Information Security: Environmental Protection Agency Needs to Resolve Weaknesses
Published: 2012-07-19T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: EPA is responsible for protecting human health and the environment by implementing and enforcing the laws and regulations intended to improve the quality of the nations air, water, and lands. The agencys policies and programs affect virtually all segments of the economy, society, and government. In addition, it relies extensively on networked computer systems to collect a wealth of environmental data and to disseminate much of this information while also protecting other forms of sensitive or confidential information.
Because of the importance of the security of EPAs information systems, GAO was asked to determine whether the agency has effectively implemented appropriate information security controls to protect the confidentiality, integrity, and availability of the information and systems that support its mission. To do this, GAO tested security controls over EPAs key networks and systems; reviewed policies, plans, and reports; and interviewed officials at EPA headquarters and two field offices.
section_title: What GAO Found
paragraphs: Although the Environmental Protection Agency (EPA) has taken steps to safeguard the information and systems that support its mission, security control weaknesses pervaded its systems and networks, thereby jeopardizing the agencys ability to sufficiently protect the confidentiality, integrity, and availability of its information and systems. The agency did not fully implement access controls, which are designed to prevent, limit, and detect unauthorized access to computing resources, programs, information, and facilities. Specifically, the agency did not always (1) enforce strong policies for identifying and authenticating users by, for example, requiring the use of complex (i.e., not easily guessed) passwords; (2) limit users access to systems to what was required for them to perform their official duties; (3) ensure that sensitive information, such as passwords for system administration, was encrypted so as not to be easily readable by unauthorized individuals; (4) keep logs of network activity or monitor key parts of its networks for possible security incidents; and (5) control physical access to its systems and information, such as controlling visitor access to computing equipment. In addition to weaknesses in access controls, EPA had mixed results in implementing other security controls. For example, EPA conducted appropriate background investigations for employees and contractors to ensure sufficient clearance requirements had been met before permitting access to information and information systems. However,
EPA had not always securely configured network devices and updated operating system and database software with patches to protect against known vulnerabilities.
EPA had not always ensured equipment used for sanitization and disposal of media was tested to verify correct performance.
An underlying reason for the control weaknesses is that EPA has not fully implemented a comprehensive information security program. Although EPA has established a framework for its security program, the agency has not yet fully implemented all elements of its program. Specifically, it did not always finalize policies and procedures to guide staff in effectively implementing controls; ensure that all personnel were given relevant security training to understand their roles and responsibilities; update system security plans to reflect current agency security control requirements; assess management, operational, and technical controls for agency systems at least annually and based on risk; and implement a corrective action process to track and manage all weaknesses when remedial actions were necessary. Sustained management oversight and monitoring are necessary for EPA to implement these key information security practices and controls. Until EPA fully implements a comprehensive security program, it will have limited assurance that its information and information systems are adequately protected against unauthorized access, use, disclosure, modification, disruption, or loss.
section_title: What GAO Recommends
paragraphs: GAO is making 12 recommendations to the Administrator of EPA to fully implement elements of EPAs comprehensive information security program. In commenting on a draft of this report, EPAs Assistant Administrator generally agreed with GAOs recommendations. Two of GAOs recommendations were revised to incorporate EPAs comments. In a separate report with limited distribution, GAO is also making 94 recommendations to EPA to enhance access and other information security controls over its systems.

section_title: Letter
paragraphs: The Environmental Protection Agency’s (EPA) mission is to protect  human health and the environment by implementing and enforcing the  laws and regulations intended to improve the quality of the nation’s air,  water, and lands. EPA’s policies and programs affect virtually all  segments of the economy, society, and government. In meeting its  mission, the agency relies extensively on networked computer systems to  collect a wealth of environmental data and to disseminate much of this  information to the public while also protecting sensitive or confidential  information.
Protection of mission-critical and sensitive information technology (IT)  resources on information systems remains an ongoing challenge for EPA  as federal agencies experience evolving and growing cyber attacks.  Without a well-designed security program, EPA’s information and  information systems could be subject to unauthorized access, disclosure,  disruption, modification, or destruction.
In response to your request, we evaluated EPA’s information security  program. Our objective was to determine whether EPA has effectively  implemented appropriate information security controls to protect the  confidentiality, integrity, and availability of the information and systems  that support its mission.
To accomplish this objective, we examined computer security controls  over EPA’s network infrastructure and systems key to the agency’s  mission. We also examined information security policies, plans, and  procedures; reviewed testing of controls over key applications;  interviewed key agency officials; and reviewed EPA inspector general  reports to identify previously reported weaknesses.
We conducted this performance audit from July 2011 to July 2012 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objective. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objective. See appendix I for a complete  description of our objective, scope, and methodology.
subsections: section_title: Background
paragraphs: Safeguarding government computer systems and the sensitive  information that resides on them is an ongoing challenge because of the  complexity and interconnectivity of systems, the ease of obtaining and  using hacking tools, the steady advances in the sophistication and  effectiveness of attack technology, and the emergence of new and more  destructive attacks. Without adequate safeguards, systems are  vulnerable to individuals and groups with malicious intentions, who may  obtain sensitive information, commit fraud, disrupt operations, or launch  attacks against other computer systems and networks. Federal agencies  have experienced a significant rise in security incidents in recent years,  with data from the U.S. Computer Emergency Readiness Team showing  an increase in security incidents and events from 29,999 in 2009 to  42,887 in 2011.
subsections: section_title: EPA Plays a Key Role in Protecting the Environment
paragraphs: EPA was established in 1970 in response to concerns about  environmental pollution. To perform its statutory responsibilities, EPA  develops and enforces regulations and gives grants to and sponsors  partnerships with state environmental programs, non-profit organizations,  educational institutions, and others. In addition, the agency conducts  research and publishes materials on a variety of environmental topics.
In fiscal year 2011, EPA’s appropriation was about $8.6 billion. The  agency has headquarters in Washington, D.C., 10 regional areas, and  multiple laboratories and centers that support research and development.  At headquarters, EPA develops national programs, policies, and  regulations for mission areas, as described in table 1.
EPA’s regional offices are responsible for the execution of agency  programs within the states, and within some regions, including U.S.  territories. Figure 1 shows the distribution of these ten regions.
EPA relies on IT to support its mission and achieve its goals. In fiscal year  2011, the agency reported having 117 agency-operated systems and 12  contractor-operated systems. These systems include networks,  telecommunications, and specific applications. The Office of Technology  Operations and Planning within the Office of Environmental Information  provides centralized management and control of EPA’s IT resources and  services, including the EPA wide area network, a primary general support  system of EPA. The Office of Technology Operations and Planning is  located in Washington, D.C., and provides connectivity to EPA program  offices, regional offices and laboratories, and federal agencies. It is  responsible for the planning, design, operation, management, and  maintenance of the EPA wide area network with support from on-site  contractors and its Managed Trusted Internet Protocol Services (MTIPS)  service provider. Two divisions within the Office of Technology  Operations and Planning have primary responsibility for carrying out day- to-day operations of these services: the National Computer Center  (NCC), located in Research Triangle Park, North Carolina, is responsible  for EPA’s wide area network operations and server operations for  systems operated in the NCC. The Enterprise Desktop Solutions Division,  located in Washington, D.C., is responsible for the D.C. area local area  network, voice, and shared server room operation. Figure 2 depicts a  simplified version of EPA’s network.
EPA, in response to the Office of Management and Budget’s (OMB)  “Cloud First” policy that requires each agency to identify three services  that it will migrate to a cloud by June 2012, has identified two cloud  services: Enterprise Service Desk and MTIPS, which is part of the  Networx program offered by the General Services Administration. EPA  also operates a virtual hosting infrastructure in four internal data centers  with a standardized platform supporting up to 1,750 servers. Officials  stated that the goal is to migrate e-mail and collaboration services to a  commercial external cloud provider by 2015.
section_title: Responsibilities for EPA’s Information Security Program
paragraphs: The Federal Information Security Management Act of 2002 (FISMA)  requires each federal agency to develop, document, and implement an  agencywide information security program to provide security for the  information and information systems that support the operations and  assets of the agency, including those provided or managed by other  agencies, contractors, or other sources. According to FISMA, each  agency is responsible for providing information security protections,  commensurate with risk, for information collected or maintained by or on  behalf of the agency, and information systems used or operated by the  agency or on its behalf. FISMA requires that a chief information officer or  a comparable official of the agency be responsible for developing and  maintaining an agencywide information security program.
The Administrator of EPA is responsible for ensuring that an information  security program is implemented, and that security processes are  integrated with strategic and operational planning. EPA is responsible for  reporting annually to congressional committees, GAO, and to the Director  of OMB on the effectiveness of the agency’s information security program  and compliance with FISMA. The Chief Information Officer appoints a  senior agency information security officer and ensures that EPA’s  information security program follows applicable federal laws. Senior  leaders of EPA’s program offices and regions appoint information security  officers to implement agency information security program requirements  for the systems and information under their control.
The Office of Environmental Information centrally administers EPA’s  information security program. The Assistant Administrator of the Office of  Environmental Information serves as the Chief Information Officer for  EPA. As described in table 2, EPA has designated key roles in IT security  according to FISMA and agency policy.
section_title: Control Weaknesses Threaten Information and Systems Supporting EPA’s Mission
paragraphs: Although EPA has taken steps to safeguard the information and systems  that support its mission, security control weaknesses pervade its systems  and networks, thereby jeopardizing the agency’s ability to sufficiently  protect the confidentiality, integrity, and availability of its information and  systems. These deficiencies include those related to access controls, as  well as other controls such as configuration management and sensitive  media protection. A key reason for these weaknesses is that EPA has not  yet fully implemented its agencywide information security program to  ensure that controls are appropriately designed and operating effectively.  As a result, EPA has limited assurance that its information and  information systems are being adequately protected against unauthorized  access, use, disclosure, modification, disruption, or loss.
subsections: section_title: EPA Did Not Fully Implement Access Controls
paragraphs: A basic management objective for any organization is to protect the  resources that support its critical operations from unauthorized access.  Agencies accomplish this objective by designing and implementing  controls that are intended to prevent, limit, and detect unauthorized  access to computing resources, programs, information, and facilities.  Inadequate access controls diminish the reliability of computerized  information and increase the risk of unauthorized disclosure, modification,  and destruction of sensitive information and disruption of service. Access  controls include those related to (1) protection of system boundaries, (2)  user identification and authentication, (3) authorization, (4) cryptography,  (5) audit and monitoring, and (6) physical security.
Boundary protection controls logical connectivity into and out of networks  and controls connectivity to and from devices connected to the network.  For example, multiple firewalls can be deployed to prevent both outsiders  and trusted insiders from gaining unauthorized access to systems, and  intrusion detection technologies can be deployed to defend against  attacks from the Internet. Unnecessary connectivity to an organization’s  network increases not only the number of access paths that must be  managed and the complexity of the task, but also the risk of unauthorized  access in a shared environment. National Institute of Standards and  Technology (NIST) guidance states that agencies should provide  adequate protection for networks and employ information control policies  and enforcement mechanisms to control the flow of information between  designated sources and destinations within information systems.
EPA has established network boundaries, but did not always adequately  enforce those boundaries to secure connectivity into and out of its  networks. For example, at one location, network boundaries did not have  adequate segregation between a public library and the EPA facilities in  Research Triangle Park, North Carolina. In addition, EPA had allowed  unrestricted inbound use of an encrypted protocol that could be used to  access EPA internal networks. As a result, EPA’s networks were  vulnerable to unnecessary and potentially undetectable access at these  points.
A computer system must be able to identify and authenticate different  users so that activities on the system can be linked to a specific  individual. When an organization assigns a unique user account to a  specific user, the system is able to distinguish that user from another—a  process called identification. The system must also establish the validity  of a user’s claimed identity by requesting some kind of information, such  as a password, that is known only by the user—a process known as  authentication. The combination of identification and authentication—such  as a user account/password combination—provides the basis for  establishing individual accountability and for controlling access to the  system. NIST 800-53 recommends that information systems uniquely  identify and authenticate all users (or processes on behalf of users) and  that systems establish complex passwords to reduce the likelihood of a  successful attack. NIST also recommends using multifactor authentication  to access user accounts via a network.
While EPA has developed an interim security policy that addresses  identification and authentication and a draft procedure that is based on  NIST guidance, the agency did not always adequately implement these  interim requirements. For example, EPA did not authenticate routing  protocols on several of its internal network devices, leaving them  vulnerable. In addition, EPA did not enforce its own password complexity  requirements or change passwords for multiple servers. Further, EPA did  not require two-factor authentication for remote authentication and access  to e-mail accounts. As a result, EPA’s networks and systems are at  increased risk that an unauthorized individual could guess a legitimate  user’s identification and password combination and gain access to these  devices.
Authorization is the process of granting or denying access rights and  permissions to a protected resource, such as a network, a system, an  application, a function, or a file. For example, operating systems have  some built-in authorization features such as permissions for files and  folders. Network devices, such as routers, have access control lists that  can be used to authorize a user who can access and perform certain  actions on the device. A key component of granting or denying access  rights is the concept of “least privilege.” Least privilege is a basic principle  for securing computer resources and information. This principle means  that a user is granted only those access rights and permissions needed to  perform official duties. To restrict legitimate user access to only those  programs and files needed to perform work, agencies establish access  rights and permissions. “User rights” are allowable actions that can be  assigned to a user or to a group of users. File and directory permissions  are rules that regulate which users can access a particular file or directory  and the extent of that access. To avoid unintentionally authorizing user  access to sensitive files and directories, an agency must give careful  consideration to its assignment of rights and permissions.
NIST requires federal agencies to grant a user only the access and rights  to information and information systems needed to perform official duties.  National Security Agency (NSA) network security best practice guidance  recommends prohibiting root from logging directly into a remote system.  The guidance also recommends creating a set of filtering rules, also  known as an access control list, which permits the traffic identified on the  list and prohibits other traffic.
Although EPA has established an access control methodology based on  least privilege and need-to-know principles, it did not always limit user  access rights and permissions to only those necessary to perform official  duties. For example, EPA allowed for a large number of unused accounts  across several network domains. At one location, EPA did not have  adequate restrictions on a sensitive server to control access in managing  and administering network devices either locally or remotely, leaving them  vulnerable. In addition, EPA had not removed the accounts of former  employees. The result of these weaknesses is an increased risk of  unauthorized access to EPA systems and information.
Cryptography underlies many of the mechanisms used to enforce the  confidentiality and integrity of critical and sensitive information.  Cryptographic tools help control access to information by making it  unintelligible to unauthorized users and by protecting the integrity of  transmitted or stored information. A basic element of cryptography is  encryption. Encryption is the conversion of data into a form, called a  cipher text, which cannot be easily understood. Encryption can be used to  provide basic data confidentiality and integrity by transforming plain text  into cipher text using a special value known as a key and a mathematical  process known as an algorithm. NIST guidelines state that agencies  should use encryption to protect the confidentiality of remote access  sessions and encrypt sessions between host systems. The NIST  standard for an encryption algorithm is Federal Information Processing  Standards (FIPS) 140-2.
EPA did not always effectively encrypt certain sensitive information. For  example, EPA did not always encrypt private keys stored on certain  servers and had used a weak password encryption feature on network  devices. In addition, the agency allowed the use of insecure network  protocols to manage network devices. The agency also did not always  use a FIPS-compliant algorithm to encrypt passwords on three support  servers we reviewed. These weaknesses expose critical and sensitive  information to unnecessary risk of unauthorized access, modification, or  destruction.
To establish individual accountability, monitor compliance with security  policies, and investigate security violations, it is crucial to determine what,  when, and by whom specific actions have been taken on a system.  Agencies accomplish this by implementing system or security software  that provides an audit trail, or a log of system activity, that can be used to  determine the source of a transaction or attempted transaction and to  monitor a user’s activities. Audit and monitoring involves the regular  collection, review, and analysis of auditable events for indications of  inappropriate or unusual activity, and the appropriate investigation and  reporting of such activity. Automated mechanisms may be used to  integrate audit monitoring, analysis, and reporting into an overall process  for investigation and response to suspicious activities. Audit and  monitoring controls can help security professionals routinely assess  computer security, perform investigations during and after an attack, and  even recognize an ongoing attack. Audit and monitoring technologies  include network and host-based intrusion detection systems, audit  logging, security event correlation tools, and computer forensics.
NIST guidance states that agencies should retain sufficient audit logs to  allow monitoring of key activities, provide support for after-the-fact  investigation of security incidents, and meet organizational information  retention requirements.
Although EPA has many useful mechanisms at its disposal to help  prevent and respond to security breaches, such as firewalls and intrusion  detection systems, it has not consistently implemented integrated and  responsive audit and monitoring. For example, EPA had not enabled  auditing on a server used for receiving confidential data from commercial  entities. Furthermore, more than 150 of EPA’s network devices had  remote logging set to a severity level that was not sufficient for logging  important security information. In addition, the number of error logs on  one server database system was set so low that old logs would be  overwritten as soon as this number was reached, thus removing the old  logs from use. As a result, EPA is limited in its ability to establish  accountability, ensure compliance with security policies, and investigate  violations.
Physical security controls are a key component of limiting unauthorized  access to sensitive information and information systems. These controls  are important for protecting computer facilities and resources from  espionage, sabotage, damage, and theft. They involve restricting physical  access to computer resources and sensitive information, usually by  limiting access to the buildings and rooms in which the resources are  housed and periodically reviewing access rights granted to ensure that  access continues to be appropriate based on established criteria. Such  controls include perimeter fencing; surveillance cameras; security guards;  gates; locks; environmental controls such as smoke detectors, fire alarms  and extinguishers; and uninterruptible power supplies. NIST guidance  states that federal agencies should implement physical security and  environmental safety controls to protect employees and contractors,  information systems, and the facilities in which they are located.
EPA had implemented numerous physical security controls for protecting  its information, information systems, and employees. For example, the  agency used electronic badges, guards, magnetometers, and x-ray  machines to help control access to computing environments at two  locations. EPA had also implemented environmental and safety controls  such as temperature and humidity controls as well as emergency lighting  to protect its staff and sensitive IT resources.
Nonetheless, EPA did not always ensure that these controls were  consistently implemented. For example, over a period of 5 days, five staff  members at one location used their electronic badges to gain access to  the computer room, but they were not on the list of staff authorized to  enter the area. Two of these staff members were contractors, and the  other three were EPA staff. Similarly, EPA did not always effectively  control access to sensitive IT equipment kept in server or  telecommunication rooms. To illustrate, visitor logs were incomplete for  several rooms that contained sensitive IT equipment. These logs did not  always include information such as the visitor’s purpose for visiting the  room, the time of departure, or the type of identification used to sign in.  As a result, EPA has diminished assurance that its computing resources  are protected from inadvertent or deliberate misuse including sabotage,  vandalism, theft, and destruction. EPA officials stated that the access  controls list issue had been resolved and that IT equipment in the rooms  would be moved as part of its data center consolidation effort. The  agency also provided a subsequent response stating that most of the IT  equipment had been moved. We have not yet verified this information.
section_title: EPA Did Not Effectively Implement Other Controls
paragraphs: In addition to access controls, other important controls should be in place  to ensure the confidentiality, integrity, and availability of an agency’s  information. These controls include policies, procedures, and techniques  for securely configuring information systems, sufficiently disposing of  media, and implementing personnel security. Weaknesses in these areas  increase the risk of unauthorized use, disclosure, modification, or loss of  sensitive information and information systems supporting EPA’s mission.  EPA had personnel security controls in place.
Configuration management controls ensure that only authorized and fully  tested software is placed in operation, software and hardware are  updated, patches are applied to these systems to protect against known  vulnerabilities, and changes are documented and approved. To protect  against known vulnerabilities, effective procedures must be in place,  appropriate software installed, and patches updated promptly. Up-to-date  patch installation helps mitigate flaws in software code that could be  exploited to cause significant damage and enable malicious individuals to  read, modify, or delete sensitive information or disrupt operations. NIST  guidance states that agencies should document approved system  changes and retain records of configuration changes to systems and that  agencies should configure security settings to the most restrictive mode  consistent with operational requirements. Both NIST and NSA guidance  recommend that certain system services be disabled.
EPA has developed, documented, and established procedures to manage  configuration changes. For example, although the agencywide  configuration management procedure is still a draft document, EPA’s  Office of Technology Operations and Planning has developed,  documented, and implemented a change management process and  procedures document that is intended to provide formal and standardized  processes and procedures for identifying, assessing, approving,  implementing, and accounting for changes to EPA information systems.  In addition, the agency uses a central tool to request, approve, and track  the status of configuration change requests. The system owners or  managers have responsibility for documenting these changes. According  to agency officials, EPA uses an automated tool for applying patches that  are intended to correct software security vulnerabilities.
Despite these efforts, EPA had not always implemented configuration  management controls. For example, although the agency has an  automated tool in place for managing changes, officials could only  provide records of approved changes for four of the six systems we  reviewed. Information for the other two systems consisted only of e-mails  describing the changes. Furthermore, information for only two of the six  systems included the unique change request number generated by the  tool; this number could be used to research and determine whether a  change had been formally approved. During a demonstration of the tool,  an EPA official suggested that we contact system owners for system- specific change reports. However, change information provided by the  system owners varied in content, and the agencywide configuration  management guide did not instruct them on how such records should be  documented.
Similarly, EPA had not securely configured its networks and databases in  accordance with NIST guidance and web applications and operating  systems were not always configured to the most restrictive settings in  accordance with NIST guidance. Moreover, some EPA information  systems and network devices were running outdated software that was  no longer supported by the manufacturer, resulting in EPA being unable  to effectively patch them for vulnerabilities. In addition, newly released  security patches, service packs, and hot fixes had not been installed in a  timely manner, and several critical systems had not been patched or were  out of date, and some had known vulnerabilities. Without adequate  security controls, EPA systems are susceptible to many known  vulnerabilities.
The destruction of media and their disposal are key to ensuring the  confidentiality of information. Media can include magnetic tapes, optical  disks (such as compact disks), and hard drives. Agencies safeguard used  media to ensure that the information they contain is appropriately  controlled or disposed of. Media that are improperly disposed of can lead  to the inappropriate or inadvertent disclosure of an agency’s sensitive  information, including the personally identifiable information of its  employees and customers. NIST guidance states that verifying the  selected information sanitization and disposal process and testing of  media is an essential step for maintaining confidentiality. EPA has  documented a media protection policy through its interim network security  policy that states that all IT resources scheduled for disposal must be  adequately sanitized to protect the confidentiality of agency information  and that appropriate security controls such as those prescribed by NIST  must be applied. EPA has a supplemental disk sanitization procedure,  and program offices have the option to develop their own separate  procedures if needed.
However, EPA did not provide evidence that equipment used for disposal  of sensitive information had been tested to ensure that it was working  properly. Specifically, EPA could not provide documentation or support to  verify whether or not media disposal equipment had been tested for three  systems. Additionally, both sanitized and unsanitized hard drives were  being kept together in the storage area for one system. None of the drives  were labeled to show whether or not they had been sanitized, which could  allow intended or unintended access to sensitive data on an unsanitized  hard drive. Until EPA tests, documents, and implements information  security controls for media disposal and sanitization, increased risk exist  that the agency’s sensitive information may not be adequately protected.
The greatest harm or disruption to a system comes from the actions, both  intentional and unintentional, of individuals. These intentional and  unintentional actions can be reduced through the implementation of  personnel security controls. According to NIST guidance, personnel  security controls help agencies ensure that individuals occupying  positions of responsibility (including third-party service providers) are  trustworthy and meet established security criteria for these positions.  According to NIST, personnel security controls include, among other  things, that the agency develop a formal personnel security policy and  screen individuals prior to authorizing access to an information system.  EPA’s security policy for personnel screening states that the type of  investigation should be based on the sensitivity of the position and the  level of public trust. According to EPA policy, all system administrative  staff, including contractors, must have an adequate background check.
EPA has conducted the appropriate background investigations for all 14  employees and contractors reviewed. For one system reviewed, we  verified that EPA has a process in place to track whether personnel who  require access to the system have the necessary security clearances.
section_title: EPA Has Not Fully Documented and Implemented Components of Its Information Security Program
paragraphs: A key reason for the weaknesses in controls over EPA’s information and  information systems is that it has not yet fully implemented its agencywide  information security program to ensure that controls were effectively  established and maintained. FISMA requires each agency to develop,  document, and implement an information security program that, among  other things, includes policies and procedures that (1) are based on risk assessments, (2)  cost-effectively reduce risks, (3) ensure that information security is  addressed throughout the life cycle of each system, and (4) ensure  compliance with applicable requirements; plans for providing adequate information security for networks,  facilities, and systems;  security awareness training to inform personnel of information security  risks and their responsibilities in complying with agency policies and  procedures, and information security training for personnel with  significant security responsibilities for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of major  information systems; a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in its information security  policies, procedures, or practices; and plans and procedures to ensure continuity of operations for  information systems that support operations and assets of the agency.
FISMA also requires agencies to maintain and update annually an  inventory of major information systems and the program requirements  that apply to the information and information systems that support the  operations and assets of the agency, including those provided or  managed by another agency, contractor, or other source.
A key element of an effective information security program is to develop,  document, and implement risk-based policies, procedures, and technical  standards that govern the security over an agency’s computing  environment. If properly implemented, policies and procedures should  help reduce the risk that could come from unauthorized access or  disruption of services. Developing, documenting, and implementing  security policies is important because they are the primary mechanisms  by which management communicates its views and requirements; these  policies also serve as the basis for adopting specific procedures and  technical controls. In addition, agencies need to take the actions  necessary to effectively implement or execute these procedures and  controls. Otherwise, agency systems and information will not receive the  protection that the security policies and controls should provide. FISMA  requires agencies to develop and implement policies and procedures that  support an effective information security program.
Although EPA has developed information security policies and  procedures, most of its agencywide requirements were not finalized. For  example, EPA’s agencywide information security policy and its security  assessment and authorization procedure are both interim documents.  While EPA has developed 18 procedures that correspond to NIST’s “18  families of controls,” such as those for access controls, security training,  and contingency planning, 17 of the procedures are still in draft, including  12 that have been in draft since 2008. The Office of Environmental  Information, the organization with the primary responsibility for  implementing EPA’s security program, has also issued its own  information security program manual intended to complement EPA’s  security policy. However, the Office of Environmental Information program  manual has not been revised since 2006 and is not based on the current  EPA interim security policy issued in August 2011.
According to EPA’s Office of Environmental Information web page, the  agency is undertaking an extensive IT/management policy review and  update, but the website does not cite any specific dates for completion.  Until EPA has finalized and implemented its security policies and  procedures, the agency cannot be sure that its information security  requirements are being applied consistently and effectively across the  agency.
An objective of system security planning is to improve the protection of IT  resources. A system security plan provides an overview of the systems’  security requirements and describes the controls that are in place or  planned to meet those requirements. OMB Circular A-130 directs  agencies to develop system security plans for major applications and  general support systems, and to ensure that those plans address policies  and procedures for providing management, operational, and technical  controls.explains that agencies were expected to be in compliance with NIST   In addition, OMB’s fiscal year 2011 FISMA reporting guidance  standards and guidelines within 1 year of publication unless otherwise  directed by OMB.
EPA has developed and documented system security plans, but those  plans have not been updated to reflect current policies and procedures.  For example, all six systems we reviewed referenced expired policies and  procedures. In addition, two of the six plans did not reflect controls  identified in the current NIST Special Publication 800-53. two controls for moderate systems, publically accessible content and  least privilege—allowing only authorized access for users—were not  reflected in system security plans. An EPA official with responsibility for  one of the system’s that had an outdated plan attributed this to the  agency not having a security procedure in place to clearly explain how  updated federal guidance should be implemented. In a fiscal year 2010  report,agency’s system security plans were not current.
EPA’s Inspector General also indentified instances where the  EPA officials informed us that the agency was replacing its current  automated tool for managing security with one that is intended to improve  system security planning, among other activities. Currently in the pilot  stage, the new tool is to provide a built-in system security planning  capability and a central location to store all system security  documentation. However, until EPA updates system security plans and  finalizes security plan procedures, the agency may not have assurance  that controls are being effectively implemented for its systems.
NIST, Special Publication 800-53. complying with agency policies and procedures designed to reduce these  risks. FISMA also includes requirements for training personnel with  significant responsibilities for information security. OMB guidance states  that personnel should be trained before they are granted access to  systems or applications. The training is intended to ensure that personnel  are aware of the system’s or application’s rules, their responsibilities, and  their expected behavior. In addition, EPA interim policy requires annual  security awareness training to be completed by all personnel and those  personnel with significant network security roles and responsibilities to  complete sufficient information system security training and continuing  education to ensure compliance with agency policy.
EPA has implemented a security awareness training program and  maintains training records as part of its e-learning system: users of EPA  systems are required to complete and pass a web-based course.  According to EPA’s fiscal year 2011 FISMA report, the Chief Information  Officer reported that 100 percent of EPA’s employees had completed the  required security awareness training.
EPA also uses its e-learning system to deliver training content for  employees who have significant network and system security roles.  However, for this group of employees, the Chief Information Officer  reported that approximately 81 percent had completed training related to  their specialized security responsibilities. According to EPA officials, the  agency has been unable to enforce the specialized security training  requirement, which has led to reporting a lower percentage. In addition,  officials also noted that formalized standard procedures related to  specialized training are not well documented, including to what extent  employees should complete specialized training and the specific actions  to take if an employee does not complete the training.
To assist with addressing these inconsistencies, the senior agency  Information Security Officer distributed a memorandum to information  security officials that describes the requirement for employees with  significant information security responsibilities. Specifically, EPA has  determined that, at a minimum, all employees with significant security  responsibilities should complete two courses using the e-learning system  or through another mechanism. In addition, EPA sent e-mails to its  information security officers that denote what positions include the  requirement to complete the two-courses. However, EPA’s actions did not  ensure that all employees with significant security responsibilities met this  requirement. Until EPA implements a procedure to enforce the completion  of specialized security training and tailors the training to specific roles, the  agency will not have reasonable assurance that its staff have the  adequate knowledge, skills, and abilities consistent with their roles to  protect the confidentiality of the information housed within EPA systems  to which they are assigned.
Another key element of an information security program is to test and  evaluate policies, procedures, and controls to determine whether they are  effective and operating as intended. This type of oversight is a  fundamental element because it demonstrates management’s  commitment to the security program, reminds employees of their roles  and responsibilities, and identifies and mitigates areas of noncompliance  and ineffectiveness. FISMA requires that the frequency of tests and  evaluations of management, operational, and technical controls be based  on risks and occur no less than annually. OMB directs agencies to meet  their FISMA-required controls testing by drawing on security control  assessment results that include, but are not limited to, continuous  monitoring activities. EPA’s interim security assessment procedure  requires that information system security controls be assessed annually  to meet FISMA’s requirements and to support continuous monitoring.
EPA had documented that management, operational, and technical  controls for five of six systems were tested or reviewed. Assessment  results for five systems consisted of self assessments generated by  EPA’s Automated System Security Evaluation and Remediation Tracking  (ASSERT) tool, used for continuous monitoring, along with vulnerability  assessments for two of the five systems. However, the agency did not  provide any information demonstrating that controls for a clean air  markets division system had been tested or reviewed at least annually.  The last assessment for the system had been completed during fiscal  year 2009. An EPA official stated that testing would be completed during  fiscal year 2012.
We also identified data reliability challenges with EPA’s ASSERT tool.  The data reliability weakness with this tool was previously reported by  EPA’s Inspector General in 2010.in 2011 that the agency had not implemented continuous monitoring   The Inspector General also reported  procedures or a strategy. As a result, EPA has less assurance that  controls over its information and information systems are adequately  implemented and operating as intended.
Remedial action plans, also known as plans of action and milestones  (POA&M), help agencies identify and assess security weaknesses in  information systems, set priorities, and monitor progress in correcting the  weaknesses. NIST and OMB guidance specify steps that federal  agencies should take to address identified security weaknesses.
NIST standards state that organizations must periodically assess  security controls in their information systems and develop and  implement plans of action to correct deficiencies and reduce or  eliminate vulnerabilities.
OMB guidance specifies information that should be recorded for each  POA&M, including a description of the weakness identified, the audit  or other source where it was identified, and key milestones with  completion dates.
NIST guidance also states that POA&Ms should be updated to show  progress made on current outstanding items and to incorporate the  results of the continuous monitoring process.
OMB guidance further states that initial milestone and completion  dates should not be altered; rather, changes to dates should be  recorded in a separate column.
Further, EPA procedure states that any IT security finding and  recommendation that results from a review, audit, assessment, test, or  from another source must be assigned a risk level and assessed for  appropriate action.
EPA uses an automated tool to record and track remediation of  vulnerabilities. This tool contains fields for entering a description of each  weakness, where it was reported, the risk level, milestones describing  appropriate actions and their completion dates, and the status of actions  taken. However, the manner in which the agency uses the tool can  preclude retrieval of specific POA&Ms and pose weaknesses with data  reliability. For example, EPA officials were unable to locate certain  POA&Ms pertaining to findings and recommendations in fiscal year 2011  reports from EPA, the agency’s Inspector General, and GAO. These  officials could not find the requested information because POA&M entries  did not have all the information called for by federal guidance. In  particular, these entries lacked a specific description of each weakness  and did not list the report where the weakness had initially been identified.  Additionally, the tool does not have built-in safeguards to keep individuals  who have access to POA&Ms from altering initial milestone and  completion dates. Since the Chief Information Officer and other agency  officials use POA&M information to track the progress of corrective  actions, inaccurate milestone information could hinder their efforts to  effectively remediate program and system-level IT security weaknesses.
The EPA Inspector General had also documented weaknesses in the  agency’s remediation process. In its fiscal year 2011 FISMA report, the  Inspector General found that EPA does not consistently create POA&Ms  for vulnerabilities and the agency missed remediation deadlines for about  20 percent of the POA&Ms that have been created. Another fiscal year  2011 Inspector General report found that data in the agency’s POA&M  tracking tool is unreliable, and that EPA lacked the skills and resources  needed to identify and remediate ongoing cyber threats.
EPA officials noted that deficiencies in the way that the current tool is  used are expected to be addressed when the new remediation tool is  deployed agencywide in fiscal year 2013. Until weaknesses with EPA’s  remediation of vulnerabilities have been resolved, they will compromise  the ability of the Chief Information Officer and other EPA officials to track,  assess, and report accurately the status of the agency’s information  security.
Contingency planning is a critical component of information protection. If  normal operations are interrupted, network managers must be able to  detect, mitigate, and recover from a service disruption while preserving  access to vital information. Contingency plans detail emergency  response, backup operations, and disaster recovery for information  systems. To mitigate service disruptions, these plans should be clearly  documented, communicated to potentially affected staff, updated to  reflect current operations, and regularly tested. FISMA, a NIST Special  Publication, and EPA procedures specify requirements and guidelines for  contingency planning.
FISMA requires each agency to develop, document, and implement  plans and procedures to ensure continuity of operations for  information systems that support the agency’s operations and assets.
NIST guidance states that contingency plans for information systems   In addition, the plans should account for  be developed and tested. primary and alternate contact methods and should discuss  procedures to be followed if an individual cannot be contacted.
EPA procedures further specify that the plans must be reviewed,  tested, and updated at least annually.
EPA has taken steps to implement FISMA requirements and NIST  specifications but has not fully met them. Contingency plans were in place  for five of the six systems we reviewed. The contingency needs for the  one remaining system were addressed in disaster recovery plans.  However, the agency did not follow its own procedures or NIST guidance  for approving contingency plans, reviewing them annually, and updating  them as necessary. All six of the plans lacked evidence that they had  been signed by the approving officials. According to EPA, an approving  official does not need to sign a contingency plan because the plan is  included in each system’s certification and authorization package and  approval of the package applies to all documents within it. The agency  provided documentation indicating that system security plans were part of  certification and authorization packages, and two systems had  contingency plans embedded in their respective system security plans.  However, EPA did not provide clear evidence that contingency plans  were included in certification and authorization packages for the other  four systems. In addition, two of the six plans had no evidence of having  had an annual review. Without clear dates for initial approvals and  subsequent reviews, EPA employees and contractors cannot be certain  that they have access to current, updated versions of contingency plans.
In addition to providing current information, plans are to provide adequate  contact information on personnel who may be needed during an  emergency. For example, the National Computer Center Hosting Systems  contingency plan states that personal contact information should include  home addresses, cell phone numbers, pager numbers, and alternate  contact information. Among the six plans reviewed, five did not provide  full contact information for some staff listed, giving only office telephone  numbers and e-mail addresses or, in some cases, office numbers alone.  Having inadequate information could jeopardize the agency’s ability to  contact key personnel during an emergency.
To help ensure that contingency plans are viable and will meet an  agency’s needs during an emergency, these plans should be tested at  least annually. While EPA provided evidence that it had tested three of  the six plans in 2011, it did not provide the requested test results for the  other three plans.
The EPA Inspector General has also noted deficiencies with the agency’s  contingency planning. In reports from fiscal years 2009 through 2011, the  Inspector General described plans that lacked approval, were out of date,  did not have a record of changes, and did not have evidence that  contingency plans had been tested annually.
Until EPA addresses identified weaknesses in its contingency planning  processes, the agency will have less assurance that it can recover  important systems in a timely manner when disruptions occur.
FISMA requires agencies to maintain and update annually an inventory of  major information systems operated by the agency or operated by others  on its behalf, such as those operated by a contractor or other third party.  For their fiscal year 2011 FISMA reports, agencies were required to report  the number of agency and contractor systems by impact levels.fiscal year 2011, EPA reported a total of 129 systems, composed of 117  agency and 12 contractor systems, as shown by impact level in table 3.  This represents a slight decrease in the total number of systems from   For  fiscal year 2010, with the number of agency systems remaining the same  and the number of contractor systems decreasing.
EPA did not ensure that its inventory of information systems was  accurate. For example, the total number of systems in inventories  provided by EPA on August 5, 2011, and September 26, 2011, did not  equal each other or equal the number of systems in the agency’s fiscal  year 2011 FISMA report. Specifically, the initial inventory provided listed  59 general support systems and 85 major applications for a total of 144  systems, but a subsequent list reflected 47 general support systems and  85 major applications, for a total of 132 systems. Within that same time,  the agency provided another listing that consisted of only general support  systems; that list identified 57 general support systems, a number that did  not equal the totals on either of the two inventories.
EPA also provided three lists of systems that the agency had determined  contained or processed confidential business information, and all three  lists differed in the number of systems identified, totaling 19, 21, and 24  systems. One system on the third list was not included on either of the  first two inventories provided by EPA. Furthermore, three systems were  erroneously listed twice, with minor variations of the spelling of the  system names as the distinguishing information between the duplicate  entries. These errors could be due to inadvertent data entry errors, as the  agency places responsibility on individual information security officers to  update the central systems inventory that is maintained in its ASSERT  tool. The agency’s Inspector General has previously identified issues with  the quality of system-related information entered into the tool.
As a result, senior management has reduced assurance that the  inventory accurately represents the number of EPA systems cited in its  annual FISMA reporting and reduced assurance that agency information  systems have been accounted for properly.
section_title: Conclusions
paragraphs: Although EPA has implemented numerous controls and procedures  intended to protect key information and information systems, control  weaknesses continue to jeopardize the confidentiality, integrity, and  availability of its sensitive information. The agency has established a  framework for its information security program and taken actions toward  developing, documenting, and implementing the components of its  program. However, there are weaknesses in access controls and other  information security controls over EPA’s systems. Additionally, some  control deficiencies are longstanding, having been identified in past  reports by the EPA Inspector General. These shortcomings will likely  persist until EPA (1) addresses weaknesses such as those for  identification and authentication, authorization, cryptography, audit and  monitoring, physical security, and configuration management and (2) fully  implements key components of a comprehensive information security  program that ensures that policies and procedures are completed and  effectively implemented; security plans are updated to reflect current  federal and agency requirements; remedial actions are effectively  managed for all weaknesses; and management, operational, and  technical controls for all systems are tested and evaluated at least  annually. However, until EPA fully implements these controls, it will have  limited assurance that its information and information systems are being  adequately protected against unauthorized access, disclosure,  modification, and loss.
section_title: Recommendations for Executive Action
paragraphs: To help establish an effective and comprehensive information security  program for EPA’s information and information systems, we recommend  that the Administrator of EPA direct the Assistant Administrator for the  Office of Environmental Information to take the following 12 actions:
Update configuration management procedures to ensure they include  guidance for documenting records of approved changes.
Finalize the 17 agencywide interim information security policies and  draft procedures.
Update system security plans to reflect current policies and  procedures.
Include current NIST Special Publication 800-53 guidance in system  security plans.
Develop and finalize a role-based security training procedure that  tailors specific training requirements to EPA users’ role/position  descriptions and details the actions information security officers must  take when users do not complete the training.
Conduct testing of management, operational, and technical controls,  based on risks, to occur no less than annually, for the clean air  markets division system identified.  Include features in the planned remedial action tracking tool that will  require users to enter all information required by OMB policy,  including descriptions of each weakness and the source of the finding.  Include features in the planned remedial action tracking tool that block  inappropriate alteration of data.  Implement an agencywide, uniform method for approving contingency  plans.
Develop and implement procedures to annually test the viability of  contingency plans for agency systems.
Develop and implement procedures to ensure that both work and  home contact information are included for each individual in a  contingency plan’s emergency contact list.  Implement procedures to verify the accuracy of system inventory  information.
In a separate report with limited distribution, we are also making 94  detailed recommendations to correct weaknesses in access controls and  in other information security controls.
section_title: Agency Comments and Our Evaluation
paragraphs: In providing written comments on a draft of this report (reprinted in app.  II), EPA’s Assistant Administrator stated that the agency’s response  reflected its continued efforts to ensure that information assets are  protected and secured in a manner consistent with the risk and  magnitude of the harm resulting from loss, misuse, or unauthorized  access to or modification of information. The Assistant Administrator also  indicated that the agency agreed with 10 of our 12 draft  recommendations, and partially agreed with the other 2  recommendations, as discussed below.
EPA agreed with implementing our recommendation to implement an  agencywide method for approving contingency plans, but did not  agree with requiring the approving officials’ signature and date to be  on the document. The agency stated that a centralized repository for  managing all security documents would be the more appropriate  mechanism for ensuring plans are the most recent official versions.  We believe this alternative action meets the intent of our draft  recommendation and have modified our recommendation accordingly.
For the second recommendation, EPA agreed to implement a uniform  method for recording annual contingency plan testing, but did not  agree to keep records of contingency plan testing within the  contingency plans. The intent of our draft recommendation was to  ensure that EPA implements procedures to test contingency plans at  least annually. Accordingly, we have clarified our recommendation to  emphasize this point.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution of it until 30 days from  the date of this letter. At that time, we will send copies to interested  congressional committees and to the Administrator of the Environmental  Protection Agency. In addition, the report will be available at no charge on  the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov or Dr.  Nabajyoti Barkakati at (202) 512-4499 or barkakatin@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. Key contributors to this report are  listed in appendix III.
section_title: Appendix I: Objective, Scope, and Methodology
paragraphs: The objective of our review was to determine whether the Environmental  Protection Agency (EPA) had effectively implemented appropriate  information security controls to protect the confidentiality, integrity, and  availability of the information and systems that support its mission.
To determine the effectiveness of EPA’s security controls, we gained an  understanding of the overall network control environment, identified  interconnectivity and control points, and examined controls for the  agency’s networks and facilities. Specifically, we reviewed controls over  EPA’s network infrastructure and systems that support EPA’s business  functions of air, land, and water quality management and process or  contain confidential business information. We performed our work at  EPA’s National Computer Center in Research Triangle Park, North  Carolina; Potomac Yard Data Center in Arlington, Virginia; and at EPA  headquarters in Washington, D.C. We selected these sites to maximize  audit coverage while limiting travel costs, since the majority of EPA  systems and applications are supported or maintained in these locations.
We used GAO’s Federal Information System Controls Audit Manual,  which contains guidance for reviewing information system controls that  affect the confidentiality, integrity, and availability of computerized  information; National Institute of Standards and Technology (NIST)  standards and guidance; and EPA’s policies, procedures, practices, and  standards to evaluate the agency’s controls over its information systems.  Specifically, we  reviewed network access paths to determine if boundaries had been  adequately protected;  reviewed the complexity and expiration of password settings to  determine if password management was being enforced; analyzed users’ system authorizations to determine whether they had  more permissions than necessary to perform their assigned functions; observed methods for providing secure data transmissions across the  network to determine whether sensitive data were being encrypted;  reviewed software security settings to determine if modifications of  sensitive or critical system resources had been monitored and logged; observed physical access controls to determine if computer facilities  and resources were being protected from espionage, sabotage,  damage, and theft; examined configuration settings and access controls for routers,  network management servers, switches, and firewalls;  inspected key servers and workstations to determine if critical patches  had been installed and/or were up-to-date;  reviewed media handling procedures to determine if equipment used  for clearing sensitive data had been tested to ensure correct  performance; and  reviewed personnel clearance procedures to determine whether staff  had been properly cleared prior to gaining access to sensitive  information or information systems.
Using the requirements identified by the Federal Information Security  Management Act of 2002 (FISMA), which establishes key elements for an  effective agencywide information security program, and associated NIST  guidelines and EPA requirements, we evaluated EPA systems and  networks by analyzing EPA policies, procedures, practices, and standards to  determine their effectiveness in providing guidance to personnel  responsible for securing information and information systems; analyzed security plans for six systems to determine if those plans  had been documented and updated according to federal guidance; examined the security awareness training process for employees and  contractors to determine whether they had received training according  to federal requirements; examined training records for personnel who have significant  responsibilities to determine whether they had received training  commensurate with those responsibilities; analyzed EPA’s procedures and results for testing and evaluating  security controls to determine whether management, operational, and  technical controls for six systems had been sufficiently tested at least  annually and based on risk;  reviewed EPA’s implementation of continuous monitoring and use of  automated tools to determine the extent to which it uses these tools to  manage IT assets and monitor the security configurations and  vulnerabilities for its IT assets; evaluated EPA’s process to correct weaknesses and determine  whether remedial action plans complied with federal guidance; and examined contingency plans for six systems to determine whether  those plans had been developed and tested.
We also discussed with key security representatives and management  officials whether information security controls were in place, adequately  designed, and operating effectively.
To determine the reliability of EPA’s computer-processed data, we  performed an assessment. We evaluated the materiality of the data to our  audit objectives and assessed the data by various means, including  reviewing related documents, interviewing knowledgeable agency  officials, and reviewing internal controls. Through a combination of  methods, we concluded that the data were sufficiently reliable for the  purposes of our work.
We conducted this performance audit from July 2011 to July 2012 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objective. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objective.
section_title: Appendix II: Comments from the Environmental Protection Agency
section_title: Appendix III: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the individuals named above, the following made key  contributions to this report: West Coile, Anjalique Lawrence, Duc Ngo,  and Chris Warweg, (assistant directors); Gary Austin; Angela Bell; Larry  Crosland; Saar Dagani; Kirk Daubenspeck; Nancy Glover; Kevin  Metcalfe; Mary Marshall; Sean Mays; Dana Pon; Jason Porter, Sr.; and  Eugene Stevens.