Insider Threats: DOD Should Strengthen Management and Guidance to Protect Classified Information and Systems
Published: 2015-06-02T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Since 2010, the United States has suffered grave damage to national security and an increased risk to the lives of U.S. personnel due to unauthorized disclosures of classified information by individuals with authorized access to defense information systems. Congress and the President have issued requirements for structural reforms and a new program to address insider threats.
A 2014 House Committee on Armed Services report included a provision that GAO assess DOD's efforts to protect its information and systems. This report evaluates the extent to which (1) DOD has implemented an insider-threat program that incorporates minimum standards and key elements, (2) DOD and others have assessed DOD's insider-threat program, and (3) DOD has identified any technical and policy changes needed to protect against future insider threats. GAO reviewed studies, guidance, and other documents; and interviewed officials regarding actions that DOD and a nonprobability sample of six DOD components have taken to address insider threats.
section_title: What GAO Found
paragraphs: The Department of Defense (DOD) components GAO selected for review have begun implementing insider-threat programs that incorporate the six minimum standards called for in Executive Order 13587 to protect classified information and systems. For example, the components have begun to provide insider-threat awareness training to all personnel with security clearances. In addition, the components have incorporated some of the actions associated with a framework of key elements that GAO developed from a White House report, an executive order, DOD guidance and reports, national security systems guidance, and leading practices recommended by the National Insider Threat Task Force. However, the components have not consistently incorporated all recommended key elements. For example, three of the six components have developed a baseline of normal activity—a key element that could mitigate insider threats. DOD components have not consistently incorporated these key elements because DOD has not issued guidance that identifies recommended actions beyond the minimum standards that components should take to enhance their insider-threat programs. Such guidance would assist DOD and its components in developing and strengthening insider-threat programs and better position the department to safeguard classified information and systems.
DOD and others, such as the National Insider Threat Task Force, have assessed the department's insider-threat program, but DOD has not analyzed gaps or incorporated risk assessments into the program. DOD officials believe that current assessments meet the intent of the statute that requires DOD to implement a continuing gap analysis. However, DOD has not evaluated and documented the extent to which the current assessments describe existing insider-threat program capabilities, as is required by the law. Without such a documented evaluation, the department will not know whether its capabilities to address insider threats are adequate and address statutory requirements. Further, national-level security guidance states that agencies, including DOD, should assess risk posture as part of insider-threat programs. GAO found that DOD components had not incorporated risk assessments because DOD had not provided guidance on how to incorporate risk assessments into components' programs. Until DOD issues guidance on incorporating risk assessments, DOD components may not conduct such assessments and thus not be able to determine whether security measures are adequate.
DOD components have identified technical and policy changes to help protect classified information and systems from insider threats in the future, but DOD is not consistently collecting this information to support management and oversight responsibilities. According to Office of the Under Secretary of Defense for Intelligence officials, they do not consistently collect this information because DOD has not identified a program office that is focused on overseeing the insider-threat program. Without an identified program office dedicated to oversight of insider-threat programs, DOD may not be able to ensure the collection of all needed information and could face challenges in establishing goals and in recommending resources and improvements to address insider threats.
This is an unclassified version of a classified report GAO issued in April 2015.
section_title: What GAO Recommends
paragraphs: GAO recommends that DOD issue guidance to incorporate key elements into insider-threat programs, evaluate the extent to which programs address capability gaps, issue risk-assessment guidance, and identify a program office to manage and oversee insider-threat programs. DOD agreed or partially agreed with all of the recommendations, and described actions it plans to take. However, DOD's actions may not fully address the issues as discussed in the report.

section_title: Letter
paragraphs: According to U.S. intelligence-community leaders, unauthorized  disclosures of classified information by individuals with authorized access  to Department of Defense (DOD) information and systems have resulted  in grave damage to national security and potentially placed the lives of  military service members at risk, highlighting the threat insiders can pose  to government organizations. Disclosures by an Army service member in  2010 and a National Security Agency contractor in 2013 are among the  largest known leaks of classified information in U.S. history, according to  DOD and U.S intelligence-community leaders. In January 2014, the U.S.  intelligence community’s Worldwide Threat Assessment cited the  persistent challenge and continuing critical threat that insiders pose.  Insiders have an advantage over others who may want to harm an  organization because insiders may have an awareness of their  organization’s vulnerabilities, such as loosely enforced policies and  procedures, or exploitable technical flaws. Even insiders who do not  intend to cause harm may inadvertently do so through human error.  Insiders with access to DOD information and systems may be able to  conduct far more malicious activity—wittingly or unwittingly—than  outsiders, with potentially devastating consequences for DOD. DOD’s  April 2015 cyber strategy stressed the importance of mitigating insider  threats, stating that DOD’s work to mitigate these threats extends beyond  technological solutions and includes personnel, reliability, leadership, and  accountability matters.
Since the 2010 disclosures, Congress and the President have taken  actions to try to prevent additional unauthorized disclosures of classified  information by insiders. In 2011, Congress—citing damage to national  security, the effect on military operations, and harm to the reputation and  credibility of the United States resulting from the 2010 disclosures—called  for DOD to establish an insider-threat program. issued Executive Order 13587 (E.O. 13587) that directed structural  reforms to ensure responsible sharing and safeguarding of classified  information on computer networks consistent with appropriate protections  for privacy and civil liberties. In 2012, the President issued the national  insider-threat policy that required agencies to implement insider-threat  programs by May 2013. The President also directed each agency’s  insider-threat program to include six minimum standards: (1) designation  of senior official(s); (2) information integration, analysis, and response; (3)  insider-threat program personnel; (4) access to information; (5)  monitoring user activity on networks; and (6) employee training and  awareness.
See National Defense Authorization Act for Fiscal Year 2012, Pub. L. No. 112–81, § 922  (2011) and H.R. Rep. 112-78 at 184-185 (2011).
See H. R. Rep. No. 113-446 at 287–288 (2014) accompanying H.R. 4435, a proposed bill  for the National Defense Authorization Act for Fiscal Year 2015. The House report also  included a provision for us to evaluate DOD’s efforts to protect U.S. installations from  insider threats. That report is due to be issued in summer 2015. systems, (2) DOD and others have assessed DOD’s insider-threat  program to protect classified information and systems, and (3) DOD has  identified any technical and policy changes it needs to protect its  classified information and systems from insider threats in the future.  Although this report is about protection of classified information and  systems from insider threats, we have previously completed a body of  work on other security issues, such as defense cybersecurity, information  security, and personnel security. This is an unclassified version of a  classified report that we issued in April 2015. This report does not identify  specific DOD components or the results of DOD and independent  assessments of DOD insider-threat programs—information that DOD  deemed to be classified or sensitive. Although the information provided in  this report is less detailed, it addresses the same objectives as our  classified report. Also, the overall methodology used for both reports is  the same.
To evaluate the extent to which DOD has implemented an insider-threat  program that incorporates minimum standards and key elements to  protect classified information and systems, we evaluated initiatives that  DOD had established and policy and guidance that identify  responsibilities within the department to address the threat that insiders  pose to classified information and systems. We selected a nonprobability  sample of six DOD components to assess implementation efforts at the  component level. The six components include three combat support  agencies; one military service; one combatant command; and one service  sub-command. We selected these six components based on several  factors including their specific roles in supporting DOD networks, prior  insider-threat incidents, and reported progress in implementing insider- threat programs. In order to avoid duplication with an ongoing DOD  Inspector General evaluation, we included only one military service.  While not generalizable, the information we obtained from these selected  components provided insight about the steps that different types of  components (i.e., service, combatant command, combat support agency)  are taking and challenges they are encountering. We developed a  questionnaire based on our research objectives, the minimum standards  called for in E.O. 13587, and industry leading practices for insider-threat  programs. We administered the questionnaire and collected responses  from all six components, and conducted follow-up meetings as needed  based on responses. We also collected responses from the Office of the  Under Secretary of Defense for Intelligence (OUSD ) about  the implementation of the department’s insider-threat program because  the Under Secretary of Defense for Intelligence is the DOD senior official  responsible for the department’s program. We used the questionnaire  responses and information obtained from meetings and document  reviews to assess each component’s insider-threat program  implementation and content. Using a scorecard methodology, two  analysts independently rated the collective data sources against the  minimum standards to score and provide an overall rating. The two  analysts then compared their independent scores, discussed any  differences, and determined the final ratings.
In addition to minimum standards, we identified key elements of insider- threat programs by reviewing and analyzing a range of documents  including E.O. 13587, DOD guidance and reports, Committee on National  Security Systems guidance, a set of leading practices that the National  Insider Threat Task Force recommends, practices that other federal  agencies and private industry use, and a list of essential principles  developed by a group of private-sector and U.S. government analysts.  We then organized this information into a framework of 25 key elements.  We based these elements upon the principles that we identified, but this  framework is not necessarily a comprehensive list of all elements since  other principles may exist that could benefit insider-threat programs. We  discussed this framework with DOD and private-sector officials and  incorporated their comments and changes as appropriate. In order to  assess how insider-threat programs incorporated these key elements, we  collected and analyzed information from the selected components and  OUSD (Intelligence) and interviewed relevant officials.
To evaluate the extent to which DOD and others have assessed DOD’s  insider-threat program to protect classified information and systems, we  compared DOD assessment efforts occurring during the course of our  review to those described in E.O. 13587. We reviewed copies of DOD’s  quarterly self-assessments from December 2013 through February 2015,  in which DOD reported its progress in complying with minimum  standards, and we interviewed OUSD (Intelligence) and DOD Chief  Information Officer (DOD CIO) officials about their self-assessment  process and results. We did not independently verify the accuracy of the  self-assessments since it was beyond the scope of this review. We also  met with officials from the National Security Agency and National Insider  Threat Task Force involved in conducting independent assessments,  confirmed that they have assessed some DOD components, and  obtained and reviewed copies of the assessments. To determine the  extent to which DOD conducted the continuing analysis of gaps in its  insider-threat program required by the National Defense Authorization Act  for Fiscal Year 2012, we obtained and reviewed DOD’s 2013 report to  Congress, which described the department’s plan for conducting a  continuing analysis, and interviewed OUSD (Intelligence) officials about  the current status of the analysis. To determine the extent to which DOD  incorporated risk assessments in its insider-threat program, we reviewed  DOD, Committee on National Security Systems, and National Insider  Threat Task Force guidance, and asked OUSD (Intelligence), DOD CIO,  and component officials about the extent to which DOD conducted risk  assessments related to insider-threat programs.
To evaluate the extent to which DOD has identified any technical or policy  changes it needs to protect its classified information and systems from  insider threats in the future, we focused on initiatives to be implemented  beginning in 2015 and those initiatives not included in DOD’s existing  insider-threat guidance. We collected information about initiatives through  our questionnaire and interviews with component officials, discussed  above. We also asked component, OUSD (Intelligence), and DOD CIO  officials about their process for prioritizing and planning for initiatives, as  well as how the department is collecting information about these  initiatives. We compared their responses to DOD guidance on  responsibilities for insider-threat programs and the defense security   and Office of the  enterprise, federal standards for internal control, Director of National Intelligence guidance. We did not evaluate the  initiatives themselves or assess each initiative’s relative priority or  efficacy. A more-detailed explanation of our scope and methodology can  be found in appendix I.
GAO/AIMD-00.21.3.1.
We conducted this performance audit from May 2014 to June 2015 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Policies and Plans to Address Insider Threats
paragraphs: DOD reported on the potential threats that insiders could pose in April  2000 when the department issued an integrated process team report with  59 recommendations for action to mitigate insider threats to DOD  information systems. After the unauthorized, massive disclosures of  classified information in 2010, Congress required the Secretary of  Defense to establish a program for information sharing protection and  insider-threat mitigation for DOD information systems. Additionally, the  President in October 2011 ordered structural reforms to safeguard  classified information and improve security of classified networks that  were to be consistent with appropriate protections for privacy and civil  liberties. E.O. 13587, among other things, established an interagency  Insider Threat Task Force, known as the National Insider Threat Task  Force, discussed below.
In November 2012, the President issued the National Insider Threat  Policy and Minimum Standards for Executive Branch Insider Threat  Programs, which identified six minimum standards that executive-branch  agencies were required to include in their insider-threat programs. These  standards include (1) designation of senior official(s); (2) information  integration, analysis, and response; (3) insider-threat program personnel;  (4) access to information; (5) monitoring user activity on networks; and (6)   Each minimum standard has multiple  employee training and awareness.associated tasks. For more information on these minimum standards and  associated tasks, see appendix II.
As part of the minimum standards, departments and agencies were  required to issue their own insider-threat policies and plans. DOD issued  its insider-threat program policy in September 2014. threat program policy requires each of the department’s components to  issue respective insider-threat policies and implementation plans. Figure  1 shows the relationship between the White House, DOD, and DOD  component actions to issue policies or plans.
section_title: Roles and Responsibilities Related to Insider Threats
paragraphs: DOD Directive 5205.16, The DOD Insider Threat Program (Sept. 30, 2014). tailor programs to meet their particular needs.to task-force officials, the task force conducts independent  assessments of agency programs as required by E.O. 13587.
Senior Information Sharing and Safeguarding Steering Committee  (co-chaired by the National Security Staff and the Office of  Management and Budget and includes representatives from executive  departments and agencies, including DOD) is to coordinate priorities  for sharing and safeguarding classified information on computer  networks. According to E.O. 13587, the committee is to receive copies  of the self-assessments that each agency is to conduct—commonly  referred to as the Key Information Sharing and Safeguarding  Indicators assessment—and copies of the independent assessments  that the National Insider Threat Task Force and National Security  Agency are to conduct.
National Security Agency, as co-Executive Agent for Safeguarding  Classified Information on Computer Networks, is to conduct  independent assessments of agency compliance with safeguarding  policies and standards as required by E.O. 13587.
Departments and agencies, including DOD, are to establish insider- threat programs and perform self-assessments of compliance with  established standards and priorities.
Various DOD organizations, as described in table 1, have responsibilities  related to insider threats, specifically the protection of DOD classified  information and systems.
section_title: DOD’s Program to Address Insider Threats
paragraphs: DOD has structured its insider-threat program to include four broad types  of insider threats, including cyber threats. According to an OUSD  (Intelligence) insider-threat program briefing, the DOD organizations  responsible for each of these threat areas are to share information to help  prevent and mitigate insider threats (see fig. 2).
section_title: DOD and Selected Components Have Taken Steps to Implement Insider- Threat Programs, but DOD Has Not Issued Supplemental Guidance
subsections: section_title: DOD and Selected Components Have Begun Implementing Insider- Threat Programs That Incorporate Minimum Standards
paragraphs: DOD and the six selected components we reviewed have begun  incorporating the minimum standards called for in E.O. 13587 into insider- threat programs to varying degrees to protect classified information and  systems. Specifically, two components have established insider-threat  programs that incorporate all six of the minimum standards. Conversely,  the other components have taken action but have not addressed all tasks  associated with the six minimum standards. For example, one insider- threat program has addressed six of the seven tasks associated with the  minimum standard of “Designation of Senior Official(s).” However, that  program has not completed the task that requires their senior official to  submit to the agency head an implementation plan and an annual report  that identifies annual accomplishments, resources allocated, insider- threat risks to the agency, recommendations and goals for program  improvement, and major impediments or challenges.
Similarly, all of the components we reviewed reported that they had  addressed the task included in the “Monitoring User Activity on Networks”  standard that states that insider-threat programs should include the  technical capability to monitor user activity on classified networks.  However, the means by which the selected components addressed this  task varied. Specifically, according to component officials, one component  was conducting more enhanced user activity monitoring for a small pilot  group, and two components were conducting widespread enhanced  monitoring of user activity. Two components reported that they were  using an application that provides network activity information to inform   According to the National Insider Threat Task  user activity monitoring.Force, this application contributes to insider-threat programs but does not  provide full user activity-monitoring capability. Table 2 describes our  evaluation of the extent to which DOD and the six selected components  had incorporated minimum standards into insider-threat programs as of  January 2015.
As of January 2015, DOD officials indicated that the selected components  continue to take steps to develop their programs and incorporate the  minimum standards into their programs. For example, DOD has drafted  an implementation plan—a task in the “Designation of Senior Official(s)”  minimum standard—that identifies the key milestones to incorporate the  minimum standards into the department’s insider-threat program. The  implementation plan also requires the components to issue their own  implementation plans as they establish insider-threat programs that  incorporate all minimum standards in accordance with DOD’s insider- threat program directive. According to DOD officials, DOD plans to issue  the department’s implementation plan in spring 2015. Additionally,  according to National Insider Threat Task Force officials, the Senior  Information Sharing and Safeguarding Steering Committee has decided  to adopt a risk-based approach to how departments and agencies  incorporate the minimum standards. Lower-risk organizations, which  could include some DOD components, will not be required to incorporate  the minimum standards to the same extent as higher-risk organizations.  The officials told us that they have not yet determined which DOD  components might be characterized as lower-risk, and the committee is  continuing to study the standards to determine what will be required of  lower-risk organizations.
section_title: Selected Components Have Not Incorporated Key Elements of Insider- Threat Programs That Are Cited in DOD Guidance
paragraphs: In addition to the minimum standards issued by the President, DOD  guidance and reports identify elements that could enhance DOD’s efforts  to protect classified information and systems. These elements—which are  required to support DOD’s broader efforts in areas such as cybersecurity,  counterintelligence, and information security—are also identified in  executive-branch policy and recommended in DOD and independent  studies related to insider threats. For example, DOD Instruction  5240.26, DOD’s 2000 insider-threat mitigation report, and Carnegie  Mellon Software Engineering Institute’s insider-threat guide state that  DOD components should develop a baseline of normal users’ activities.  Also, Carnegie Mellon Software Engineering Institute and a White  House review group—both of whom have recommended actions to  address insider threats—stated that agencies, such as DOD, should  develop risk-based analytics to detect insider-threat activity. As shown in  figure 3, we developed a framework of these key elements by program  phase based on our analysis of the minimum standards, DOD guidance,  executive-branch policy and reports, and other guidance.
DOD and the six components we reviewed have incorporated some of the  25 recommended key elements we identified from DOD guidance and  reports and independent studies to mitigate insider threats. Specifically,  we found that some components have incorporated key elements such as  conducting internal spot checks; instituting internal controls and security  controls; performing risk-based analytics; and taking personnel action.
However, DOD and the six components have not incorporated all of the  25 key elements and for the ones they have incorporated, they have not  done so consistently. For example:  Institute and communicate consequences. DOD Instruction 8500.01  directs DOD components to ensure personnel are considered for  sanctions if they compromise, damage, or place at risk DOD  information. Additionally, Carnegie Mellon Software Engineering  Institute’s insider-threat guide states that agencies should have  policies and procedures in place that specify the consequences of  particular policy violations. We found that one component published  a table of penalties, which is a guide for assessing the appropriate  penalty for misconduct. A second component’s policy had procedures  for communicating the consequences of disciplinary actions to insider- threat personnel; however, the other components we reviewed did not  have similar information in their insider-threat program policies.  Further, two components reported that their program processes and  procedures were not fully documented, and officials from another  component cited an example of component officials not instituting  consequences when an incident occurred.
Develop a baseline of normal activity. directs DOD components to report anomalies, such as changes in  user behavior. DOD’s 2000 insider-threat mitigation report  recommended that DOD create a list of system and user behavior  attributes to develop a baseline of normal activity patterns.
A baseline of normal activity identifies a user’s normal network activity.
Additionally, according to Carnegie Mellon Software Engineering  Institute’s insider-threat guide, to detect anomalies in network activity,  an organization must first create a baseline of normal network  activity. Three components have taken action to identify a baseline  of normal user activity, but the others have not.
Share information as appropriate. E.O. 13587 states that agencies  should provide policies for sharing information both within and outside  of the federal government. Component officials stated there are  informal processes for sharing information within DOD; however, the  component officials stated that they were unaware of a process for  sharing information outside of DOD.
Develop, disseminate, and incorporate best practices and lessons  learned. DOD Instruction 5240.26 calls for the identification and  dissemination of best practices across DOD in support of DOD  insider-threat programs. Additionally, DOD’s 2000 insider-threat  mitigation report recommended that DOD develop a database of  lessons learned from insider-threat incidents. The report stated that  not having such information severely hampers understanding of the  magnitude of the insider-threat problem and the development of  solution strategies. Officials at five components stated that while they  sometimes develop and share best practices and lessons learned as  a matter of practice, they do not have or use a formalized process of  developing, disseminating, and incorporating best practices and  lessons learned, such as solutions to vulnerabilities, in their insider- threat programs.
When we discussed the key elements framework with DOD officials,  researchers specializing in insider threats, and a private sector insider- threat program official, they agreed that it identified elements that would  help DOD components develop and strengthen their insider-threat  programs. However, DOD officials stated that they would need  supplemental planning guidance that helps them identify actions, such as  the key elements, beyond the minimum standards that they should take to  enhance their insider-threat programs. The current DOD directive does  not contain additional guidance for implementing key elements of an  insider-threat program beyond the minimum standards. According to  DOD component officials, the directive repeats the minimum standards  but does not provide DOD component officials with sufficient guidance for  incorporating recommended key elements to enhance their insider-threat  programs. Additionally, the draft DOD implementation plan provides  guidance on the minimum standards but not recommended key elements.  In January 2015, DOD officials stated that they planned to issue  supplemental guidance to assist components in implementing insider- threat programs. Issuing such guidance would be consistent with federal  standards for internal control, which state that organizations need  information to achieve objectives, and that information should be  communicated to those who need it within a time frame that enables them  to carry out their responsibilities. Guidance identifying actions beyond  the minimum standards could assist components in enhancing their  insider-threat programs and further enhance the department’s efforts to  protect its classified information and systems.
section_title: DOD Has Assessed Its Insider-Threat Program but Has Not Analyzed Gaps or Incorporated Risk Assessments into the Program
subsections: section_title: DOD and Other Entities Have Assessed the Department’s Insider- Threat Program
paragraphs: DOD has conducted self-assessments of its insider-threat program;  additionally, independent entities have assessed DOD components’  compliance with relevant policies and standards. E.O. 13587 and the  national insider-threat policy require agencies to perform self- assessments that evaluate their level of organizational compliance with  the national insider-threat policy and minimum standards. To meet this  requirement, DOD conducts quarterly self-assessments—commonly  referred to as the Key Information Sharing and Safeguarding Indicators  assessment—and evaluates the extent to which the department is  addressing 63 key performance indicators. These 63 key performance  indicators address topics such as the implementation of the department’s  insider-threat program, the management and monitoring of removable  media, and the implementation of a public-key infrastructure to reduce  user anonymity on classified networks. In its February 2015 quarterly  self-assessment, DOD reported that it addressed all of the management  and monitoring indicators for removable media. For example, DOD  reported that it monitors computer systems and uses a tool to alert  appropriate officials when individuals try to write to removable media such  as CDs or USB devices. However, DOD also reported that it had not fully  addressed other indicators, including those associated with the  department’s insider-threat program. For example, DOD reported that it  had not issued its program-implementation plan. DOD officials  acknowledged that the department had not completed the tasks  associated with the 63 key performance indicators and told us that the  department will continue to focus on these efforts until they have been  addressed.
DOD has conducted these self-assessments for the department, as  required. However, we found that these assessments reflect either the  department’s overall progress or limited information regarding actions  taken by individual DOD components. This information is limited because  the current assessments do not reflect the extent to which the  components have accomplished tasks associated with the 63 key  performance indicators. According to the draft DOD insider threat  program implementation plan, DOD components will be expected to  submit self-assessments to the Under Secretary of Defense for  Intelligence in 2015.
In addition to its self-assessments, in 2013 DOD updated its Command  Cyber Readiness Inspections to evaluate whether units had  incorporated insider-threat security measures identified in a 2013 U.S.  Cyber Command tasking order. U.S. Cyber Command officials indicated  that the command selects units for inspection according to risk factors  such as threat information and inspection histories. As of July 2014, DOD  had inspected one of the six components included in the scope of our  review. According to the inspection report, this component was complying  with the security measures cited in the 2013 tasking order. U.S. Cyber  Command officials stated that DOD intends to update the inspections in  2015 to include additional security measures developed in response to a  2014 U.S. Cyber Command tasking order.
In addition to DOD’s internal assessments, the National Security Agency  and the National Insider Threat Task Force separately conduct  independent assessments of DOD’s protection of classified information  and systems, as required by E.O. 13587. January 2015, the National Security Agency had assessed one DOD  component since E.O. 13587 was issued in 2011. The focus of the  assessment was to identify vulnerabilities, assess compliance, and assist  the component with the implementation of safeguarding policies and  standards in support of E.O. 13587. The assessment report identified  best practices, vulnerabilities, and recommendations to resolve technical  security issues.
The National Security Agency conducts these assessments in its independent role as  co-executive agent for safeguarding classified information on computer networks.
In accordance with the executive order, the National Insider Threat Task  Force has assessed four DOD components’ compliance with insider- threat policies and minimum standards. According to these assessments,  the task force compares the component’s policies and practices with the  minimum standards. The assessments note where the component has  taken action to address minimum standards and associated tasks, and  also make recommendations to help the components develop their  programs and address the standards. For example, in its assessment of  one component, the National Insider Threat Task Force complimented the  component’s system to centralize access to unclassified employee  records, but recommended that the component begin issuing an annual  report to its director, which is a task associated with the “Designation of  Senior Official(s)” standard.
section_title: DOD Has Not Completed a Required Continuing Analysis of Gaps
paragraphs: Section 922 of the National Defense Authorization Act for Fiscal Year  2012 requires that DOD complete a continuing analysis of gaps in  security measures and of technology, policies, and processes that are  needed to increase the capability of its insider-threat program to address  these gaps, and that DOD report to Congress on implementation of the  requirement. Although DOD reported to Congress in March 2013 that  OUSD (Intelligence) was conducting a survey to serve as a baseline  foundation for a continuing analysis of gaps, in October 2014 DOD  officials told us that they suspended this baseline survey and did not  otherwise complete a continuing analysis of gaps.have allowed DOD to define existing insider-threat program capabilities;  identify gaps in security measures; and advocate for the technology,  policies, and processes necessary to increase capabilities in the future.  According to the officials, after consulting DOD’s Cost Assessment and  Program Evaluation office about the process for conducting such a survey  across the department, the department believed such an effort would not  be feasible due to financial and personnel limitations. The department has  not taken action to fulfill this statutory requirement since then.
OUSD (Intelligence) officials stated that they believe the department has  addressed the intent of the statutory requirement through the previously  discussed assessments—DOD’s quarterly self-assessments, DOD’s  Command Cyber Readiness Inspections, and the National Security  Agency’s independent assessments. However, DOD has not evaluated  and documented the extent to which these assessments define existing  insider-threat program capabilities; identify gaps in security measures;  and advocate for the technology, policies, and processes necessary to  increase capabilities in the future, as is required by law. Similarly, DOD  officials stated that the department has not informed Congress that it did  not complete the actions identified in its 2013 report to Congress,  because they believed the legislation required only the 2013 report.  Further, officials from OUSD (Intelligence)—which supports DOD’s senior  official overseeing insider-threat programs—told us they do not review the  results of the National Security Agency assessments or Command Cyber  Readiness Inspection reports, though DOD Directive 5205.16 directs the  senior official to monitor insider-threat program implementation  progress. Without evaluating and documenting the extent to which  current assessments provide a continuing analysis of gaps, reporting to  Congress on the results of this evaluation, and OUSD (Intelligence)  reviewing the overall results of these self- and independent assessments,  the department will not know whether their capabilities for insider-threat  detection and analysis are adequate and fully address the statutory  requirements.
section_title: DOD and the Six Components Have Not Incorporated Risk Assessments into Insider- Threat Programs
paragraphs: National-level security guidance states that agencies should assess their   For example, the  risk posture as a part of their insider-threat programs.National Insider Threat Task Force’s guide states that agencies should  identify their critical assets and then assess the risk to those assets. Also,  the Committee on National Security Systems’ Directive on Protecting  National Security Systems from Insider Threat requires the alignment of  departments and agencies’ cybersecurity protections—which are part of  an insider-threat program’s protective capabilities—with the assets,  threats, and vulnerability assessments as determined by risk  assessments.
We found that DOD has not incorporated risk assessments into its  insider-threat programs. DOD officials stated that they include insider  threats in other risk assessments; however, these assessments are  technical in nature and focus on the vulnerabilities of individual systems.  These individual system risk assessments do not provide insider-threat  program officials with complete information to make informed risk and  resource decisions about how to align cybersecurity protections. For  example, the individual system risk assessments do not identify or  consider the different types of insider threats (e.g., foreign intelligence  collection, individuals with a personal agenda, or unintentional actions);  insider-threat vulnerabilities; or different levels of consequence that each  component or organization could suffer if an insider were to exploit the  vulnerability; nor do they address the overall risk to the insider-threat  program. Rather than conducting a formal risk assessment for the insider- threat program, DOD CIO officials stated that they reach out to DOD  component officials in an effort to maintain awareness of the department’s  overall insider-threat capabilities. We found that this communication  provides OUSD (Intelligence) and DOD CIO a status update of the  component’s progress in achieving key performance indicators for the  insider-threat program but does not include identification of component’s  critical assets and risks to them, as described in the National Insider  Threat Task Force’s guide. elements of their mission that are essential to national security and that, if  damaged, stolen, or otherwise exploited, would have a damaging effect  on the agency, its mission, and national security.
National Insider Threat Task Force, 2014 Guide to Accompany the National Insider  Threat Task Force Policy and Minimum Standards.
DOD officials stated that they believe the department has addressed the  intent of a risk assessment by other means, including the Command  Cyber Readiness Inspections and the National Security Agency’s  independent assessments of DOD components. Officials of the  Command Cyber Readiness Inspection program told us that the  inspection process currently includes threat assessments, a risk-indicator  matrix, and a risk assessment to prompt organizations to consider threats  and risk to their missions and operations resulting from vulnerabilities  found on their networks. However, these inspections do not focus on the  overall component but rather on specific units within a component.  Additionally, the National Security Agency told us that its independent  assessments would not include all information needed for a true risk  assessment. Finally, OUSD (Intelligence) officials stated that they do not  currently review the results of the National Security Agency assessments  or Command Cyber Readiness Inspection reports, as previously  discussed. Therefore, the senior-level official does not know which  specific types of risk the department is incurring.
DOD officials stated that the department and its components have not  incorporated risk assessments as part of their insider-threat programs in  part because they have not fully implemented the department’s insider- threat program. We also found that the DOD components we reviewed  have not assessed risks because DOD has not provided guidance  directing components to incorporate risk assessments into their  respective insider-threat programs. Until DOD provides supplemental  guidance directing components to incorporate risk assessments into their  insider-threat programs, components may not assess risk and DOD will  not be able to determine whether current security measures are adequate  or whether proposed security measures would address a component’s  level of risk. Also, if DOD and its components do not align insider-threat  security measures with threats, as required by the directive on national  security systems, decision makers may lack information needed to make  informed judgments.
section_title: DOD Identified Technical and Policy Changes to Protect against Insider Threats in the Future but Does Not Consistently Collect Information for Oversight and Recommendations
subsections: section_title: Selected DOD Components Identified Technical and Policy Changes for Future Action
paragraphs: To help protect classified information and systems from future insider  threats, in the technical area, officials from three of the six DOD  components we reviewed told us that they are hoping to obtain or  improve analytic tools that allow the component to identify anomalous   These analytic tools  behavior that could indicate insider-threat activities.would obtain data through monitoring of user activity. Specifically, officials  from two DOD components told us that they currently do not have these  tools, but hope to obtain them in the future. Officials from another DOD  component that does have such a tool told us that the component hopes  to obtain an enhanced version that will allow the tool to analyze user  behavior across systems of different classification levels (i.e., across the  unclassified network, secret network, and top-secret network). According  to National Insider Threat Task Force officials, these tools can also merge  user activity-monitoring data with other sources of data to provide  analysts with additional information.
In the policy area, component officials we interviewed also identified  several actions to better protect against insider threats.
DOD Insider Threat Management and Analysis Center. Officials from  three of the six DOD components we reviewed told us that they need  DOD to make additional decisions regarding the proposed Defense  Insider Threat Management and Analysis Center. According to an  OUSD (Intelligence) briefing, DOD developed the concept for such a  center based on a common recommendation that was identified in a  2012 Defense Science Board report and a 2013 Washington Navy  Yard shooting after-action report; a similar recommendation was also  identified in a 2010 Fort Hood shooting after-action report.  According to DOD’s Washington Navy Yard Task Force  Implementation Plan, the center will consist of cross-functional  representatives that assess risk, recommend intervention or  mitigation, and oversee the completion of case action on threats that  insiders may pose to DOD personnel, DOD missions and resources,  or both. While this implementation plan identifies general efforts that  the center could take, DOD has not issued a concept of operations  and other planning documents that identify the center’s actual  functions, scope, level of involvement expected from the components,  level of DOD involvement, and depth of analysis to be completed at  the center, and the relationship between the center and the services’  existing threat-analysis centers.
Information sharing. Officials from two of the six components we  reviewed cited the need for clear policies on when and how  components can share information about individuals who are  suspected or confirmed of being an insider threat. Similarly, officials  said that the components need clear policy about sharing suspicious  information that could be occurring across DOD components and  other federal agencies.
Continuous evaluation. Officials from one of the six components we  reviewed told us that the components need policy that addresses  continuous evaluation. Continuous evaluation is the practice of  reviewing background information at any time during an individual’s  period of eligibility for access to classified information to determine  whether the individual continues to meet the requirement for eligibility.  According to DOD’s Washington Navy Yard Task Force  Implementation Plan, continuous evaluation will leverage automated  records checks of personnel with access to DOD facilities or classified  information. These automated records checks of authoritative  commercial and government data sources (e.g., criminal, financial, or  credit records) will flag issues of personnel security concern. These  checks are to supplement existing security processes, such as self- reporting, to more quickly identify and prioritize information of  adjudicative relevance or adverse events that occur between periodic  reinvestigations. According to DOD’s draft insider-threat program  implementation plan, as of October 2014 DOD was still defining the  organizational construct and concept of operations for continuous  evaluation. DOD plans to provide this information in 2015.
section_title: DOD Is Not Consistently Collecting Information for Providing Oversight and Recommendations
paragraphs: DOD is not consistently collecting the information to manage and oversee  insider-threat programs that could assist the Under Secretary of Defense  for Intelligence in providing oversight and making recommendations to  counter insider threats, such as the technical and policy changes  identified above. DOD’s insider-threat program directive requires that the  Under Secretary of Defense for Intelligence provide management,  accountability, and oversight of the department’s insider-threat program,  which includes the components’ programs. As part of these  responsibilities, the Under Secretary of Defense for Intelligence is to  oversee departmental capabilities and resources to counter insider  threats, and make recommendations on program improvements and  resources. Additionally, DOD’s defense security enterprise directive  requires that the Under Secretary of Defense for Intelligence coordinate  with the DOD CIO to establish enterprise investment goals informed by  security-related efforts such as insider-threat initiatives. OUSD  (Intelligence) officials stated that they reach out to components on an as- needed basis to obtain information about insider-threat resources.  However, according to the officials, they do not have a process to  consistently collect information that identifies components prioritized  needs, such as technical and policy needs for the future, and as a result  face difficulties identifying component needs and comparing them against  overall goals and strategy. Without collecting information from DOD  components, the Under Secretary of Defense for Intelligence may face  challenges fulfilling these management responsibilities. OUSD  (Intelligence) and DOD CIO officials acknowledged that information from  the components’ about technical and policy needs would help the Under  Secretary of Defense for Intelligence establish investment goals and  make recommendations on program improvements and resources.
According to OUSD (Intelligence) officials, they do not have a process to  collect information from the components to support management and  oversight duties and inform resource recommendations and investment  goals because DOD has not dedicated a program office that is focused  on oversight of the insider-threat program. Specifically, while DOD has  designated the Under Secretary of Defense for Intelligence as the  department’s senior insider-threat program official, officials stated that  DOD has not identified a program office to execute the day-to-day  responsibilities associated with this position and the program is instead  currently supported within an office whose mission is policy, rather than  management, oriented. Identification of a program office is consistent with  federal standards for internal control and Office of the Director of National  Intelligence guidance. For example, federal standards for internal  control call for an organizational structure that provides a framework to  achieve agency objectives, including delegation of authority and  responsibility for operating activities.
Director of National Intelligence guidance states that fully functional  headquarters-level counterintelligence programs should include at least a  program manager and supporting program staff. Without identifying a  program office to support the Under Secretary of Defense for  Intelligence’s responsibilities in managing and overseeing DOD and  components’ insider-threat programs, DOD may not be able to collect all  information about DOD components’ technical and policy needs and  could face challenges in establishing goals, and recommending resources  and improvements to address insider threats.
section_title: Conclusions
paragraphs: The recent disclosures of classified information by insiders have  damaged national security, potentially placed the lives of military service  members at risk, and highlighted the importance of preventing or  mitigating future threats to DOD’s classified information and systems.  DOD’s April 2015 cyber strategy reflects the importance of mitigating  insider threats to achieve the department’s goal of defending DOD’s  information network, securing DOD data, and mitigating the risk to DOD   DOD and its components are taking steps to address these  missions.threats by implementing programs that incorporate minimum standards.  However, DOD components have not taken action to incorporate other  key elements into their insider-threat programs because DOD has not  issued guidance that identifies actions beyond the minimum standards  that components should take to enhance their insider-threat programs.  Such guidance would assist components in developing and strengthening  insider-threat programs and better position the department to safeguard  classified information and systems.
Gap and risk assessments allow DOD components to regularly assess  the dynamic threat, vulnerability, and consequences associated with  protecting classified information and systems from insider threats. While  DOD has assessed aspects of its insider-threat program, it has not  evaluated or documented the extent to which these assessments provide  a continuing analysis of gaps as required by statute and has not  incorporated risk assessments into insider-threat programs; nor have the  results of the existing assessments been provided to DOD’s senior  insider-threat official. Without such an analysis of gaps and risk  assessments—and without the Under Secretary of Defense for  Intelligence reviewing the results—DOD will face challenges  understanding the extent to which its mitigations address current and  evolving threats that insiders pose, and will be hampered in making more- informed management and resource decisions.
In addition, as the threat evolves, DOD will need to address future  technical and policy changes. However, DOD is not consistently collecting  information about future technical and policy changes because it has not  established an insider-threat program office. Without designating a  program office dedicated to the oversight role, DOD may not ensure the  collection of all information about components’ needs and could face  challenges in establishing goals, and recommending resources and  improvements to address insider threats.
section_title: Recommendations for Executive Action
paragraphs: To further enhance the department’s efforts to protect its classified  information and systems from insider threats, we recommend that the  Secretary of Defense take the following four actions.
We recommend that the Secretary of Defense direct the Under Secretary  of Defense for Intelligence to take the following actions:  In planned supplemental planning guidance to be developed, identify  actions beyond the minimum standards that components should take  to enhance their insider-threat programs.
Evaluate and document the extent to which current assessments  provide a continuing analysis of gaps for all DOD components; report  to Congress on the results of this evaluation; and direct that the  overall results of these self- and independent assessments be  reviewed by the Office of the Under Secretary of Defense for  Intelligence.
Provide DOD components supplemental guidance that directs them to  incorporate risk assessments into their insider-threat programs.
We also recommend that the Secretary of Defense take action to do the  following:  Identify an insider-threat program office to support the Under  Secretary of Defense for Intelligence’s responsibilities in managing  and overseeing DOD and components’ insider-threat programs.
section_title: Agency Comments and Our Evaluation
paragraphs: DOD provided written comments on a draft of this report and these  comments are reproduced in appendix IV. DOD concurred or partially  concurred with all four of our recommendations. The Departments of  Homeland Security and Justice and the Office of the Director of National  Intelligence reviewed a draft of this report but did not provide any  comments.
DOD agreed with our recommendation to identify in supplemental  guidance actions beyond the minimum standards that components should  take to enhance their insider-threat programs. DOD stated that it will  publish a detailed implementation plan in 2015 to assist components in  implementing multiple actions required in all insider-threat programs.  Issuing an implementation plan is a positive step and one required by the  minimum standards. However, as stated in our report, the draft  implementation plan that we reviewed focused on actions that DOD would  take to implement the minimum standards and did not provide DOD  components additional information about other key elements that  component officials told us would be helpful. We therefore believe that  DOD needs to update its draft implementation plan before it is issued to  include guidance beyond the minimum standards, or issue this guidance  in another form. This will ensure that DOD components will be better  positioned to enhance their insider-threat programs and the department  will be better positioned to protect its classified information and systems.
DOD partially agreed with our recommendation to evaluate and document  the extent to which current assessments provide a continuing analysis of  gaps for all DOD components, report to Congress on the results of this  evaluation, and direct that the overall results of these assessments be  reviewed by OUSD (Intelligence). In its comments, DOD first stated that it  analyzes security gaps each quarter through its self-assessments, which  identify gaps in program capabilities. While these assessments can  provide DOD and its components information required under E.O. 13587,  DOD did not indicate whether it would evaluate and document whether  those assessments provide a continuing analysis of gaps as identified in  Section 922 of the National Defense Authorization Act for Fiscal Year  2012. Such an evaluation is necessary to determine whether DOD is  meeting the statutory requirement to complete a continuing analysis of  gaps in security measures and of technology, policies, and processes that  are needed to increase the capability of DOD’s insider-threat program to  address these gaps. We believe such an evaluation is prudent since, as  we stated in the report, the information from the self-assessments and  independent assessments cited by DOD is sometimes limited. Therefore,  we continue to believe that DOD should take steps to evaluate and  document the extent to which these current assessments provide the  same information as the statutorily-required analysis of gaps in order to  determine the adequacy of DOD’s insider-threat detection and analysis  capabilities. Second, DOD stated that it met the congressional reporting  requirement with its 2013 report, which did not require additional  reporting. However, as we stated in the report, DOD did not complete the  actions it described in the 2013 report and thus has not provided  Congress with current information that would assist it in making informed  decisions about funding to address gaps in security measures. Therefore,  we continue to believe that the department should report to Congress on  the results of its evaluation of current assessments, which identify gaps in  security measures under its program for information-sharing protection  and insider-threat mitigation. DOD also stated that the self-assessments  and independent assessments of component insider-threat programs  have begun, and agreed that these assessments will be provided to  OUSD (Intelligence) for review upon completion.
DOD agreed with our recommendation to provide components with  supplemental guidance directing them to incorporate risk assessments  into their insider-threat programs. DOD stated that its forthcoming  implementation plan will require components to employ a process to  identify critical assets and assess the components’ risk posture. DOD  also stated that other risk assessments will be considered and integrated  with insider-threat risks. We agree that incorporating risk assessments  will assist component leadership in making informed judgments and  better enable them to align security measures with threats.
DOD partially agreed with our recommendation to identify an insider- threat program office to support the Under Secretary of Defense for  Intelligence’s responsibilities in managing and overseeing insider-threat  programs. DOD stated that it has chartered a study to examine the  feasibility and associated requirements for establishing a separate DOD  insider-threat program office. DOD expects to complete this study by July  2016. Our recommendation does not state that DOD needs to establish a  separate program office, but rather that DOD should identify a program  office to support the Under Secretary’s responsibilities. Therefore we  would hope that as part of its study DOD would assign responsibility for  this oversight to a program office. In its comments, DOD also referred to  steps it has taken to establish the Defense Insider Threat Management  and Analysis Center and described some of the center’s future  capabilities. However, as we note in our report, DOD components  described their need for policy about the center, and DOD has not yet  issued a concept of operations and other planning documents that identify  the center’s actual functions, scope, and relationships with existing  service threat-analysis centers. Once DOD implements our  recommendation and identifies an insider-threat program office, the  Under Secretary of Defense for Intelligence will be better positioned to  collect information from the components about their prioritized technical  and policy needs for the future, such as policy regarding the Defense  Insider Threat Management and Analysis Center.
We are sending copies of this report to the appropriate congressional  committees, the Secretaries of Defense and Homeland Security; the  Attorney General of the United States; and the Director of National  Intelligence. In addition, this report will also be available at no charge on  the GAO website at http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact Joseph W. Kirschbaum at (202) 512-9971 or  KirschbaumJ@gao.gov or Gregory C. Wilshusen at (202) 512-6244 or  WilshusenG@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report.  GAO staff who made key contributions to this report are listed in appendix  V.
section_title: Appendix I: Scope and Methodology
paragraphs: To evaluate the extent to which the Department of Defense (DOD) has  implemented an insider-threat program that incorporates minimum  standards and key elements to protect classified information and  systems, we evaluated initiatives that DOD had established and policy  and guidance that identify responsibilities within the department to  address the threat that insiders pose to classified information and  systems. We selected a nonprobability sample of six DOD components to  assess implementation efforts at the component level. These six  components include three combat support agencies; one military service;  one combatant command; and one service sub-command. We selected  these six components based on several factors including their specific  roles in supporting DOD networks, prior insider-threat incidents, and  reported progress in implementing insider-threat programs. In order to  avoid duplication with an ongoing DOD Inspector General evaluation, we  included only one military service. While not generalizable, the  information we obtained from these selected components provided insight  about steps components are taking and challenges they are  encountering.
We developed a questionnaire based on our research objectives, the six  minimum standards issued in 2012 by the President, and industry leading  practices, and solicited responses from the six selected components. We  administered the questionnaire and collected responses from all six  selected components and the Office of the Under Secretary of Defense  for Intelligence (OUSD ), and conducted follow-up meetings  as needed. We also collected policies and guidance related to the  responses and programs. We then used the questionnaire responses and  information obtained from meetings and document reviews to assess  each component’s insider-threat program implementation and content.  We reviewed the questionnaire responses to ensure the responses were  consistent with the information we obtained. Any discrepancies were  documented and follow up was conducted as necessary. Using a  scorecard methodology, we developed a rating system to assess the  components against the minimum standards to determine the extent to  which the minimum standards were incorporated into component insider- threat programs. We used three ratings for assessing the incorporation of  each minimum standard: addressed all tasks associated with minimum  standard, addressed at least one task, and did not address tasks. We  rated components that answered yes to all questions related to that  minimum standard and its associated tasks as addressed all tasks. We  rated components that answered yes to one or more question related to  that minimum standard and its associated tasks as addressed at least  one task. We rated components that did not answer yes to at least one  question related to a minimum standard and its associated tasks as  having not addressed any of the tasks. Two analysts independently  assessed and assigned a rating to each standard and then compared  their independent ratings, discussed any differences, and determined a  final rating. We then compiled the final ratings into a scorecard graphic.  An independent analyst reviewed our analysis and ratings for accuracy  and consistency.
Additionally, to identify 25 key elements for a framework applicable to  insider-threat programs, we analyzed Executive Order 13587 (E.O.  13587), the national insider-threat policy and minimum standards, DOD  guidance and reports, Committee on National Security Systems  guidance, a set of leading practices that the National Insider Threat Task  Force recommends, practices that other federal agencies and private  industry use, and a list of essential elements that a group of private-sector  and U.S. government analysts created.consulted by key element, see appendix III. We then organized this  information into a framework of 25 key elements. We based these  elements upon the principles that we identified, but note that this  framework is not necessarily a comprehensive list since other principles  may exist that did not surface based on our inquiry that could benefit  insider-threat programs. We discussed the framework with DOD and   For a list of the resources we  private-sector officials and incorporated comments and changes as  appropriate. We also met with officials from the Department of Homeland  Security and Department of Justice and obtained information about their  insider-threat programs because E.O. 13587 assigns them roles for  insider threats. While not generalizable, the information we obtained  provided insight about the implementation of insider-threat programs at  federal agencies other than DOD.
To evaluate the extent to which DOD and others have assessed DOD’s  insider-threat program to protect classified information and systems, we  obtained copies of DOD’s quarterly self-assessments from December  2013 through February 2015, in which DOD reported its progress in  complying with minimum standards. We compared the current DOD  assessment efforts to those described in E.O. 13587 and national policy,  and we interviewed officials from DOD and its components about their  self-assessment process and results. We did not independently verify the  accuracy of the self-assessments since it was beyond the scope of this  review. We met with U.S. Cyber Command and obtained information  about Command Cyber Readiness Inspections, including a list of  organizations inspected and the overall results related to insider threat.  We did not independently verify the accuracy of this information since it  was beyond the scope of this review. We also met with officials from the  National Insider Threat Task Force and National Security Agency who are  involved in conducting independent assessments, confirmed that they  have assessed some DOD components, and obtained and reviewed  copies of the assessments. To determine the extent to which DOD  conducted the continuing analysis of gaps in its insider-threat program  required by National Defense Authorization Act for Fiscal Year 2012, we  obtained and reviewed DOD’s 2013 report to Congress in which it  described its plan for conducting a continuing analysis, and interviewed  officials about the current status of the analysis. To determine the extent  to which DOD incorporated risk assessments in its insider-threat program,  we reviewed DOD, Committee on National Security Systems, and  National Insider Threat Task Force guidance related to the assessment of  an agency’s risk posture. We interviewed OUSD (Intelligence) and DOD  Chief Information Officer (DOD CIO) officials about the extent to which  DOD conducted risk assessments related to insider-threat programs, and  asked components about the extent to which they conducted risk  assessments that would inform insider-threat programs.
To evaluate the extent to which DOD has identified any technical or policy  changes to protect its classified information and systems from insider  threats in the future, we focused on initiatives to be implemented  beginning in 2015 and those initiatives not included in DOD’s existing  insider-threat guidance. We did not include initiatives that are being  assessed in-depth by a related GAO engagement. We collected  information about initiatives through the questionnaire we developed for  the six selected components, and through interviews with component  officials. The questionnaire and interviews were used to identify any  future technical and policy changes to address threats to component  information and information systems. We also asked component officials  about their process for prioritizing and planning for initiatives. We then  interviewed officials from OUSD (Intelligence) and DOD CIO about how  the department is collecting information about these initiatives and using  the information to inform resource recommendations and program  improvements. We compared these responses to DOD guidance on  responsibilities for insider-threat programs and the defense security  enterprise, federal standards for internal control, and Office of the  Director of National Counterintelligence guidance. We did not evaluate  the initiatives themselves or assess each initiative’s relative priority or  efficacy.
We obtained relevant data and documentation and interviewed officials  from components within the Department of Defense, Department of  Homeland Security, Department of Justice, and the Office of the Director  of National Intelligence’s National Insider Threat Task Force. We also met  with representatives from Carnegie Mellon University Software  Engineering Institute – CERT Insider Threat Center and Lockheed Martin.
We conducted this performance audit from May 2014 to June 2015 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Minimum Standards for Executive Branch Insider-Threat Programs
paragraphs: DESIGNATION OF SENIOR OFFICIAL(S):  Each agency head shall designate a senior  official or officials, who shall be principally  responsible for establishing a process to  gather, integrate, and centrally analyze, and  respond to Counterintelligence (CI), Security,  Information Assurance (IA), Human  Resources (HR), Law Enforcement (LE), and  other relevant information indicative of a  potential insider threat. Senior Official(s)  shall:  1.  Provide management and oversight of the insider threat program and provide  resource recommendations to the agency head.  2.  Develop and promulgate a comprehensive agency insider threat policy to be  approved by the agency head within 180 days of the effective date of the National  Insider Threat Policy. Agency policies shall include internal guidelines and  procedures for the implementation of the standards contained herein.  3.  Submit to the agency head an implementation plan for establishing an insider  threat program and annually thereafter a report regarding progress and/or status  within that agency. At a minimum, the annual reports shall document annual  accomplishments, resources allocated, insider threat risks to the agency,  recommendations and goals for program improvement, and major impediments or  challenges.  4.  Ensure the agency’s insider threat program is developed and implemented in  consultation with that agency’s Office of General Counsel and civil liberties and  privacy officials so that all insider threat program activities to include training are  conducted in accordance with applicable laws, whistleblower protections, and civil  liberties and privacy policies.  5.  Establish oversight mechanisms or procedures to ensure proper handling and use  of records and data described below, and ensure that access to such records and  data is restricted to insider threat personnel who require the information to perform  their authorized functions.  6.  Ensure the establishment of guidelines and procedures for the retention of records  7. and documents necessary to complete assessments required by Executive Order  13587.   Facilitate oversight reviews by cleared officials designated by the agency head to  ensure compliance with insider threat policy guidelines, as well as applicable legal,  privacy and civil liberty protections.
subsections: section_title: INFORMATION INTEGRATION, ANALYSIS AND RESPONSE: Agency heads shall:
paragraphs: 1.  Build and maintain an insider threat analytic and response capability to manually  2. and/or electronically gather, integrate, review, assess, and respond to information  derived from CI, Security, lA, HR, LE, the monitoring of user activity, and other  sources as necessary and appropriate.   Establish procedures for insider threat response action(s), such as inquiries, to  clarify or resolve insider threat matters while ensuring that such response action(s)  are centrally managed by the insider threat program within the agency or one of its  subordinate entities.  3.  Develop guidelines and procedures for documenting each insider threat matter  reported and response action(s) taken, and ensure the timely resolution of each  matter.
INSIDER THREAT PROGRAM  PERSONNEL: Agency heads shall ensure  personnel assigned to the insider threat  program are fully trained in: 1.  Counterintelligence and security fundamentals to include applicable legal issues;  2.  Agency procedures for conducting insider threat response action(s);  3.  Applicable laws and regulations regarding the gathering, integration, retention,  safeguarding, and use of records and data, including the consequences of misuse  of such information;  4.  Applicable civil liberties and privacy laws, regulations, and policies; and  5.
Investigative referral requirements of Section 811 of the Intelligence Authorization  Act for FY 1995, as well as other policy or statutory requirements that require  referrals to an internal entity, such as a security office or Office of Inspector  General, or external investigative entities such as the Federal Bureau of  Investigation, the Department of Justice, or military investigative services  1.  Direct CI, Security, lA, HR, and other relevant organizational components to  securely provide insider threat program personnel regular, timely, and, if possible,  electronic access to the information necessary to identify, analyze, and resolve  insider threat matters. Such access and information includes, but is not limited to,  the following:  a. Counterintelligence and Security. All relevant databases and files to include,  but not limited to, personnel security files, polygraph examination reports,  facility access records, security violation files, travel records, foreign contact  reports, and financial disclosure filings.  b. Information Assurance. All relevant unclassified and classified network  information generated by IA elements to include, but not limited to, personnel  usernames and aliases, levels of network access, audit data, unauthorized  use of removable media, print logs, and other data needed for clarification or  resolution of an insider threat concern.  c. Human Resources. All relevant HR databases and files to include, but not  limited to, personnel files, payroll and voucher files, outside work and activities  requests, disciplinary files, and personal contact records, as may be  necessary for resolving or clarifying insider threat matters.  2.  Establish procedures for access requests by the insider threat program involving  particularly sensitive or protected information, such as information held by special  access, law enforcement, inspector general, or other investigative sources or  programs, which may require that access be obtained upon request of the Senior  Official(s).  3.  Establish reporting guidelines for CI, Security, lA, HR, and other relevant  organizational components to refer relevant insider threat information directly to the  insider threat program.  4. Ensure insider threat programs have timely access, as otherwise permitted, to  available United States Government intelligence and counterintelligence reporting  information and analytic products pertaining to adversarial threats.
MONITORING USER ACTIVITY ON  NETWORKS: Agency heads shall ensure  insider threat programs include: 1.  Either internally or via agreement with external agencies, the technical capability,  subject to appropriate approvals, to monitor user activity on all classified networks  in order to detect activity indicative of insider threat behavior. When necessary,  Service Level Agreements (SLAs) shall be executed with all other agencies that  operate or provide classified network connectivity or systems. SLAs shall outline  the capabilities the provider will employ to identify suspicious user behavior and  how that information shall be reported to the subscriber’s insider threat personnel.  2.  Policies and procedures for properly protecting, interpreting, storing, and limiting  access to user activity monitoring methods and results to authorized personnel.  3.  Agreements signed by all cleared employees acknowledging that their activity on  any agency classified or unclassified network, to include portable electronic  devices, is subject to monitoring and could be used against them in a criminal,  security, or administrative proceeding. Agreement language shall be approved by  the Senior Official(s) in consultation with legal counsel.  4.  Classified and unclassified network banners informing users that their activity on  the network is being monitored for lawful United States Government-authorized  purposes and can result in criminal or administrative actions against the user.  Banner language shall be approved by the Senior Official(s) in consultation with  legal counsel.
EMPLOYEE TRAINING AND  AWARENESS: Agency heads shall ensure  insider threat programs: 1.  Provide insider threat awareness training, either in-person or computer-based, to  all cleared employees within 30 days of initial employment, entry-on-duty (EOD), or  following the granting of access to classified information, and annually thereafter.  Training shall address current and potential threats in the work and personal  environment, and shall include, at a minimum, the following topics:  a. The importance of detecting potential insider threats by cleared employees  and reporting suspected activity to insider threat personnel or other  designated officials;  b. Methodologies of adversaries to recruit trusted insiders and collect  classified information;  c. Indicators of insider threat behavior and procedures to report such behavior;  and  d. Counterintelligence and security reporting requirements, as applicable.  2.  Verify that all cleared employees have completed the required insider threat  awareness training contained in these standards. ‘  3.  Establish and promote an internal network site accessible to all cleared employees  to provide insider threat reference material, including indicators of insider threat  behavior, applicable reporting requirements and procedures, and provide a secure  electronic means of reporting matters to the insider threat program.
section_title: Appendix III: Sources for Key Elements of Insider-Threat Programs GAO Identified
subsections: section_title: Program phase Deter
paragraphs: Source  GAO, Standards for Internal Control in the Federal Government,  GAO/AIMD-00.21.3.1 (Washington, D.C.: Nov. 1, 1999); Office of the Director  of National Intelligence, Office of the National Counterintelligence Executive,  Protecting Key Assets: A Corporate Counterintelligence Guide (11137482 ID  6-11)
section_title: Program phase Detect
paragraphs: DOD 5200.8-R; DODI 2000.16; DODI 6055.17; Joint Pub. 3-07.2; Secretary of  Defense, Final Recommendations of the Fort Hood Follow-on Review,  memorandum (Aug. 18, 2010)
section_title: Appendix IV: Comments from the Department of Defense
section_title: Appendix V: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the individuals named above, Tommy Baril, Assistant  Director; Jeffrey Knott, Assistant Director; Tracy Barnes; Lon Chin; Grace  Coleman; Nicole Collier; Kristi Dorsey; Ashley Houston; Amie Lesser;  Richard Powelson; Terry Richardson; Monica Savoy; and Jennifer  Spence made key contributions to this report.
section_title: Related Unclassified GAO Products
paragraphs: Defense Department Cyber Efforts: Definitions, Focal Point, and  Methodology Needed for DOD to Develop Full-Spectrum Cyberspace  Budget Estimates. GAO-11-695R. Washington, D.C.: July 29, 2011.
Defense Department Cyber Efforts: DOD Faces Challenges In Its Cyber  Activities. GAO-11-75. Washington, D.C.: July 25, 2011.
Defense Department Cyber Efforts: More Detailed Guidance Needed to  Ensure Military Services Develop Appropriate Cyberspace Capabilities.  GAO-11-421. Washington, D.C.: May 20, 2011.
Federal Facility Cybersecurity: DHS and GSA Should Address Cyber Risk  to Building and Access Control Systems. GAO-15-6. Washington, D.C.:  December 12, 2014.
Information Security: Agencies Need to Improve Oversight of Contractor  Controls. GAO-14-612. Washington, D.C.: August 8, 2014.
Information Security: Agencies Need to Improve Cyber Incident  Response Practices. GAO-14-354. Washington, D.C.: April 30, 2014.
Critical Infrastructure Protection: More Comprehensive Planning Would  Enhance the Cybersecurity of Public Safety Entities’ Emerging  Technology. GAO-14-125. Washington, D.C.: January 28, 2014.
Information Security: Agency Responses to Breaches of Personally  Identifiable Information Need to Be More Consistent. GAO-14-34.  Washington, D.C.: December 9, 2013.
Federal Information Security: Mixed Progress in Implementing Program  Components; Improved Metrics Needed to Measure Effectiveness.   GAO-13-776. Washington, D.C.: September 26, 2013.
Cybersecurity: National Strategy, Roles, and Responsibilities Need to Be  Better Defined and More Effectively Implemented. GAO-13-187.  Washington, D.C.: February 14, 2013.
Information Security: Better Implementation of Controls for Mobile  Devices Should Be Encouraged. GAO-12-757. Washington, D.C.:  September 18, 2012.
Cybersecurity: Challenges in Securing the Electricity Grid. GAO-12-926T.  Washington, D.C.: July 17, 2012.
Information Security: Cyber Threats Facilitate Ability to Commit Economic  Espionage. GAO-12-876T. Washington, D.C.: June 28, 2012.
Cybersecurity: Threats Impacting the Nation. GAO-12-666T. Washington,  D.C.: April 24, 2012.
Critical Infrastructure Protection: Cybersecurity Guidance Is Available, but  More Can be Done to Promote Its Use. GAO-12-92. Washington, D.C.  December 9, 2011.
Personnel Security Clearances: Additional Guidance and Oversight  Needed at DHS and DOD to Ensure Consistent Application or Revocation  Process. GAO-14-640. Washington, D.C.: September 8, 2014.
Personnel Security Clearances: Opportunities Exist to Improve Quality  Throughout the Process.GAO-14-186T. Washington, D.C.: November 13,  2013.
Personnel Security Clearances: Further Actions Needed to Improve the  Process and Realize Efficiencies. GAO-13-728T. Washington, D.C.: June  20, 2013.
Security Clearances: Agencies Need Clearly Defined Policy for  Determining Civilian Position Requirements. GAO-12-800. Washington,  D.C.: July 12, 2012.