are

considered in security planning.
B-285625

Page 21 GAO/AIMD-00-215 EPA Information Security

Security Program Planning

and Management

We recommend that the Administrator direct EPA’s Principal Deputy

Assistant Administrator for the Office of Environmental Information, the

assistant administrators for other EPA offices, and the regional

administrators to work together to

• identify and rank their information assets and computer-supported

operations according to their sensitivity and criticality to EPA’s mission;

• determine what level of protection is appropriate to adequately reduce

the information security risks associated with these operations and

assets;

• select procedures and controls that provide this protection;

• identify and prioritize improvement actions needed; and

• implement a program of routine and periodic testing and evaluation of

the procedures and controls adopted, with emphasis on those

procedures and controls affecting the most sensitive and critical

information assets.

We also recommend that the Administrator direct EPA’s Principal Deputy

Assistant Administrator for the Office of Environmental Information to

• proactively assist EPA offices in understanding and implementing EPA’s

agencywide information security policy;

• assist EPA program and regional offices in understanding the

information security risks associated with their operations, including

those risks stemming from their reliance on general support systems,

such as the agencywide network maintained by EPA’s National

Computer Center;

• assist offices in developing and implementing plans for testing key

information security controls associated with systems under their

control;

• develop and implement plans for testing key information security

controls associated with general support systems and other systems

under their control;

• monitor progress in implementing actions needed to address identified

information security weaknesses;

• periodically report to the Administrator and the heads of EPA program

and support offices on the effectiveness of EPA’s information security

program; and

• adjust and supplement EPA’s written information security policies and

related guidance to include information that

• clarifies which elements of policies and related guidance are

mandatory and which are optional,
B-285625

Page 22 GAO/AIMD-00-215 EPA Information Security

• defines information security roles and responsibilities, and

• defines procedures and provides tools for agencywide selfassessments.

Agency Comments and

Our Evaluation

In written comments on a draft of this report, EPA’s Principal Deputy

Assistant Administrator for the Office of Environmental Information

concurred with our recommendations and described EPA’s corrective

actions. According to the comments, EPA has taken steps to strengthen

access controls, enhance its intrusion detection capabilities, and improve

its information security management structure. Further, EPA’s plans

include

• establishing a program for testing and evaluating the controls and

procedures adopted,

• improving the risk assessment process, and

• better supporting program managers in carrying out their information

security related responsibilities.

We cannot yet draw conclusions on the effectiveness of EPA’s actions

because many have not yet been fully implemented and others have not

been independently tested. However, the corrective actions described

represent a comprehensive approach to improving EPA’s agencywide

information security program and, if implemented effectively, should

significantly strengthen EPA’s security posture. To be effective on an

ongoing basis, it is important that EPA’s efforts be institutionalized as part

of a continual cycle of risk management activity. In this regard, the periodic

tests and evaluations that EPA plans to implement should provide EPA

management with important information on the success of its actions and

provide a basis for fine-tuning the agency’s security program in the future.

As agreed with your office, unless you publicly announce the contents of

this report earlier, we plan no further distribution until 30 days from the

date of this letter. At that time, we will send copies to Senator Max Baucus,

Senator Christopher S. Bond, Senator Robert C. Byrd, Senator Pete V.

Domenici, Senator Richard J. Durbin, Senator Frank Lautenberg, Senator

Joseph Lieberman, Senator Barbara A. Mikulski, Senator Bob Smith,

Senator Ted Stevens, Senator Fred Thompson, and Senator George V.

Voinovich, and to Representative Dan Burton, Representative John D.

Dingell, Representative Stephen Horn, Representative John R. Kasich,

Representative Alan B. Mollohan, Representative David R. Obey,
B-285625

Page 23 GAO/AIMD-00-215 EPA Information Security

Representative John Spratt, Representative Jim Turner, Representative

James T. Walsh, Representative Henry A. Waxman, and Representative C.W.

Bill Young in their capacities as Chairmen or Ranking Minority Members of

Senate and House Committees and Subcommittees. We are also sending

copies to the Honorable Carol M. Browner, Administrator, Environmental

Protection Agency; the Honorable Nikki L. Tinsley, Inspector General,

Environmental Protection Agency; the Honorable Jacob J. Lew, Director,

Office of Management and Budget; and other agency officials. Copies will

be made available to others upon request.

If you have questions regarding this report, please contact me at (202) 512-

6240 or by e-mail at mcclured.aimd@gao.gov.

Sincerely yours,

David L. McClure

Associate Director

Defense and Governmentwide

Information Systems
Page 24 GAO/AIMD-00-215 EPA Information Security

Appendix I

Objectives, Scope, and Methodology ApApenednxidexiIs

Our objectives were to (1) test the effectiveness of key computer-based

controls over access to and use of EPA’s systems, (2) determine the extent

and impact of reported computer security incidents involving EPA’s

systems and related EPA responses, and (3) evaluate EPA’s agencywide

computer security program planning and management. To accomplish

these objectives, we applied appropriate sections of our Federal

Information System Controls Audit Manual (GAO/AIMD-12.19.6), which

describes our methodology for reviewing information system controls that

affect the integrity, confidentiality, and availability of computerized data

associated with federal agency operations.

To test the effectiveness of key controls over EPA computer systems, we

examined the configuration and control implementation for each of the

computer operating systems and for the agencywide computer network

that support most of EPA’s mission-related and financial operations. In

addition, we attempted to penetrate EPA’s systems through the Internet

from a remote location, and we attempted to exploit identified control

weaknesses to verify the vulnerability they presented. We also met with

officials at EPA’s National Computer Center to discuss their practices in

managing the security of EPA’s systems, possible reasons for vulnerabilities

identified, and plans for future improvement.

To determine the extent and impact of security incidents involving EPA

systems, we reviewed reports of computer security incidents from 1992

through 1999 identified by EPA’s IG and analyzed listings of security

problem reports for 1998 and 1999 provided by EPA’s National Computer

Center. Based on this analysis, we identified and characterized notable

individual incidents, patterns and trends for recent incidents, and

ambiguities and omissions in reported incident data and incident

management actions. To evaluate EPA’s practices for responding to

incidents, we (1) reviewed EPA’s policy and procedures on incident

management, (2) examined security problem reports to determine whether

they accurately reflected the testing activities we performed, and

(3) discussed incident management practices with EPA’s National

Computer Center, OEI, and IG officials.

To evaluate EPA’s agencywide information security program planning and

management, we reviewed pertinent agencywide policies, guidance, and

security plans and held discussions with officials responsible for

developing and implementing these policies and plans throughout EPA.

This included
Appendix I

Objectives, Scope, and Methodology

Page 25 GAO/AIMD-00-215 EPA Information Security

• analyzing agencywide policies to determine (1) their compliance with

OMB and NIST guidance and (2) whether they incorporated the

management best practices identified in our executive guide

Information Security Management: Learning From Leading

Organizations (GAO/AIMD-98-68, May 1998);

• meeting with officials in EPA’s OEI, which is responsible for managing

EPA’s information security program, to determine what actions it has

taken to ensure effective security program implementation;

• discussing security plan development and implementation with officials

in EPA’s Office of the Chief Financial Officer and five of the agency’s

program area offices: the Office of Air and Radiation; the Office of

Prevention, Pesticides and Toxic Substances; the Office of Research and

Development; the Office of Solid Waste and Emergency Response; and

the Office of Water; and

• reviewing 54 finalized system security plans from four program offices,

OEI, and the Office of the Chief Financial Officer to determine if they

conformed with EPA’s agencywide policies and complied with OMB and

NIST guidance.

We performed our audit work at EPA headquarters and at EPA’s National

Computer Center from September 1999 through February 2000 in

accordance with generally accepted government auditing standards. EPA’s

Principal Deputy Assistant Administrator for OEI provided comments on a

draft of this report. These comments are discussed in the “Agency

Comments and Our Evaluation” section of this report and are reprinted in

appendix II.
Page 26 GAO/AIMD-00-215 EPA Information Security

Appendix II

Comments From the Environmental

Protection Agency ApendxiI
Appendix II

Comments From the Environmental

Protection Agency

Page 27 GAO/AIMD-00-215 EPA Information Security
Appendix II

Comments From the Environmental

Protection Agency

Page 28 GAO/AIMD-00-215 EPA Information Security
Appendix II

Comments From the Environmental

Protection Agency

Page 29 GAO/AIMD-00-215 EPA Information Security
Appendix II

Comments From the Environmental

Protection Agency

Page 30 GAO/AIMD-00-215 EPA Information Security
Appendix II

Comments From the Environmental

Protection Agency

Page 31 GAO/AIMD-00-215 EPA Information Security
Appendix II

Comments From the Environmental

Protection Agency

Page 32 GAO/AIMD-00-215 EPA Information Security
Appendix II

Comments From the Environmental

Protection Agency

Page 33 GAO/AIMD-00-215 EPA Information Security
Appendix II

Comments From the Environmental

Protection Agency

Page 34 GAO/AIMD-00-215 EPA Information Security
Appendix II

Comments From the Environmental

Protection Agency

Page 35 GAO/AIMD-00-215 EPA Information Security
Appendix II

Comments From the Environmental

Protection Agency

Page 36 GAO/AIMD-00-215 EPA Information Security
Appendix II

Comments From the Environmental

Protection Agency

Page 37 GAO/AIMD-00-215 EPA Information Security
Appendix II

Comments From the Environmental

Protection Agency

Page 38 GAO/AIMD-00-215 EPA Information Security
Page 39 GAO/AIMD-00-215 EPA Information Security

Appendix III

GAO Contacts and Staff Acknowledgments ApendxiI

GAO Contact Jean Boltz, (202) 512-6240

Acknowledgments Other major contributors to this work were Nancy DeFrancesco, Michael

Gilmore, Paula Moore, and William Wadsworth. In addition, the computer

security test team provided significant support and included Gary Austin,

Lon Chin, Debra Conner, Vernon Conyers, Edward Glagola, Harold Lewis,

and Christopher Warweg.

(511994) Letr
Ordering Information The first copy of each GAO report is free. Additional copies of

reports are $2 each. A check or money order should be made out to

the Superintendent of Documents. VISA and MasterCard credit

cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address are

discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 37050

Washington, DC 20013

Orders by visiting:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders by phone:

(202) 512-6000

fax: (202) 512-6061

TDD (202) 512-2537

Each day, GAO issues a list of newly available reports and

testimony. To receive facsimile copies of the daily list or any list

from the past 30 days, please call (202) 512-6000 using a touchtone

phone. A recorded menu will provide information on how to obtain

these lists.

Orders by Internet:

For information on how to access GAO reports on the Internet,

send an e-mail message with “info” in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web home page at:

http://www.gao.gov

To Report Fraud,

Waste, or Abuse in

Federal Programs

Contact one:

• Web site: http://www.gao.gov/fraudnet/fraudnet.htm

• e-mail: fraudnet@gao.gov

• 1-800-424-5454 (automated answering system)

United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Bulk Rate

Postage & Fees Paid

GAO

Permit No. GI00