Information Security: Department of Homeland Security Faces Challenges in Fulfilling Statutory Requirements
Published: 2005-04-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: For many years, GAO has reported that poor information security is a widespread problem that has potentially devastating consequences. Accordingly, since 1997, GAO has identified information security as a governmentwide high-risk issue in reports to Congress--most recently in January 2005. Concerned with accounts of attacks on commercial systems via the Internet and reports of significant weaknesses in federal computer systems that made them vulnerable to attack, Congress passed the Federal Information Security Management Act of 2002 (FISMA), which permanently authorized and strengthened the federal information security program, evaluation, and reporting requirements established for federal agencies. FISMA requires that agencies report annually to OMB who issues guidance for that reporting process. The Department of Homeland Security (DHS), the third largest agency in the federal government, uses a variety of major applications and general systems in support of operational and administrative requirements. This testimony discusses DHS's progress and challenges in implementing FISMA as reported by the agency and its Inspector General (IG).
section_title: What GAO Found
paragraphs: DHS has made progress in implementing key federal information security requirements, yet it continues to face challenges in fulfilling the requirements mandated by FISMA. In its fiscal year 2004 report on FISMA implementation, DHS highlights increases in the majority of the key performance measures (developed by the Office of Management and Budget (OMB) to track agency performance in implementing information security requirements), such as the percentage of agency systems reviewed and percentage of employee and contractor personnel who received security awareness training. For example, DHS reported a substantial increase in the percentage of personnel that received security awareness training, rising from 14 percent in fiscal year 2003 to 85 percent in fiscal year 2004. However, DHS continues to face significant challenges in meeting most statutory information security requirements. For example, DHS has yet to develop a complete and accurate inventory or an effective remediation process.

section_title: Letter
paragraphs: This  is  a  work  of  the  U.S.  government  and  is  not  subject  to  copyright  protection  in  the  United  States.  It  may  be  reproduced  and  distributed  in  its  entirety  without  further  permission  from  GAO.  However,  because  this  work  may  contain  copyrighted  images  or  other  material,  permission  from  the  copyright  holder  may  be  necessary  if  you  wish  to  reproduce this material separately.
Mr. Chairman and Members of the Subcommittee:  I am pleased to be here today to discuss efforts by the Department  of Homeland Security (DHS) to implement requirements of the  Federal Information Security Management Act of 2002 (FISMA). For  many years, we have reported that poor information security is a  widespread problem that has potentially devastating consequences.  Accordingly, since 1997, we have identified information security as a  governmentwide high-risk issue in reports to Congress—most  recently in January 2005. Concerned with accounts of attacks on  commercial systems via the Internet and reports of significant  weaknesses in federal computer systems that made them vulnerable  to attack, Congress passed FISMA, which permanently authorized  and strengthened the federal information security program,  evaluation, and reporting requirements established for federal  agencies. Under FISMA, agencies are to report annually to the Office  of Management and Budget (OMB) who issues guidance for that  reporting.
In my testimony today, I will summarize the reported status of  DHS’s implementation of FISMA, including areas of progress and  continuing challenges.
In conducting this review, we analyzed and summarized DHS’s fiscal  year 2003 and 2004 reports to Congress on FISMA implementation.  We also reviewed and summarized the fiscal year 2004 FISMA  reports for 24 of the largest federal agencies and their Inspectors  General (IGs). In addition, we reviewed standards and guidance  issued by Office of Management and Budget (OMB) and the National  Institute of Standards and Technology (NIST) pursuant to their  FISMA responsibilities. Finally, we reviewed OMB’s 2004 report to  Congress on the implementation of FISMA governmentwide. We did  not validate the accuracy of the data reported by DHS, the other 23  CFO agencies, or OMB, but did analyze the IGs’ fiscal year 2004  FISMA reports to identify any issues related to the accuracy of  agency-reported information. We performed our work from October  2004 to March 2005 in accordance with generally accepted  government auditing standards. In addition, we continue to perform  on-going work on DHS’s management of information security.
subsections: section_title: Background
paragraphs: Since the early 1990s, increasing computer interconnectivity—most  notably growth in the use of the Internet—has revolutionized the  way that our government, our nation, and much of the world  communicate and conduct business. While the benefits have been  enormous, without proper safeguards, this widespread  interconnectivity also poses significant risks to the government’s  computer systems and, more importantly, to the critical operations  and infrastructures they support.
We recently reported that, while federal agencies showed  improvement in addressing information security, they also  continued to have significant control weaknesses in federal  computer systems that put federal operations and assets at risk of  inadvertent or deliberate misuse, financial information at risk of  unauthorized modification or destruction, sensitive information at  risk of inappropriate disclosure, and critical operations at the risk of  disruption. The significance of these weaknesses led us to conclude  in the audit of the federal government’s fiscal year 2004 financial  statements that information security was a material weakness. Our  audits also identified instances of similar types of weaknesses in  non-financial systems. Weaknesses continued to be reported in each  of the six major areas of general controls—the policies, procedures,  and technical controls that apply to all or a large segment of an  entity’s information systems and help ensure their proper operation.
To fully understand the significance of the weaknesses we  identified, it is necessary to link them to the risks they present to  federal operations and assets. Virtually all federal operations are  supported by automated systems and electronic data, and agencies  would find it difficult, if not impossible, to carry out their missions  and account for their resources without these information assets.  Hence, the degree of risk caused by security weaknesses is high.  The weaknesses identified place a broad array of federal operations  and assets at risk. For example:  ●  resources, such as federal payments and collections, could be lost  ●  computer resources could be used for unauthorized purposes or to  launch attacks on others;  ●  sensitive information, such as taxpayer data, social security records,  medical records, and proprietary business information could be  inappropriately disclosed, browsed, or copied for purposes of  industrial espionage or other types of crime;  ●  critical operations, such as those supporting national defense and  emergency services, could be disrupted;  ●  data could be modified or destroyed for purposes of fraud, identity  theft, or disruption; and  ●  agency missions could be undermined by embarrassing incidents  that result in diminished confidence in their ability to conduct  operations and fulfill their fiduciary responsibilities.
Congress and the administration have established specific  information security requirements in both law and policy to help  protect the information and information systems that support these  critical operations and assets.
subsections: section_title: FISMA Authorized and Strengthened Information Security Requirements
paragraphs: Enacted into law on December 17, 2002, as Title III of the E- Government Act of 2002, FISMA authorized and strengthened  information security program, evaluation, and reporting  requirements. FISMA assigns specific responsibilities to agency  heads, chief information officers, and IGs. It also assigns  responsibilities to OMB, which include developing and overseeing  the implementation of policies, principles, standards, and guidelines  on information security and reviewing at least annually, and  approving or disapproving, agency information security programs.
Overall, FISMA requires each agency to develop, document, and  implement an agencywide information security program. This  program should provide information security for the information  and information systems that support the operations and assets of  the agency, including those provided or managed by another agency,  contractor, or other source. Specifically, this program is to include:  ●  periodic assessments of the risk and magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems;  ●  risk-based policies and procedures that cost-effectively reduce  information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of each  information system;  ●  subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems;  ●  security awareness training for agency personnel, including  contractors and other users of information systems that support the  operations and assets of the agency;  ●  periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of  major information systems;  ●  a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information  security policies, procedures, and practices of the agency;  ●  procedures for detecting, reporting, and responding to security  ●  plans and procedures to ensure continuity of operations for  information systems that support the operations and assets of the  agency.
FISMA also established a requirement that each agency develop,  maintain, and annually update an inventory of major information  systems operated by the agency or that are under its control. This  inventory is to include an identification of the interfaces between  each system and all other systems or networks, including those not  operated by or under the control of the agency.
Each agency is also required to have an annual independent  evaluation of its information security program and practices,  including control testing and compliance assessment. Evaluations of  non-national security systems are to be performed by the agency IG  or by an independent external auditor, while evaluations related to  national security systems are to be performed only by an entity  designated by the agency head.
The agencies are to report annually to OMB, selected congressional  committees, and the Comptroller General on the adequacy of  information security policies, procedures, practices, and compliance  with FISMA requirements. In addition, agency heads are required to  make annual reports of the results of their independent evaluations  to OMB. OMB is also required to submit a report to Congress no  later than March 1 of each year on agency compliance, including a  summary of the findings of agencies’ independent evaluations.
Other major provisions require NIST to develop, for systems other  than national security systems: (1) standards to be used by all  agencies to categorize all their information and information systems  based on the objectives of providing appropriate levels of  information security according to a range of risk levels; (2)  guidelines recommending the types of information and information  systems to be included in each category; and (3) minimum  information security requirements for information and information  systems in each category. NIST must also develop a definition and  guidelines concerning detection and handling of information  security incidents and guidelines, developed in conjunction with the  Department of Defense (DOD) and the National Security Agency, for  identifying an information system as a national security system.
section_title: OMB Reporting Instructions and Guidance Emphasize Performance Measures
paragraphs: Consistent with FISMA requirements, OMB issues guidance to the  agencies on their annual reporting requirements. On August 23,  2004, OMB issued its fiscal year 2004 reporting instructions. The  reporting instructions, similar to the 2003 instructions, emphasized a  strong focus on performance measures and formatted these  instructions to emphasize a quantitative response. OMB has  developed performance measures in the following areas, including:  ●  certification and accreditation,  ●  annual review of agency systems,  ●  annual review of contractor operations or facilities,   ●  annual security awareness training for employees and contractors,   ●  annual specialized training for employees with significant security  ●  testing of contingency plans.
Further, OMB provided instructions for continued agency reporting  on the status of remediation efforts through plans of action and  milestones. Required for all programs and systems where an IT  security weakness has been found, these plans list the weaknesses  and show estimated resource needs or other challenges to resolving  them, key milestones and completion dates, and the status of  corrective actions. The plans are to be submitted twice a year. In  addition, agencies are to submit quarterly updates that indicate the  number of weaknesses for which corrective action was completed  on time (including testing), is ongoing and on track to be completed  as originally scheduled, or has been delayed, as well as the number  of new weaknesses discovered since the last update.
The IGs’ reports were to be based on the results of their  independent evaluations, including work performed throughout the  reporting period (such as financial statements or other audits).  While OMB asked the IGs to respond to the same questions as the  agencies, it also asked them to assess whether their agency had  developed, implemented, and was managing an agencywide plan of  actions and milestones. Further, OMB asked the IGs to assess the  certification and accreditation process at their agencies. OMB did  not request that the IGs validate agency responses to the  performance measures. Instead, as part of their independent  evaluations of a subset of agency systems, IGs were asked to assess  the reliability of the data for those systems that they evaluated.
section_title: Recently-created Department of Homeland Security is Large and Complex
paragraphs: In the aftermath of September 11, invigorating the nation’s  homeland security missions became one of the federal government’s  most significant challenges. The Homeland Security Act of 2002  created DHS, combining 22 agencies into one department. DHS,  with an estimated 170,000 employees, is the third largest  government agency. Not since the creation of DOD more than 50  years ago had the government sought an integration and  transformation of this magnitude.
GAO designated implementing and transforming DHS as high risk in  2003 because DHS had to transform 22 agencies—several with  major management challenges—into one department, and failure to  effectively address its management challenges and program risks  could have serious consequences for our national security. DHS  combined 22 agencies specializing in various disciplines: law  enforcement, border security, biological research, disaster  mitigation, and computer security, for instance. Further, DHS  oversees a number of non-homeland-security activities, such as the  Coast Guard’s marine safety responsibilities and the Federal  Emergency Management Agency’s natural disaster response  functions.
DHS has lead responsibility for preventing terrorist attacks in the  United States, reducing the vulnerability of the United States to  terrorist attacks, and minimizing the damage and assisting in the  recovery from attacks that do occur. DHS has five under secretaries  with responsibility over directorates for management, science and  technology, information analysis and infrastructure protection,  border and transportation security, and emergency preparedness  and response. In addition, the department has four other  organizations that report directly to the Secretary.
DHS uses a variety of major applications and general support  systems in support of operational and administrative requirements.  In its 2004 FISMA report, DHS stated that it had 395 systems and 61  contractor operations. These systems often served specific  organizations that are now merged with others, resulting in  interoperability issues, data management concerns, and  incompatible environments or duplicative processes.
section_title: Department of Homeland Security’s FISMA Reports Highlight Increases in Performance Measures, but Challenges Remain
paragraphs: In its FISMA-mandated report for fiscal year 2004, DHS generally  reported increases in compliance with information security  requirements as compared with 2003. However, DHS continues to  face significant challenges. The following key performance  measures showed increased performance and/or continuing  challenges:  ●  percentage of systems certified and accredited;  ●  percentage of agency systems reviewed annually;  ●  percentage of contractor operations reviewed annually;  ●  percentage of employees and contractors receiving annual security  ●  percentage of employees with significant security responsibilities  receiving specialized security training annually; and  ●  percentage of systems with contingency plans tested.
Figure 1 illustrates the reported overall status of DHS in meeting  these performance measures and the changes between fiscal years  2003 and 2004.
DHS has yet to develop a complete and accurate inventory, or an  effective plan of action and milestones. Finally, figure 2 illustrates  how DHS compares to the governmentwide results for the  performance measures when compared to the aggregated data of all  24 CFO agencies.
Included in OMB’s policy for federal information security is a  requirement that agency management officials formally authorize  their information systems to process information and, thereby,  accept the risk associated with their operation. This management  authorization (accreditation) is to be supported by a formal  technical evaluation (certification) of the management, operational,  and technical controls established in an information system’s  security plan. In 2003, agencies were required to report separately  on risk assessments and security plans. In 2004, OMB eliminated  this separate reporting in its guidance and directed agencies to  complete risk assessments and security plans for the certification  and accreditation process to be accomplished. As a result, the  performance measure for certification and accreditation now also  reflects the level of agency compliance for risk assessments and  security plans. For FISMA reporting, OMB requires agencies to  report the number of systems authorized for processing after  completing certification and accreditation.
DHS reported a significant increase for this performance measure in  its fiscal year 2004 report. The Department reported that  approximately 68 percent of its systems had been certified and  accredited, an increase of 26 percent over fiscal year 2003.  Governmentwide, 77 percent of all systems were certified and  accredited compared to the 68 percent at DHS. If agencies do not  certify and accredit their systems, they cannot be assured that risks  have been identified and mitigated to an acceptable level.
Moreover, the DHS IG reported in its 2004 FISMA report that the  certification and accreditation process at the Department was poor.  The report noted that the certification and accreditation process  was not performed consistently across the Department. In addition,  there were instances where certified and accredited systems lacked  key security documentation such as up-to-date and approved  security plans, a current risk assessment, and contingency plans. As  a result, the agency reported performance data may not accurately  reflect the status of DHS’s efforts to implement this requirement.
Annual Review of Agency Systems   FISMA requires that agency information security programs include  periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices to be performed with a  frequency that depends on risk, but no less than annually. This is to  include testing of management, operational, and technical controls  for every information system identified in the FISMA-required  inventory of major systems. Periodically evaluating the effectiveness  of security policies and controls and acting to address any identified  weaknesses are fundamental activities that allow an organization to  manage its information security risks cost effectively, rather than  reacting to individual problems ad hoc only after a violation has  been detected or an audit finding has been reported. Further,  management control testing and evaluation as part of program  reviews is an additional source of information that can be  considered along with control testing and evaluation in IG and GAO  audits to help provide a more complete picture of the agencies’  security postures. As a performance measure for this requirement,  OMB requires that agencies report the number of systems that they  have reviewed during the year.
DHS reported performing an annual review on an increased  percentage of its systems. It reported in 2004 that it had reviewed 54  percent of its systems, as compared to 44 percent in 2003. In 2004,  23 of the 24 CFO agencies reported that they had reviewed 90  percent or more of their systems. Annual security testing helps to  provide assurance to the agencies that security controls are in place  and functioning correctly. Without such testing, agencies cannot be  assured that their information and systems are protected.
Annual Review of Contractor Operations   Under FISMA, agency heads are responsible for providing  information security protections for information collected or  maintained by or on behalf of the agency and information systems  used or operated by an agency or by a contractor. Thus, agency  information security programs apply to all organizations that  possess or use federal information or that operate, use, or have  access to federal information systems on behalf of a federal agency.  Other such organizations may include contractors, grantees, state  and local governments, and industry partners. This underscores  longstanding OMB policy concerning sharing government  information and interconnecting systems: federal security  requirements continue to apply and the agency is responsible for  ensuring appropriate security controls.
At DHS, the key performance measure of annually reviewing  contractor operations showed a minor decrease from 73 percent in  2003 to 67 percent in 2004. Twenty of the Department’s contractor  operations were not reviewed. The governmentwide performance  measure was reported as 83 percent of all contractor operations  reviewed. If agencies do not review contractor operations, they  cannot be assured that federal data is being handled in accordance  with agency requirements.
FISMA requires agencies to provide security awareness training to  inform personnel, including contractors and other users of  information systems that support the operations and assets of the  agency, of information security risks associated with their activities,  and the agency’s responsibilities in complying with policies and  procedures designed to reduce these risks. Our studies of best  practices at leading organizations have shown that such  organizations took steps to ensure that personnel involved in  various aspects of their information security programs had the skills  and knowledge they needed. Agencies reported that they provided  security awareness training to the majority of their employees and  contractors. As performance measures for FISMA training  requirements, OMB has the agencies report the number of  employees and contractors who received IT security training during  fiscal year 2004.
DHS reported a substantial increase in the percentage of employees  and contractors who received security awareness training in fiscal  year 2004. The Department reported that it had trained 85 percent of  its staff compared to 14 percent in 2003. As a result, reported  performance is comparable to the majority of agencies in this  performance measure, as seventeen agencies reported that they had  trained more than 90 percent of their employees and contractors in  basic security awareness.
Under FISMA, agencies are required to provide training in  information security to personnel with significant security  responsibilities. As previously noted, our study of best practices at  leading organizations has shown that such organizations recognized  that staff expertise needed to be updated frequently to keep security  employees updated on changes in threats, vulnerabilities, software,  security techniques, and security monitoring tools. OMB directs  agencies to report on the percentage of their employees with  significant security responsibilities who received specialized  training.
DHS presented substantial improvement in this performance  measure, reporting that it had provided specialized training to more  than 90 percent of its employees who have significant security  responsibilities. Not only was this a significant improvement over  the 66 percent reported in 2003, it also places DHS among the top  ten agencies governmentwide for this performance measure. Given  the rapidly changing threats in information security, agencies need  to keep their IT security employees up-to-date on changes in  technology. Otherwise, agencies may face increased risk of security  breaches.
Contingency plans provide specific instructions for restoring critical  systems, including such elements as arrangements for alternative  processing facilities in case the usual facilities are significantly  damaged or cannot be accessed due to unexpected events such as  temporary power failure, accidental loss of files, or a major disaster.  It is important that these plans be clearly documented,  communicated to potentially affected staff, and updated to reflect  current operations.
The testing of contingency plans is essential to determining whether  plans will function as intended in an emergency situation. The  frequency of plan testing will vary depending on the criticality of the  entity’s operations. The most useful tests involve simulating a  disaster situation to test overall service continuity. Such a test  would include testing whether the alternative data processing site  will function as intended and whether critical computer data and  programs recovered from off-site storage are accessible and current.  In executing the plan, managers will be able to identify weaknesses  and make changes accordingly. Moreover, tests will assess how well  employees have been trained to carry out their roles and  responsibilities in a disaster situation. To show the status of  implementing this requirement, OMB requires that agencies report  the number of systems that have a contingency plan and the number  that have contingency plans that have been tested.
DHS reported a modest increase in the percentage of contingency  plans tested. The department stated that it had tested contingency  plans for 21 percent of its systems, an 8 percentage point increase  over 2003. Moreover, analysis of the numbers reveals that DHS  tested 82 plans, which was almost double what it tested in 2003.  However, the majority of its systems do not have tested contingency  plans. Overall, federal agencies reported that 57 percent of systems  had contingency plans that had been tested. Without testing,  agencies can have limited assurance that they will be able to recover  mission-critical applications, business processes, and information in  the event of an unexpected interruption.
In addition to the performance measures, there are other  requirements that agencies must meet under FISMA. Agencies are  required to have a complete and accurate inventory of their major  systems and any interdependencies. They are also required to have a  remediation process for correcting identified information security  weaknesses.
The total number of agency systems is a key element in OMB’s  performance measures, in that agency progress is indicated by the  percentage of total systems that meet specific information security  requirements. Thus, inaccurate or incomplete data on the total  number of agency systems affects the percentage of systems shown  as meeting the requirements. Further, a complete inventory of major  information systems is a key element of managing the agency’s IT  resources, including the security of those resources.
DHS reported that it did not have a complete and accurate inventory  in either 2003 or 2004. Without reliable information on DHS’s  inventories, the Department, the administration, and Congress  cannot be fully assured of DHS’s progress in implementing FISMA.
FISMA requires each agency to develop a process for planning,  implementing, evaluating, and documenting remedial actions to  address any deficiencies in the information security policies,  procedures and practices of the agency. OMB’s implementing  guidance refers to this process as a security plan of action and  milestones. The chief information officer (CIO) is to manage the  process for the agencies and program officials are required to  regularly update the CIO on their progress in implementing remedial  actions. This process allows both the CIO and the IG to monitor  agency-wide progress, identify problems, and provide accurate  reporting. In its annual reporting guidance, OMB asks the agency  IGs to report on the status of the plan of action and milestones at  their agencies. IGs were asked to evaluate the process based on the  following criteria:  ●  known IT security weaknesses from all components are  ●  program officials develop, implement and manage plans for the  systems they own and operate that have an IT security weakness;  ●  program officials report to the CIO on a regular basis (at least  quarterly) on their remediation progress;  ●  CIO develops, implements and manages plans for the systems  they own and operate that have an IT security weakness;  ●  CIO centrally tracks, maintains, and reviews all plan activities on  at least a quarterly basis;  ●  The plan is the authoritative agency tool for agency and IG  management to identify and monitor agency actions for corrected  information security weaknesses;  ●  System-level plans are tied directly to the system budget request  through the IT business case as required in OMB budget  guidance;  ●  IG has access to the plans as requested;  ●  IG findings are incorporated into the process; and  ●  the process prioritizes IT security weaknesses to help ensure that  significant weaknesses are addressed in a timely manner and  receive appropriate resources.
In its 2004 FISMA report, the DHS IG described problems with the  plan of action and milestones process at DHS. According to the IG,  seven of the nine major department components reviewed lacked a  documented and implemented plan of action and milestones.  Further, the IG stated that the CIO did not receive reports of  remediation progress and did not ensure that components updated  the status of their progress. Linkage of the plans to budget requests  was reported as minimal at the component level. Seven of the nine  components reviewed did not have a formal process to prioritize  their IT security weaknesses. Finally, the IG reported that its  findings were not incorporated into the plan of action and  milestones at DHS. Without an effective, implemented remediation  process, DHS cannot be assured that identified security weaknesses  are tracked and corrected.
In summary, DHS generally showed increases in the OMB  performance measures for FISMA implementation in fiscal year  2004. However, it still faces challenges in implementing the statutory  requirements. It faces significant challenges in both inventory  development and the implementation of its remediation process.  Accordingly, if information security is to continue to improve,  agency management must remain committed to these efforts. The  annual reports and performance measures will continue to be key  tools for holding DHS accountable and providing a barometer of the  overall status of its information security.
Mr. Chairman, this concludes my statement. I would be happy to  answer any questions from you or members of the Committee.
Should you have any questions about this testimony, please contact  me at (202) 512-3317 or Suzanne Lightman, Assistant Director, at  (202) 512-8146 or by e-mail at wilshuseng@gao.gov and  lightmans@gao.gov, respectively.
Other individuals making key contributions to this testimony  include Larry Crosland, Season Dietrich, Nancy Glover, Carol  Langelier, and Stephanie Lee.