Penetration Test Report (OPM-OIG): OPM OIG   US Office of Personnel Management

U.S. OFFICE OF PERSONNEL MANAGEMENT
OFFICE OF THE INSPECTOR GENERAL
OFFICE OF AUDITS
Final Audit Report
Federal Information Security Modernization Act Audit
FY 2015
Report Number 4A-CI-00-15-011
November 10, 2015
-- CAUTION --
This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may
contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available under the Freedom of
Information Act and made available to the public on the OIG webpage (http://www.opm.gov/our-inspector-general), caution needs to be exercised
before releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy.
EXECUTIVE SUMMARY
Federal Information Security Modernization Act Audit – FY 2015
Report No. 4A-CI-00-15-011 November 10, 2015
Why Did We Conduct the Audit? What Did We Find?
Our overall objective was to evaluate In FY 2015 OPM was the victim of a massive data breach that involved the
OPM’s security program and theft of sensitive personal information of millions of individuals. For many
years we have reported critical weaknesses in OPM’s ability to manage its
practices, as required by the Federal
information technology (IT) environment, and warned that the agency was at
Information Security Modernization
an increased risk of a data breach. In the wake of this data breach, OPM is
Act (FISMA). Specifically, we
finally focusing its efforts on improving its IT security posture.
reviewed the status of OPM’s
Unfortunately, as indicated by the variety of findings in this audit report,
information technology security OPM continues to struggle to meet many FISMA requirements.
program in accordance with the
Department of Homeland Security’s During this audit we did close a long-standing recommendation related to
OPM’s information security management structure. However, this audit also
(DHS) FISMA Inspector General
determined that there has been a regression in OPM’s management of its
reporting instructions.
system Authorization program, which we classified as a material weakness in
the FY 2014 FISMA audit report. In April 2015, the Chief Information
What Did We Audit?
Officer issued a memorandum that granted an extension of the previous
Authorizations for all systems whose Authorization had already expired, and
The Office of the Inspector General
for those scheduled to expire through September 2016. Should this
(OIG) has completed a performance
moratorium on Authorizations continue, the agency will have up to 23
audit of OPM’s general FISMA
systems that have not been subject to a thorough security controls assessment.
compliance efforts in the specific
areas defined in DHS’s guidance and We continue to believe that OPM’s management of system Authorizations
the corresponding reporting represents a material weakness in the internal control structure of the agency’s
IT security program. The moratorium on Authorizations will result in the IT
instructions. Our audit was conducted
security controls of OPM’s systems being neglected. Combined with the
from April through September 2015
inadequacy and non-compliance of OPM’s continuous monitoring program,
at OPM headquarters in Washington,
we are very concerned that the agency’s systems will not be protected against
D.C.
another attack.
Additionally, OPM’s inability to accurately inventory its systems and network
devices drastically diminishes the effectiveness of its security controls. OPM
has implemented a large number of improved security monitoring tools, but
without a complete understanding of its network, it cannot adequately monitor
its environment and therefore the usefulness of these tools is reduced.
The following page outlines the additional issues that we identified during
this FY 2015 FISMA audit.
_______________________
Michael R. Esser
Assistant Inspector General
for Audits
i
EXECUTIVE SUMMARY
Federal Information Security Modernization Act Audit – FY 2015
Summary of FY 2015 FISMA Results
 The significant deficiency related to information security governance has been dropped due to
the reorganization of the Office of the Chief Information Officer (OCIO).
 OPM’s system development life cycle policy is not enforced for all system development
projects.
 OPM does not maintain a comprehensive inventory of servers, databases, and network
devices.
 Up to 23 major OPM information systems are operating without a valid Authorization. This
represents a material weakness in the internal control structure of OPM’s IT security program.
 OPM does not have a mature continuous monitoring program. Also, security controls for all
OPM systems are not adequately tested in accordance with OPM policy.
 The OCIO has implemented an agency-wide information system configuration management
policy; however, configuration baselines have not been created for all operating platforms.
Also, all operating platforms are not routinely scanned for compliance with configuration
baselines.
 We are unable to independently attest that OPM has a mature vulnerability scanning program.
 Multi-factor authentication is not required to access OPM systems in accordance with OMB
memorandum M-11-11.
 OPM has established an Enterprise Network Security Operations Center that is responsible for
incident detection and response.
 OPM has not fully established a Risk Executive Function.
 Many individuals with significant information security responsibility have not taken
specialized security training in accordance with OPM policy.
 Program offices are not adequately incorporating known weaknesses into Plans of Action and
Milestones (POA&M) and the majority of systems contain POA&Ms that are over 120 days
overdue.
 OPM has not configured its virtual private network servers to automatically terminate remote
sessions in accordance with agency policy.
 Not all OPM systems have reviewed their contingency plans or conducted contingency plan
tests in FY 2015.
 Several information security agreements between OPM and contractor-operated information
systems have expired.
ii
ABBREVIATIONS
Authorization Security Assessment and Authorization
CDM Continuous Diagnostic and Mitigation
CISO Chief Information Security Officer
DHS Department of Homeland Security
DSO Designated Security Officer
ENSOC Enterprise Network Security Operations Center
FIPS Federal Information Processing Standards
FISMA Federal Information Security Modernization Act
FY Fiscal year
IOC Internal Oversight and Compliance
ISA Interconnection Security Agreements
ISCM Information Systems Continuous Monitoring
ISSO Information System Security Officer
IT Information Technology
LAN Local area network
MOU/A Memorandum of Understanding/Agreement
NIST National Institute for Standards and Technology
OCIO Office of the Chief Information Officer
OIG Office of the Inspector General
OMB Office of Management and Budget
OPM Office of Personnel Management
POA&M Plan of Action and Milestones
SDLC System Development Life Cycle
SIEM Security information and event management
SP Special Publication
US-CERT United States Computer Emergency Readiness Team
VPN Virtual private network
iii
IV. MAJOR CTOANBTLER IOBFU CTOONRTSE TNOT ST HIS REPORT
Page
EXECUTIVE SUMMARY ......................................................................................... i
ABBREVIATIONS .................................................................................................... iii
I. BACKGROUND ..........................................................................................................1
II. OBJECTIVES, SCOPE, AND METHODOLOGY ..................................................2
III. AUDIT FINDINGS AND RECOMMENDATIONS.................................................5
A. Information Security Governance ...........................................................................6
B. Security Assessment and Authorization ..