Information Security: Progress Reported, but Weaknesses at Federal Agencies Persist
Published: 2008-03-12T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Information security is especially important for federal agencies, where the public's trust is essential and poor information security can have devastating consequences. Since 1997, GAO has identified information security as a governmentwide high-risk issue in each of our biennial reports to Congress. Concerned by reports of significant weaknesses in federal computer systems, Congress passed the Federal Information Security Management Act (FISMA) of 2002, which permanently authorized and strengthened information security program, evaluation, and annual reporting requirements for federal agencies. GAO was asked to testify on the current state of federal information security and compliance with FISMA. This testimony summarizes (1) the status of agency performance of information security control activities as reported by major agencies and their inspectors general (IG), (2) the effectiveness of information security at federal agencies, and (3) opportunities to improve federal information security. In preparing for this testimony, GAO analyzed agency, IG, Office of Management and Budget (OMB), and GAO reports on information security and reviewed OMB FISMA reporting instructions, information technology security guidance, and information on reported security incidents.
section_title: What GAO Found
paragraphs: Over the past several years, 24 major federal agencies have consistently reported progress in performing information security control activities in their annual FISMA reports. For fiscal year 2007, the federal government continued to report improved information security performance relative to key performance metrics established by OMB. For example, an increasing percentage of systems governmentwide had been tested and evaluated, had tested contingency plans, and had been certified and accredited. However, IGs at several agencies sometimes disagreed with the agency reported information and identified weaknesses in the processes used to implement these and other security program activities. Despite agency reported progress, major federal agencies continue to experience significant information security control deficiencies that limit the effectiveness of their efforts to protect the confidentiality, integrity, and availability of their information and information systems. Most agencies did not implement controls to sufficiently prevent, limit, or detect access to computer networks, systems, or information. In addition, agencies did not always effectively manage the configuration of network devices to prevent unauthorized access and ensure system integrity, patch key servers and workstations in a timely manner, assign duties to different individuals or groups so that one individual did not control all aspects of a process or transaction, and maintain complete continuity of operations plans for key information systems. An underlying cause for these weaknesses is that agencies have not fully or effectively implemented agencywide information security programs. As a result, federal systems and information are at increased risk of unauthorized access to and disclosure, modification, or destruction of sensitive information, as well as inadvertent or deliberate disruption of system operations and services. Such risks are illustrated, in part, by an increasing number of security incidents experienced by federal agencies. Nevertheless, opportunities exist to bolster federal information security. Federal agencies could implement the hundreds of recommendations made by GAO and IGs to resolve prior significant control deficiencies and information security program shortfalls. In addition, OMB and other federal agencies have initiated several governmentwide initiatives that are intended to improve security over federal systems and information. For example, OMB has established an information systems security line of business to share common processes and functions for managing information systems security and directed agencies to adopt the security configurations developed by the National Institute of Standards and Technology and Departments of Defense and Homeland Security for certain Windows operating systems. Opportunities also exist to enhance policies and practices related to security control testing and evaluation, FISMA reporting, and the independent annual evaluations of agency information security programs required by FISMA.

section_title: Letter
paragraphs: Thank you for the opportunity to participate in today’s hearing to discuss  information security over federal systems. Information security is a critical  consideration for any organization that depends on information systems  and computer networks to carry out its mission or business. It is especially  important for government agencies, where the public’s trust is essential.  The need for a vigilant approach to information security is demonstrated  by the dramatic increase in reports of security incidents, the wide  availability of hacking tools, and steady advances in the sophistication and  effectiveness of attack technology. Over the past few years, federal  agencies have reported numerous security incidents in which sensitive  information has been lost or stolen, including personally identifiable  information, which has exposed millions of Americans to a loss of privacy,  identity theft, and other financial crimes.
Concerned by reports of significant weaknesses in federal computer  systems, Congress passed the Federal Information Security Management  Act (FISMA) of 2002, which permanently authorized and strengthened  information security program, evaluation, and annual reporting  requirements for federal agencies. However, five years after FISMA was  enacted, we continue to report that poor information security is a  widespread problem with potentially devastating consequences. Since  1997, we have identified information security as a governmentwide high- risk issue in each of our biennial reports to the Congress.
In my testimony today, I will summarize (1) the status of agency  performance of information security control activities as reported by  major agencies and their inspectors general (IG), (2) the effectiveness of  information security at federal agencies, and (3) opportunities to improve  federal information security. In preparing for this testimony, we analyzed  the Office of Management and Budget’s (OMB) FISMA report for fiscal  year 2007 and the annual FISMA reports and the performance and  accountability reports for 24 major federal agencies; examined agency, IG,  and our reports on information security; and reviewed OMB FISMA  reporting instructions, information technology (IT) security guidance, and  information on reported security incidents. We conducted our work, in  support of this testimony, from February 2008 through March 2008, in the  Washington, D.C. area. The work on which this testimony is based was  performed in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Virtually all federal operations are supported by automated systems and  electronic data, and agencies would find it difficult, if not impossible, to  carry out their missions and account for their resources without these  information assets. Therefore, it is important for agencies to safeguard  their systems against risks such as loss or theft of resources (such as  federal payments and collections), modification or destruction of data, and  unauthorized uses of computer resources or to launch attacks on other  computer systems. Sensitive information, such as taxpayer data, Social  Security records, medical records, and proprietary business information  could be inappropriately disclosed, browsed, or copied for improper or  criminal purposes. Critical operations could be disrupted, such as those  supporting national defense and emergency services or agencies’ missions  could be undermined by embarrassing incidents, resulting in diminished  confidence in their ability to conduct operations and fulfill their  responsibilities.
subsections: section_title: Critical Systems Face Multiple Cyber Threats
paragraphs: Cyber threats to federal systems and critical infrastructures can be  unintentional and intentional, targeted or nontargeted, and can come from  a variety of sources. Unintentional threats can be caused by software  upgrades or maintenance procedures that inadvertently disrupt systems.  Intentional threats include both targeted and nontargeted attacks. A  targeted attack is when a group or individual specifically attacks a critical  infrastructure system. A nontargeted attack occurs when the intended  target of the attack is uncertain, such as when a virus, worm, or malware  is released on the Internet with no specific target. The Federal Bureau of  Investigation has identified multiple sources of threats to our nation’s  critical information systems, including foreign nation states engaged in  information warfare, domestic criminals, hackers, virus writers, and  disgruntled employees working within an organization. Table 1  summarizes those groups or individuals that are considered to be key  sources of cyber threats to our nation’s information systems and  infrastructures.
section_title: Increased Vulnerabilities Could Expose Federal Systems to Attack
paragraphs: As federal information systems increase their connectivity with other  networks and the Internet and as the system capabilities continue to  increase, federal systems will become increasingly more vulnerable. Data  from the National Vulnerability Database, the U.S. government repository  of standards-based vulnerability management data, showed that, as of  March 6, 2008, there were about 29,000 security vulnerabilities or software  defects that can be directly used by a hacker to gain access to a system or  network. On average, close to 18 new vulnerabilities are added each day.  Furthermore, the database revealed that more than 13,000 products  contained security vulnerabilities.
These vulnerabilities become particularly significant when considering the  ease of obtaining and using hacking tools, the steady advances in the  sophistication and effectiveness of attack technology, and the emergence  of new and more destructive attacks. Thus, protecting federal computer  systems and the systems that support critical infrastructures has never  been more important.
section_title: Federal Law and Policy Established Federal Information Security Requirements
paragraphs: FISMA sets forth a comprehensive framework for ensuring the  effectiveness of security controls over information resources that support  federal operations and assets. FISMA’s framework creates a cycle of risk  management activities necessary for an effective security program, and  these activities are similar to the principles noted in our study of the risk  management activities of leading private sector organizations—assessing  risk, establishing a central management focal point, implementing  appropriate policies and procedures, promoting awareness, and  monitoring and evaluating policy and control effectiveness. More  specifically, FISMA requires the head of each agency to provide  information security protections commensurate with the risk and  magnitude of harm resulting from the unauthorized access, use,  disclosure, disruption, modification or destruction of information and  information systems used or operated by the agency or on behalf of the  agency. In this regard, FISMA requires that agencies implement  information security programs that, among other things, include    periodic assessments of the risk;  risk-based policies and procedures;   subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems, as  appropriate;   security awareness training for agency personnel, including contractors  and other users of information systems that support the operations and  assets of the agency;    periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, performed with a frequency depending  on risk, but no less than annually;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies;   procedures for detecting, reporting, and responding to security incidents;    plans and procedures to ensure continuity of operations.
In addition, agencies must develop and maintain an inventory of major  information systems that is updated at least annually and report annually  to the Director of OMB and several Congressional Committees on the  adequacy and effectiveness of their information security policies,  procedures, and practices and compliance with the requirements of the  act.
OMB and agency IGs also play key roles under FISMA. Among other  responsibilities, OMB is to develop policies, principles, standards, and  guidelines on information security and is required to report annually to  Congress on agency compliance with the requirements of the act. OMB has  provided instructions to federal agencies and their IGs for preparing  annual FISMA reports. OMB’s reporting instructions focus on performance  metrics related to the performance of key control activities such as  developing a complete inventory of major information systems, providing  security training to personnel, testing and evaluating security controls,  testing contingency plans, and certifying and accrediting systems. Its  yearly guidance also requires agencies to identify any physical or  electronic incidents involving the loss of, or unauthorized access to,  personally identifiable information.
FISMA also requires agency IGs to perform an independent evaluation of  the information security programs and practices of the agency to  determine the effectiveness of such programs and practices. Each  evaluation is to include (1) testing of the effectiveness of information  security policies, procedures, and practices of a representative subset of  the agency’s information systems and (2) assessing compliance (based on  the results of the testing) with FISMA requirements and related  information security policies, procedures, standards, and guidelines. These  required evaluations are then submitted by each agency to OMB in the  form of an OMB-developed template that summarizes the results. In  addition to the template submission, OMB encourages agency IGs to  provide any additional narrative in an appendix to the report to the extent  they provide meaningful insight into the status of the agency’s security or  privacy program.
section_title: Agencies Report Progress in Performing Control Activities, but Some IGs Report that Weaknesses Exist
paragraphs: Major federal agencies have continued to report steady progress over the  past several years in performing information security control activities,  although IGs at several agencies identified inconsistencies with reported  information. According to OMB and agency FISMA reports, the federal  government continued to improve information security performance in  fiscal year 2007 relative to key performance metrics established by OMB.  For fiscal year 2007, IGs reported that more agencies had completed  approximately 96-100 percent of their inventories and the governmentwide  percentage of employees with significant security responsibilities who  received specialized training increased. Percentages also increased for  systems that had been tested and evaluated at least annually, systems with  tested contingency plans, and systems that had been certified and  accredited. However, agencies reported a decline in the percentage of  employees and contractors who received security awareness training (see  fig. 1). In addition, IGs at several agencies sometimes disagreed with the  information reported by the agency and have identified weaknesses in the  processes used to implement these and other security program activities.
In fiscal year 2007, 24 major federal agencies reported a total of 10,285  systems, composed of 8,933 agency and 1,352 contractor systems. Table 2  summarizes the number of agency and contractor systems by system  impact level.
IGs reported that 19 agencies had completed approximately 96-100 percent  of their inventories, an increase from 18 agencies in 2006. However, IGs  identified problems with system inventories at several agencies. For  example, three agency IGs did not agree with the reported number of  agency systems or systems operated by a contractor or another  organization on the agency’s behalf and one IG for a large agency reported  that it did not agree with the number of agency owned systems.  Additionally, one agency IG identified discrepancies in the number of  system interfaces and interconnections reported and one IG reported the  agency lacked procedures to ensure contractor systems are identified.  Without complete and accurate inventories, agencies cannot effectively  maintain and secure their systems. In addition, the performance measures  used to assess agencies’ progress may not accurately reflect the extent to  which these security practices have been implemented.
subsections: section_title: Security Awareness and Specialized Training
paragraphs: Overall, agencies reported a decline in the percentage of employees and  contractors receiving security awareness training. According to agency  FISMA reports, 84 percent of total employees and contractors  governmentwide received security awareness training in fiscal year 2007, a  decrease from 2006 in which 91 percent of employees and contractors  governmentwide received security awareness training. However, 10  agencies reported increasing percentages of employees and contractors  receiving security awareness training and five other agencies continue to  report that 100 percent of their employees and contractors received  security awareness training. In addition, each agency reported it had  explained policies regarding peer-to-peer file sharing in security  awareness training, ethics training, or other agencywide training.
Governmentwide, agencies reported an increasing percentage of  employees with significant security responsibilities who received  specialized training. In fiscal year 2007, 90 percent of these employees had  received specialized training, compared with 86 percent in fiscal year 2006.
Although the majority of agencies reported improvements in both the  percentage of employees and contractors receiving security awareness  training and the percentage of employees with significant security  responsibilities who received specialized training, several did not. For  example, nine agencies reported a decrease in the percentage of  employees and contractors who received security awareness training. In  addition, several IGs reported weaknesses in agencies security awareness  and training efforts. For example, one IG reported that the agency was  unable to ensure that contractors received security awareness training and  another IG reported that the agency security awareness program needs to  increase employees’ awareness of social engineering techniques and the  importance of protecting their usernames and passwords as a result of  successful social engineering attempts. Two agency IGs also noted that  weaknesses exist in ensuring that all employees who have specialized  responsibilities receive specialized training. Further, eight agency IGs  disagree with the percentage of individuals that their agency reported as  having received security awareness training. Figure 2 shows a comparison  between agency and IG reporting of the percentage of employees receiving  security awareness training. Failure to provide up-to-date information  security awareness training could contribute to the information security  problems at agencies.
In 2007, federal agencies reported testing and evaluating security controls  for 95 percent of their systems, up from 88 percent in 2006. The number of  agencies that reported testing and evaluating 90 percent or more of their  systems also increased from 16 in 2006 to 23 in 2007. However, IGs  reported shortcomings in agency procedures for testing and evaluating  security controls at several agencies. For example, 11 IGs reported that  their agency did not always ensure that information systems used or  operated by a contractor met the requirements of FISMA, OMB policy,  NIST guidelines, national security policy, and agency policy. In addition,  two IGs reported that agencies did not conduct their annual assessments  using current NIST guidance. As a result, these agencies may not have  reasonable assurance that controls are implemented correctly, are  operating as intended, and producing the desired outcome with respect to  meeting the security requirements of the agency. In addition, agencies may  not be fully aware of the security control weaknesses in their systems,  thereby leaving the agencies’ information and systems vulnerable to attack  or compromise.
section_title: Continuity of Operations
paragraphs: Federal agencies reported that 86 percent of total systems had  contingency plans that had been tested, an increase from 77 percent in  2006. However, as we reported in 2006, high-risk systems continue to have  the smallest percentage of tested contingency plans—only 77 percent of  high-risk systems had tested contingency plans. In contrast, agencies had  tested contingency plans for 90 percent of moderate-risk systems, 85  percent of low-risk systems, and 91 percent of uncategorized systems (see  fig. 3).
Two IGs reported that systems for their agencies were not tested in  accordance with federal government requirements. Without developing  and testing contingency plans, agencies have limited assurance that they  will be able to recover mission-critical applications, business processes,  and information in the event of an unexpected interruption.
section_title: Certification and Accreditation
paragraphs: Federal agencies continue to report an increasing percentage of systems  that have been certified and accredited. For fiscal year 2007, 92 percent of  agencies’ systems governmentwide were reported as certified and  accredited, as compared with 88 percent in 2006. In addition, agencies  reported certifying and accrediting 95 percent of their high-risk systems,  an increase from 89 percent in 2006.
Although agencies reported increases in the overall percentage of systems  certified and accredited, IGs reported that several agencies continued to  experience shortcomings in the quality of their certification and  accreditation process. As figure 4 depicts, five IGs rated their agencies’  certification and accreditation process as poor or failing, including three  agencies that reported over 90 percent of their systems as certified and  accredited.
In addition, IGs at six agencies identified specific weaknesses with key  documents in the certification and accreditation process such as risk  assessments, testing and evaluation, and security plans not being  consistent with NIST guidance or finding those items missing from  certification and accreditation packages. In other cases where systems  were certified and accredited, IGs noted that contingency plans and  security controls were not tested annually and security controls were not  fully tested and evaluated when significant changes were made to agency  systems. Additionally, one agency IG noted that the agency does not  follow a formally established and documented process for certification  and accreditation. As a result, reported certification and accreditation  progress may not be providing an accurate reflection of the actual status  of agencies’ implementation of this requirement. Furthermore, agencies  may not have assurance that accredited systems have controls in place  that properly protect those systems.
section_title: Policies and Procedures
paragraphs: Agencies had not always implemented security configuration policies.  Twenty-three of the major federal agencies reported that they had an  agencywide security configuration policy. Although the IGs agreed that  their agency had such a policy, several IGs did not agree to the extent to  which their agencies implemented the policies or applied the common  security configurations as established by NIST. In addition, only seven  agencies reported that they complied with NIST security configuration  requirements 96 percent or more of the time. If minimally acceptable  configuration requirements policies are not properly implemented to  systems, agencies will not have assurance that products are configured  adequately to protect those systems, which could increase their  vulnerability and make them easier to compromise.
As we have previously reported, not all agencies had developed and  documented policies and procedures reflecting OMB guidance on  protection of personally identifiable information that is either accessed  remotely or physically transported outside an agency’s secured physical  perimeter. Of the 24 major agencies, 22 had developed policies requiring  personally identifiable information to be encrypted on mobile computers  and devices. Fifteen of the agencies had policies to use a “time-out”  function for remote access and mobile devices requiring user  reauthentication after 30 minutes of inactivity. Fewer agencies (11) had  established policies to log computer-readable data extracts for databases  holding sensitive information and erase the data within 90 days after  extraction. Several agencies indicated that they were researching technical  solutions to address these issues. Furthermore, four IGs reported  agencies’ progress of implementing OMB guidance as poor or failing and at  least 14 IGs reported weaknesses in agencies’ implementation of OMB  guidance related to the protection of PII. Gaps in their policies and  procedures reduce agencies’ ability to protect personally identifiable  information from improper disclosure.
section_title: Security Incident Procedures
paragraphs: Shortcomings exist in agencies’ security incident reporting procedures.  According to OMB, the number of incidents reported by agencies in their  annual FISMA reports continued to fluctuate dramatically from the prior  year. The majority of IGs reported that these agencies followed  documented procedures for identifying and reporting incidents internally,  to US-CERT, and to law enforcement. However, five IGs noted that the  agency was not following procedures for internal incident reporting, two  noted that their agency was not following reporting procedures to US- CERT, and one noted that the agency was not following reporting  procedures to law enforcement. Several IGs also noted specific  weaknesses in incident procedures such as components not reporting  incidents reliably or consistently, components not keeping records of  incidents, and incomplete or inaccurate incident reports. Without properly  accounting for and analyzing security problems and incidents, agencies  risk losing valuable information needed to prevent future exploits and  understand the nature and cost of threats directed at the agency.
section_title: Remedial Actions to Address Deficiencies in Information Security Policies, Procedures, and Practices
paragraphs: IGs reported weaknesses in their agency’s remediation process. According  to IG assessments, 10 of the 24 major agencies did not almost always  incorporate information security weaknesses for all systems into their  remediation plans. Twelve IGs found that vulnerabilities from reviews  were not always included in remedial action plans and 10 IGs found that  agencies were not always prioritizing weaknesses to help ensure they are  addressed in a timely manner. Without a sound remediation process,  agencies cannot be assured that information security weaknesses are  efficiently and effectively corrected.
section_title: Significant Control Deficiencies at Federal Agencies Place Sensitive Information and Systems at Risk
paragraphs: Our work and that of IGs show that significant weaknesses continue to  threaten the confidentiality, integrity, and availability of critical  information and information systems used to support the operations,  assets, and personnel of federal agencies. In their fiscal year 2007  performance and accountability reports, 20 of 24 major agencies indicated  that inadequate information security controls were either a significant  deficiency or a material weakness for financial statement reporting (see  fig. 5). Our audits continue to identify similar conditions in both financial  and non-financial systems, including agencywide weaknesses as well as  weaknesses in critical federal systems.
Persistent weaknesses appear in five major categories of information  system controls: (1) access controls, which ensure that only authorized  individuals can read, alter, or delete data; (2) configuration management  controls, which provide assurance that only authorized software programs  are implemented; (3) segregation of duties, which reduces the risk that  one individual can independently perform inappropriate actions without  detection; (4) continuity of operations planning, which provides for the  prevention of significant disruptions of computer-dependent operations;  and (5) an agencywide information security program, which provides the  framework for ensuring that risks are understood and that effective  controls are selected and properly implemented. Figure 6 shows the  number of major agencies with weaknesses in these five areas.
subsections: section_title: Access Controls Were Not Adequate
paragraphs: A basic management control objective for any organization is to protect  data supporting its critical operations from unauthorized access, which  could lead to improper modification, disclosure, or deletion of the data.  Access controls, which are intended to prevent, limit, and detect  unauthorized access to computing resources, programs, information, and  facilities, can be both electronic and physical. Electronic access controls  include use of passwords, access privileges, encryption, and audit logs.  Physical security controls are important for protecting computer facilities  and resources from espionage, sabotage, damage, and theft.
Most agencies did not implement controls to sufficiently prevent, limit, or  detect access to computer networks, systems, or information. Our analysis  of IG, agency, and our own reports uncovered that agencies did not have  adequate controls in place to ensure that only authorized individuals could  access or manipulate data on their systems and networks. To illustrate, 23  of 24 major agencies reported weaknesses in such controls. For example,  agencies did not consistently (1) identify and authenticate users to prevent  unauthorized access, (2) enforce the principle of least privilege to ensure  that authorized access was necessary and appropriate, (3) establish  sufficient boundary protection mechanisms, (4) apply encryption to  protect sensitive data on networks and portable devices, and (5) log, audit,  and monitor security-relevant events. Agencies also lacked effective  controls to restrict physical access to information assets. We previously  reported that many of the data losses occurring at federal agencies over  the past few years were a result of physical thefts or improper  safeguarding of systems, including laptops and other portable devices.
section_title: Weaknesses Also Existed in Other Controls
paragraphs: In addition to access controls, other important controls should be in place  to protect the confidentiality, integrity, and availability of information.  These controls include the policies, procedures, and techniques for  ensuring that computer hardware and software are configured in  accordance with agency policies and that software patches are installed in  a timely manner; appropriately segregating incompatible duties; and  establishing plans and procedures to ensure continuity of operations for  systems that support the operations and assets of the agency.
However, 22 agencies did not always configure network devices and  services to prevent unauthorized access and ensure system integrity, or  patch key servers and workstations in a timely manner. In addition, 18  agencies did not always segregate incompatible duties to different  individuals or groups so that one individual does not control all aspects of  a process or transaction. Furthermore, 23 agencies did not always ensure  that continuity of operations plans contained all essential information or  were sufficiently tested. Weaknesses in these areas increase the risk of  unauthorized use, disclosure, modification, or loss of information.
section_title: Agencywide Security Programs Were Not Fully Implemented
paragraphs: An underlying cause for information security weaknesses identified at  federal agencies is that they have not yet fully or effectively implemented  all the FISMA-required elements for an agencywide information security  program. An agencywide security program, required by FISMA, provides a  framework and continuing cycle of activity for assessing and managing  risk, developing and implementing security policies and procedures,  promoting security awareness and training, monitoring the adequacy of  the entity’s computer-related controls through security tests and  evaluations, and implementing remedial actions as appropriate. Our  analysis determined that 21 of 24 major federal agencies had weaknesses  in their agencywide information security programs. Our recent reports  illustrate that agencies often did not adequately design or effectively  implement policies for elements key to an information security program.
We identified weaknesses in information security program activities, such  as agencies’ risk assessments, information security policies and  procedures, security planning, security training, system tests and  evaluations, and remedial actions. For example,    One agency’s risk assessment was completed without the benefit of an  inventory of all the interconnections between it and other systems. In  another case, an agency had assessed and categorized system risk levels  and conducted risk assessments, but did not identify many of the  vulnerabilities we found and had not subsequently assessed the risks  associated with them.
Agencies had developed and documented information security policies,  standards, and guidelines for information security, but did not always  provide specific guidance for securing critical systems or implement  guidance concerning systems that processed Privacy Act-protected data.
Security plans were not always up-to-date or complete.
Agencies did not ensure all information security employees and  contractors, including those who have significant information security  responsibilities, received sufficient training.
Agencies had tested and evaluated information security controls, but their  testing was not always comprehensive and did not identify many of the  vulnerabilities we identified.
Agencies did not consistently document weaknesses or resources in  remedial action plans.
As a result, agencies do not have reasonable assurance that controls are  implemented correctly, operating as intended, or producing the desired  outcome with respect to meeting the security requirements of the agency,  and responsibilities may be unclear, misunderstood, and improperly  implemented. Furthermore, agencies may not be fully aware of the  security control weaknesses in their systems, thereby leaving their  information and systems vulnerable to attack or compromise.  Consequently, federal systems and information are at increased risk of  unauthorized access to and disclosure, modification, or destruction of  sensitive information, as well as inadvertent or deliberate disruption of  system operations and services. In prior reports, we and the IGs have  made hundreds of recommendations to agencies to address specific  information security control weaknesses and program shortfalls. Until  agencies effectively and fully implement agencywide information security  programs, including addressing the hundreds of recommendations that we  and IGs have made, federal information and information systems will not  be adequately safeguarded to prevent their disruption, unauthorized use,  disclosure, or modification.
section_title: Incidents at Federal Agencies Place Sensitive Information and Systems at Risk
paragraphs: The need for effective information security policies and practices is  further illustrated by the number of security incidents experienced by  federal agencies that put sensitive information at risk. Personally  identifiable information about millions of Americans has been lost, stolen,  or improperly disclosed, thereby potentially exposing those individuals to  loss of privacy, identity theft, and financial crimes. Reported attacks and  unintentional incidents involving critical infrastructure systems  demonstrate that a serious attack could be devastating. Agencies have  experienced a wide range of incidents involving data loss or theft,  computer intrusions, and privacy breaches, underscoring the need for  improved security practices.
These incidents illustrate that a broad array of federal information and  critical infrastructures are at risk.
The Department of Veterans Affairs (VA) announced that computer  equipment containing personally identifiable information on  approximately 26.5 million veterans and active duty members of the  military was stolen from the home of a VA employee. Until the equipment  was recovered, veterans did not know whether their information was  likely to be misused. VA sent notices to the affected individuals that  explained the breach and offered advice concerning steps to reduce the  risk of identity theft. The equipment was eventually recovered, and  forensic analysts concluded that it was unlikely that the personal  information contained therein was compromised.
The Transportation Security Administration (TSA) announced a data  security incident involving approximately 100,000 archived employment  records of individuals employed by the agency from January 2002 until  August 2005. An external hard drive containing personnel data, such as  Social Security number, date of birth, payroll information, and bank  account and routing information, was discovered missing from a  controlled area at the TSA Headquarters Office of Human Capital.
A contractor for the Centers for Medicare and Medicaid Services reported  the theft of one of its employee’s laptop computer from his office. The  computer contained personal information including names, telephone  numbers, medical record numbers, and dates of birth of 49,572 Medicare  beneficiaries.
The Census Bureau reported 672 missing laptops, of which 246 contained  some degree of personal data. Of the missing laptops containing personal  information, almost half (104) were stolen, often from employees’ vehicles,  and another 113 were not returned by former employees. The Commerce  Department reported that employees had not been held accountable for  not returning their laptops.
The Department of State experienced a breach on its unclassified network,  which daily processes about 750,000 e-mails and instant messages from  more than 40,000 employees and contractors at 100 domestic and 260  overseas locations. The breach involved an e-mail containing what was  thought to be an innocuous attachment. However, the e-mail contained  code to exploit vulnerabilities in a well-known application for which no  security patch existed. Because the vendor was unable to expedite testing  and deploy a new patch, the department developed its own temporary fix  to protect systems from being further exploited. In addition, the  department sanitized the infected computers and servers, rebuilt them,  changed all passwords, installed critical patches, and updated their anti- virus software.
In August 2006, two circulation pumps at Unit 3 of the Tennessee Valley  Authority’s Browns Ferry nuclear power plant failed, forcing the unit to be  shut down manually. The failure of the pumps was traced to excessive  traffic on the control system network, possibly caused by the failure of  another control system device.
Officials at the Department of Commerce’s Bureau of Industry and  Security discovered a security breach in July 2006. In investigating this  incident, officials were able to review firewall logs for an 8-month period  prior to the initial detection of the incident, but were unable to clearly  define the amount of time that perpetrators were inside its computers, or  find any evidence to show that data was lost as a result.
The Nuclear Regulatory Commission confirmed that in January 2003, the  Microsoft SQL Server worm known as “Slammer” infected a private  computer network at the idled Davis-Besse nuclear power plant in Oak  Harbor, Ohio, disabling a safety monitoring system for nearly 5 hours. In  addition, the plant’s process computer failed, and it took about 6 hours for  it to become available again.
When incidents occur, agencies are to notify the federal information  security incident center—US-CERT. As shown in figure 7, the number of  incidents reported by federal agencies to US-CERT has increased  dramatically over the past 3 years, increasing from 3,634 incidents  reported in fiscal year 2005 to 13,029 incidents in fiscal year 2007, (about a  259 percent increase).
Incidents are categorized by US-CERT in the following manner:    Unauthorized access: In this category, an individual gains logical or  physical access without permission to a federal agency’s network, system,  application, data, or other resource.
Denial of service: An attack that successfully prevents or impairs the  normal authorized functionality of networks, systems, or applications by  exhausting resources. This activity includes being the victim or  participating in a denial of service attack.
Malicious code: Successful installation of malicious software (e.g., virus,  worm, Trojan horse, or other code-based malicious entity) that infects an  operating system or application. Agencies are not required to report  malicious logic that has been successfully quarantined by antivirus  software.
Improper usage: A person violates acceptable computing use policies.
Scans/probes/attempted access: This category includes any activity that  seeks to access or identify a federal agency computer, open ports,  protocols, service, or any combination of these for later exploit. This  activity does not directly result in a compromise or denial of service.
Investigation: Unconfirmed incidents that are potentially malicious or  anomalous activity deemed by the reporting entity to warrant further  review.
As noted in figure 8, the three most prevalent types of incidents reported  to US-CERT in fiscal year 2007 were unauthorized access, improper usage,  and investigation.
section_title: Opportunities Exist for Enhancing Federal Information Security
paragraphs: In prior reports, GAO and IGs have made hundreds of recommendations to  agencies for actions necessary to resolve prior significant control  deficiencies and information security program shortfalls. For example, we  recommended agencies correct specific information security deficiencies  related to user identification and authentication, authorization, boundary  protections, cryptography, audit and monitoring and physical security. We  have also recommended that agencies fully implement comprehensive,  agencywide information security programs by correcting weaknesses in  risk assessments, information security policies and procedures, security  planning, security training, system tests and evaluations, and remedial  actions. The effective implementation of these recommendations will  strengthen the security posture at these agencies.
In addition, recognizing the need for common solutions to improving  security, OMB and certain federal agencies have continued or launched  several governmentwide initiatives that are intended to enhance  information security at federal agencies. These key initiatives are  discussed below.
The Information Systems Security Line of Business: The goal of this  initiative is to improve the level of information systems security across  government agencies and reduce costs by sharing common processes and  functions for managing information systems security. Several agencies  have been designated as service providers for IT security awareness  training and FISMA reporting.
Federal Desktop Core Configuration: This initiative directs agencies that  have Windows XP deployed and plan to upgrade to Windows Vista  operating systems to adopt the security configurations developed by NIST,  DOD, and DHS. The goal of this initiative is to improve information  security and reduce overall IT operating costs.
SmartBUY: This program, led by GSA, is to support enterprise-level  software management through the aggregate buying of commercial  software governmentwide in an effort to achieve cost savings through  volume discounts. The SmartBUY initiative was expanded to include  commercial off-the-shelf encryption software and to permit all federal  agencies to participate in the program. The initiative is to also include  licenses for information assurance.
Trusted Internet Connections initiative: This is an effort designed to  optimize individual agency network services into a common solution for  the federal government. The initiative is to facilitate the reduction of external connections, including Internet points of presence, to a target of  fifty.
In addition to these initiatives, OMB has issued several policy  memorandums over the past two years to help agencies protect sensitive  data. For example, it has sent memorandums to agencies to reemphasize  their responsibilities under law and policy to (1) appropriately safeguard  sensitive and personally identifiable information, (2) train employees on  their responsibilities to protect sensitive information, and (3) report  security incidents. In May 2007, OMB issued additional detailed guidelines  to agencies on safeguarding against and responding to the breach of  personally identifiable information, including developing and  implementing a risk-based breach notification policy, reviewing and  reducing current holdings of personal information, protecting federal  information accessed remotely, and developing and implementing a policy  outlining the rules of behavior, as well as identifying consequences and  potential corrective actions for failure to follow these rules.
Opportunities also exist to enhance policies and practices related to  security control testing and evaluation, FISMA reporting, and the  independent annual evaluations of agency information security programs  required by FISMA.
Clarify requirements for testing and evaluating security controls.  Periodic testing and evaluation of information security controls is a  critical element for ensuring that controls are properly designed, operating  effectively, and achieving control objectives. FISMA requires that agency  information security programs include the testing and evaluation of the  effectiveness of information security policies, procedures, and practices,  and that such tests be performed with a frequency depending on risk, but  no less than annually.
We previously reported that federal agencies had not adequately designed  and effectively implemented policies for periodically testing and  evaluating information security controls. Agency policies often did not  include important elements for performing effective testing such as how to  determine the frequency, depth, and breadth of testing according to risk.  In addition, the methods and practices at six test case agencies were not  adequate to ensure that assessments were consistent, of similar quality, or  repeatable. For example, these agencies did not define the assessment  methods to be used when evaluating security controls, did not test  controls as prescribed, and did not include previously reported remedial  actions or weaknesses in their test plans to ensure that they had been  addressed. In addition, our audits of information security controls often  identify weaknesses that agency or contractor personnel who tested the  controls of the same systems did not identify. Clarifying or strengthening  federal policies and requirements for determining the frequency, depth,  and breadth of security controls according to risk could help agencies  better assess the effectiveness of the controls protecting the information  and systems supporting their programs, operations, and assets.
Enhance FISMA reporting requirements. Periodic reporting of  performance measures for FISMA requirements and related analyses  provides valuable information on the status and progress of agency efforts  to implement effective security management programs.
In previous reports, we have recommended that OMB improve FISMA  reporting by clarifying reporting instructions and requesting IGs to report  on the quality of additional performance metrics. OMB has taken steps to  enhance its reporting instructions. For example, OMB added questions  regarding incident reporting and assessments of system inventory.  However, the current metrics do not measure how effectively agencies are  performing various activities. Current performance measures offer limited  assurance of the quality of agency processes that implement key security  policies, controls, and practices. For example, agencies are required to test  and evaluate the effectiveness of the controls over their systems at least  once a year and to report on the number of systems undergoing such tests.  However, there is no measure of the quality of agencies’ test and  evaluation processes. Similarly, OMB’s reporting instructions do not  address the quality of other activities such as risk categorization, security  awareness training, intrusion detection and prevention, or incident  reporting. OMB has recognized the need for assurance of quality for  certain agency processes. For example, it specifically requested that IGs  evaluate the quality of their agency’s certification and accreditation  process. OMB instructed IGs to rate their agency’s certification and  accreditation process using the terms “excellent,” “good,” “satisfactory,”  “poor,” or “failing.” For fiscal year 2007, OMB requested that IGs identify  the aspect(s) of the certification and accreditation process they included  or considered in rating the quality of their agency’s process. Examples  OMB included were security plan, system impact level, system test and  evaluation, security control testing, incident handling, security awareness  training, and security configurations (including patch management). While  this information is helpful and provides insight on the scope of the rating,  IGs are not requested to comment on the quality of these items. Providing  information on the quality of the security-related processes used to  implement key control activities would further enhance the usefulness of  the annually reported data for management and oversight purposes.
As we have previously reported, OMB’s reporting guidance and  performance measures did not include complete reporting on certain key  FISMA-related activities. For example, FISMA requires each agency to  include policies and procedures in its security program that ensure  compliance with minimally acceptable system configuration requirements,  as determined by the agency. In our report on patch management, we  stated that maintaining up-to-date patches is key to complying with this  requirement. As such, we recommended that OMB address patch  management in its FISMA reporting instructions. OMB’s current reporting  instructions only request that IGs comment on whether or not they  considered patching as part of their agency’s certification and  accreditation rating but nothing more. As a result, OMB and Congress lack  information that could identify governmentwide issues regarding patch  management. This information could prove useful in demonstrating  whether or not agencies are taking appropriate steps for protecting their  systems.
Consider conducting FISMA-mandated annual independent evaluations  in accordance with audit standards or a common approach and  framework. We previously reported that the annual IG FISMA evaluations  lacked a common approach and that the scope and methodology of the  evaluations varied across agencies.
Similar to our previous reports, we found that the IGs continue to lack a  common methodology, or framework, which culminated in disparities in  type of work conducted, scope, methodology, and content of the IGs’  annual independent evaluations. To illustrate:    Of 24 agency IGs, seven reported performing audits that were in  accordance with generally accepted government auditing standards and  one cited compliance with the Quality Standards for Inspections, issued by  the President’s Council on Integrity and Efficiency (PCIE). The remaining  IGs did not indicate whether or not their evaluations were performed in  accordance with professional standards.
One IG indicated that the evaluation focused specifically on nonfinancial  systems, while others cited work conducted for financial systems as part  of their evaluations. In addition, multiple IGs indicated that their reviews  were focused on selected components, whereas others did not make any  reference to the scope or breadth of their work.
According to their FISMA reports, certain IGs reported interviewing  officials and reviewing agency documentation, such as security plans. In  addition, certain IGs also conducted technical vulnerability assessments.  In contrast, other IGs did not indicate their methods for evaluating  controls.
The content of the information reported by IGs varied. For example,  several IGs only provided a completed OMB template, while others  completed the OMB template and provided reports summarizing their  evaluations. Content in these reports also differed in that several included  comments on whether or not their agency was in compliance with laws  and regulations.
Several reports were comprised of a summary of relevant information  security audits conducted during the fiscal year, while others included  additional evaluations that addressed specific FISMA-required elements,  such as risk assessments and remedial actions. Furthermore, some IGs  issued recommendations to their agencies to improve the effectiveness of  those agencies’ information security programs, while others did not  indicate whether or not recommendations were issued.
These inconsistencies could hamper the efforts of the collective IG  community to perform their evaluations with optimal effectiveness and  efficiency. Conducting the evaluations in accordance with generally  accepted government auditing standards and/or a robust commonly used  framework or methodology could provide improved effectiveness,  increased efficiency, quality control, and consistency in assessing whether  the agency has an effective information security program. IGs may be able  to use the framework and methodology to be more efficient by focusing  evaluative procedures on areas of higher risk and by following an  integrated approach designed to gather sufficient, competent evidence  efficiently. Having a documented methodology may also offer quality  control by providing a standardized methodology, which can help the IG  community obtain consistency of application.
Last year we reported on efforts to develop such a framework. In  September 2006, the PCIE developed a tool to assist the IG community  with conducting its FISMA evaluations. The framework consists of  program and system control areas that map directly to the control areas  identified in NIST Special Publication 800-100 and NIST Special  Publication 800-53, respectively. According to PCIE members, the  framework includes broad recommendations rather than a specific  methodology due to the varying levels of resources available to each  agency IG. According to PCIE members, this framework is an effort to  provide a common approach to completing the required evaluations, and  PCIE has encouraged IGs to use it.
In summary, agencies have reported progress in implementing control  activities, but persistent weaknesses in agency information security  controls threaten the confidentiality, integrity, and availability of federal  information and information systems, as illustrated by the increasing  number of reported security incidents. Opportunities exist to improve  information security at federal agencies. OMB and certain federal agencies  have initiated efforts that are intended to strengthen the protection of  federal information and information systems. Opportunities also exist to  enhance policies and practices related to security control testing and  evaluation of information security performance metrics and independent  evaluations. Until such opportunities are seized and fully exploited and the  hundreds of GAO and IG recommendations to mitigate information  security control deficiencies and implement agencywide information  security programs are fully and effectively implemented, federal  information and systems will remain at undue and unnecessary risk.
Mr. Chairman, this concludes my statement. I would be happy to answer  questions at this time.
section_title: Contact and Acknowledgments
paragraphs: If you have any questions regarding this report, please contact Gregory C.  Wilshusen, Director, Information Security Issues, at (202) 512-6244 or  wilshuseng@gao.gov. Other key contributors to this report include Nancy  DeFranceso (Assistant Director), Larry Crosland, Neil Doherty, Rebecca  LaPaze, Stephanie Lee, and Jayne Wilson.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.