Penetration Test Report (NASA Office of Inspector General): IG 19 022

N A S A
Office of Inspector General
National Aeronautics and Space Administration Office of Audits
C
YBERSECURITY
M
ANAGEMENT AND
O J
VERSIGHT AT THE ET
P L
ROPULSION ABORATORY
June 18, 2019
Report No. IG-19-022
Office of Inspector General
To report, fraud, waste, abuse, or mismanagement, contact the NASA OIG Hotline at[PII_REDACTED] or[PII_REDACTED] (TDD) or
visit https://oig.nasa.gov/hotline.html. You can also write to NASA Inspector General, P.O. Box 23089, L’Enfant Plaza Station,
Washington, D.C. 20026. The identity of each writer and caller can be kept confidential, upon request, to the extent permitted
by law.
To suggest ideas or request future audits, contact the Assistant Inspector General for Audits at https://oig.nasa.gov/aboutAll.html.
R B
ESULTS IN RIEF
Cybersecurity Management and Oversight at the Jet
Propulsion Laboratory
NASA Office of Inspector General
Office of Audits June 18, 2019 IG-19-022 (A-18-012-00)
WHY WE PERFORMED THIS AUDIT
N ASA’s Jet Propulsion Laboratory (JPL) is a federally funded research and development center in Pasadena, California.
Since 1959, the California Institute of Technology (Caltech) has been under contract with NASA to manage JPL, most
prominently its research and development activities, but also its network security controls. Under the contract, NASA
retains responsibility for ensuring Agency data and systems at JPL are secure from hackers or other forms of
unauthorized access.
JPL’s information technology (IT) systems maintain a wide public internet presence while supporting missions and
networks that control spacecraft, collect and process scientific data, and perform critical operations. Over the past
10 years, JPL has experienced several notable cybersecurity incidents that have compromised major segments of its
IT network. For example, in 2011 cyber intruders gained full access to 18 servers supporting key JPL missions and stole
87 gigabytes of data. More recently, in April 2018 JPL discovered an account belonging to an external user had been
compromised and used to steal approximately 500 megabytes of data from one of its major mission systems.
In this audit, we assessed the effectiveness of JPL’s network security controls for externally facing applications and
systems. We also examined elements of JPL’s Cybersecurity Program and NASA’s interaction with and oversight of
the IT security control responsibilities assigned to Caltech under its contract to manage JPL. To complete this work,
we interviewed NASA and JPL IT officials and reviewed JPL’s IT network mapping, system inventory, and security
management tools. We also reviewed federal, NASA, JPL, and Caltech criteria, policies, procedures, supporting
documentation, agreements, prior audit reports, external reviews, and other documents related to cybersecurity.
WHAT WE FOUND
Multiple IT security control weaknesses reduce JPL’s ability to prevent, detect, and mitigate attacks targeting its systems
and networks, thereby exposing NASA systems and data to exploitation by cyber criminals. JPL uses its Information
Technology Security Database (ITSDB) to track and manage physical assets and applications on its network; however,
we found the database inventory incomplete and inaccurate, placing at risk JPL’s ability to effectively monitor, report,
and respond to security incidents. Moreover, reduced visibility into devices connected to its networks hinders JPL’s
ability to properly secure those networks. Further, we found that JPL’s network gateway that controls partner access to
a shared IT environment for specific missions and data had not been properly segmented to limit users only to those
systems and applications for which they had approved access. This shortcoming enabled an attacker to gain unauthorized
access to JPL’s mission network through a compromised external user system. Additionally, NASA failed to establish
Interconnection Security Agreements (ISA) to document the requirements partners must meet to connect to NASA’s
IT systems and describe the security controls that will be used to protect the systems and data.
We also found that security problem log tickets, created in the ITSDB when a potential or actual IT system security
vulnerability is identified, were not resolved for extended periods of time—sometimes longer than 180 days. While
system administrators may request a waiver when they cannot resolve such tickets within 6 months, we found waivers
were not reviewed annually as required, resulting in unnecessary waivers and potentially outdated compensating
security controls that expose the JPL network to exploitation by cyberattacks. Further, JPL system administrators
misunderstood their responsibilities regarding management and review of logs for identifying malicious activity
occurring on a particular system or network. We also found that while cybersecurity monitoring tools employed by JPL
defend against routine intrusions and misuse of computer assets, JPL had not implemented a threat hunting program
recommended by IT security experts to aggressively pursue abnormal activity on its systems for signs of compromise,
and instead rely on an ad hoc process to search for intruders. In addition, JPL had not provided role-based security
training or funded IT security certifications for its system administrators.
Further, we found that multiple JPL incident management and response practices deviate from NASA and recommended
industry practices. For example, unlike NASA’s Security Operations Center (SOC), JPL’s SOC does not maintain
round-the-clock availability of IT security incident responders and JPL’s incident response plan does not include all
federally-recommended elements. In addition, team coordination issues delayed completion of incident containment
and eradication steps for the April 2018 incident. Moreover, while documenting and sharing cyber threat information
across JPL to help prevent future incidents is a critical component of an effective incident response program, we found
JPL’s current initiatives fall short.
Finally, while the contract between NASA and Caltech requires JPL to report certain types of IT security incidents to the
Agency through the NASA SOC incident management system, no controls were in place to ensure JPL compliance with
this requirement nor did NASA officials have access to JPL’s incident management system. Collectively, these
weaknesses leave NASA data and systems at risk.
Despite these significant concerns, the contract NASA signed with Caltech in October 2018 to manage JPL for at least the
next 5 years left important IT security requirements unresolved and instead both sides agreed to continue negotiating
these issues. As of March 2019, the Agency had not approved JPL’s plans to implement new IT security policies and
requirements NASA included in its October 2018 contract.
WHAT WE RECOMMENDED
To improve JPL network security controls, we recommended the Director of the NASA Management Office instruct the
JPL Chief Information Officer (CIO) to: (1) require system administrators to review and update the ITSDB and ensure
system components are properly registered and the JPL Cybersecurity/Identity Technologies and Operations Group
(CITO) periodically review compliance with this requirement; (2) segregate shared environments connected to the
network gateway and monitor partners accessing the JPL network; (3) review and update ISAs for all partners connected
to the gateway; (4) require the JPL CITO to identify and remediate weaknesses in the security problem log ticket process
and provide periodic aging reports to the JPL CIO; (5) require the JPL CITO to validate, update, and perform annual
reviews of all open waivers; (6) clarify the division of responsibility between the JPL Office of the Chief Information
Officer and system administrators for conducting routine log reviews and monitor compliance on a more frequent basis;
(7) implement the planned role-based training program by July 2019; (8) establish a formal