Information Security: Agencies Continue to Report Progress, but Need to Mitigate Persistent Weaknesses
Published: 2009-07-17T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: For many years, GAO has reported that weaknesses in information security are a widespread problem that can have serious consequences--such as intrusions by malicious users, compromised networks, and the theft of intellectual property and personally identifiable information--and has identified information security as a governmentwide high-risk issue since 1997. Concerned by reports of significant vulnerabilities in federal computer systems, Congress passed the Federal Information Security Management Act of 2002 (FISMA), which authorized and strengthened information security program, evaluation, and reporting requirements for federal agencies. In accordance with the FISMA requirement that the Comptroller General report periodically to Congress, GAO's objectives were to evaluate (1) the adequacy and effectiveness of agencies' information security policies and practices and (2) federal agencies' implementation of FISMA requirements. To address these objectives, GAO analyzed agency, inspectors general, Office of Management and Budget (OMB), and GAO reports.
section_title: What GAO Found
paragraphs: Persistent weaknesses in information security policies and practices continue to threaten the confidentiality, integrity, and availability of critical information and information systems used to support the operations, assets, and personnel of most federal agencies. Recently reported incidents at federal agencies have placed sensitive data at risk, including the theft, loss, or improper disclosure of personally identifiable information of Americans, thereby exposing them to loss of privacy and identity theft. For fiscal year 2008, almost all 24 major federal agencies had weaknesses in information security controls. An underlying reason for these weaknesses is that agencies have not fully implemented their information security programs. As a result, agencies have limited assurance that controls are in place and operating as intended to protect their information resources, thereby leaving them vulnerable to attack or compromise. In prior reports, GAO has made hundreds of recommendations to agencies for actions necessary to resolve prior significant control deficiencies and information security program shortfalls. Federal agencies reported increased compliance in implementing key information security control activities for fiscal year 2008; however, inspectors general at several agencies noted shortcomings with agencies' implementation of information security requirements. Agencies reported increased implementation of control activities, such as providing awareness training for employees and testing system contingency plans. However, agencies reported decreased levels of testing security controls and training for employees who have significant security responsibilities. In addition, inspectors general at several agencies disagreed with performance reported by their agencies and identified weaknesses in the processes used to implement these activities. Further, although OMB took steps to clarify its reporting instructions to agencies for preparing fiscal year 2008 reports, the instructions did not request inspectors general to report on agencies' effectiveness of key activities and did not always provide clear guidance to inspectors general. As a result, the reporting may not adequately reflect agencies' implementation of the required information security policies and procedures.

section_title: Letter
paragraphs: Information security is a critical consideration for any organization that  depends on information systems and computer networks to carry out its  mission or business. It is especially important for government agencies,  where the public’s trust is essential. The need for a vigilant approach to  information security is demonstrated by the increase in reports of security  incidents, the wide availability of hacking tools, and steady advances in  the sophistication and effectiveness of attack technology.
Over the past few years, 24 major federal agencies have reported  numerous security incidents in which sensitive information has been lost  or stolen, including personally identifiable information, which has exposed  millions of Americans to a loss of privacy, identity theft, and other  financial crimes. Since 1997, we have identified information security as a  governmentwide high-risk issue in our biennial reports to Congress.
Concerned by reports of significant weaknesses in federal computer  systems, Congress passed the Federal Information Security Management  Act (FISMA) of 2002, which requires agencies to develop and implement  an information security program, evaluation processes, and annual  reporting. FISMA requires mandated annual reports by federal agencies,  the Office of Management and Budget (OMB), and the National Institute of  Standards and Technology (NIST). FISMA also includes a requirement for  independent annual evaluations by the agencies’ inspectors general or  independent external auditors.
In accordance with the FISMA requirement that we report periodically to  Congress, our objectives were to evaluate (1) the adequacy and  effectiveness of agencies’ information security policies and practices and  (2) federal agencies’ implementation of FISMA requirements. To  accomplish these objectives, we analyzed agency, inspector general, OMB,  and our reports on information security. Where possible, we categorized  findings from those reports into areas defined by FISMA and the Federal  Information System Controls Audit Manual. We did not include systems  categorized as national security systems in our review, nor did we review  the adequacy or effectiveness of the security policies and practices for  those systems.
We conducted this performance audit from December 2008 to May 2009 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives. For more details on our objectives, scope,  and methodology, see appendix I.
subsections: section_title: Background
paragraphs: Without proper safeguards, computer systems are vulnerable to  individuals and groups with malicious intentions who can intrude and use  their access to obtain and manipulate sensitive information, commit fraud,  disrupt operations, or launch attacks against other computer systems and  networks. The risks to federal systems are well-founded for a number of  reasons, including the dramatic increase in reports of security incidents,  the ease of obtaining and using hacking tools, and steady advances in the  sophistication and effectiveness of attack technology.
Recognizing the importance of securing federal systems and data,  Congress passed FISMA in 2002. The act sets forth a comprehensive  framework for ensuring the effectiveness of information security controls  over information resources that support federal operations and assets.  FISMA’s framework creates a cycle of risk management activities  necessary for an effective security program; these activities are similar to  the principles noted in our study of the risk management activities of  leading private-sector organizations—assessing risk, establishing a  central management focal point, implementing appropriate policies and  procedures, promoting awareness, and monitoring and evaluating policy  and control effectiveness. In order to ensure the implementation of this  framework, the act assigns specific responsibilities to agency heads, chief  information officers, inspectors general, and NIST. It also assigns  responsibilities to OMB that include developing and overseeing the  implementation of policies, principles, standards, and guidelines on  information security, and reviewing agency information security programs,  at least annually, and approving or disapproving them.
FISMA requires each agency, including agencies with national security  systems, to develop, document, and implement an agencywide information  security program to provide security for the information and information  systems that support the operations and assets of the agency, including  those provided or managed by another agency, contractor, or other  source.
Specifically, FISMA requires information security programs to include,  among other things:    periodic assessments of the risk and magnitude of harm that could result  from the unauthorized access, use, disclosure, disruption, modification, or  destruction of information or information systems; risk-based policies and procedures that cost-effectively reduce  information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of each  information system;   subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems, as  appropriate;   security awareness training for agency personnel, including contractors  and other users of information systems that support the operations and  assets of the agency;   periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, performed with a frequency depending  on risk, but no less than annually, and that includes testing of  management, operational, and technical controls for every system  identified in the agency’s required inventory of major information systems;   a process for planning, implementing, evaluating, and documenting  remedial actions to address any deficiencies in the information security  policies, procedures, and practices of the agency;   procedures for detecting, reporting, and responding to security incidents;    plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency.
In addition, agencies must produce an annually updated inventory of  major information systems (including major national security systems)  operated by the agency or under its control, which includes an  identification of the interfaces between each system and all other systems  or networks, including those not operated by or under the control of the  agency.
FISMA also requires each agency to report annually to OMB, selected  congressional committees, and the Comptroller General on the adequacy  of its information security policies, procedures, practices, and compliance  with requirements. In addition, agency heads are required to report  annually the results of their independent evaluations to OMB, except to  the extent that an evaluation pertains to a national security system; then  only a summary and assessment of that portion of the evaluation needs to  be reported to OMB.
Under FISMA, NIST is tasked with developing, for systems other than  national security systems, standards and guidelines that must include, at a  minimum (1) standards to be used by all agencies to categorize all their  information and information systems based on the objectives of providing  appropriate levels of information security, according to a range of risk  levels; (2) guidelines recommending the types of information and  information systems to be included in each category; and (3) minimum  information security requirements for information and information  systems in each category. NIST must also develop a definition of and  guidelines for detection and handling of information security incidents as  well as guidelines developed in conjunction with the Department of  Defense and the National Security Agency for identifying an information  system as a national security system.
The law also assigns other information security functions to NIST,  including:    providing technical assistance to agencies on elements such as compliance  with the standards and guidelines and the detection and handling of  information security incidents;   evaluating private-sector information security policies and practices and  commercially available information technologies to assess potential  application by agencies;   evaluating security policies and practices developed for national security  systems to assess their potential application by agencies; and    conducting research, as needed, to determine the nature and extent of  information security vulnerabilities and techniques for providing cost- effective information security.
As required by FISMA, NIST has prepared its annual public report on  activities undertaken in the previous year and planned for the coming  year. In addition, NIST’s FISMA initiative supports the development of a  program for credentialing public and private sector organizations to  provide security assessment services for federal agencies.
Under FISMA, the inspector general for each agency shall perform an  independent annual evaluation of the agency’s information security  program and practices. The evaluation should include testing of the  effectiveness of information security policies, procedures, and practices of  a representative subset of agency systems. In addition, the evaluation must  include an assessment of the compliance with the act and any related  information security policies, procedures, standards, and guidelines. For  agencies without an inspector general, evaluations of non-national security  systems must be performed by an independent external auditor.  Evaluations related to national security systems are to be performed by an  entity designated by the agency head.
FISMA states that the Director of OMB shall oversee agency information  security policies and practices, including:    developing and overseeing the implementation of policies, principles,  standards, and guidelines on information security; requiring agencies to identify and provide information security protections  commensurate with risk and magnitude of the harm resulting from the  unauthorized access, use, disclosure, disruption, modification, or  destruction of information collected or maintained by or on behalf of an  agency, or information systems used or operated by an agency, or by a  contractor of an agency, or other organization on behalf of an agency;   overseeing agency compliance with FISMA to enforce accountability; and  reviewing at least annually, and approving or disapproving, agency  information security programs.
In addition, the act requires that OMB report to Congress no later than  March 1 of each year on agency compliance with FISMA.
section_title: Weaknesses in Information Security Place Sensitive Information at Risk
paragraphs: Significant weaknesses in information security policies and practices  threaten the confidentiality, integrity, and availability of critical  information and information systems used to support the operations,  assets, and personnel of most federal agencies. These persistent  weaknesses expose sensitive data to significant risk, as illustrated by  recent incidents at various agencies. Further, our work and reviews by  inspectors general note significant information security control  deficiencies that place a broad array of federal operations and assets at  risk. Consequently, we have made hundreds of recommendations to  agencies to address these security control deficiencies.
subsections: section_title: Reported Incidents Are on the Rise and Place Sensitive Information at Risk
paragraphs: Since our report in July 2007, federal agencies have reported a spate of  security incidents that have put sensitive data at risk, thereby exposing the  personal information of millions of Americans to the loss of privacy and  potential harm associated with identity theft. Agencies have experienced a  wide range of incidents involving data loss or theft, computer intrusions,  and privacy breaches, underscoring the need for improved security  practices. The following examples, reported in 2008 and 2009, illustrate  that a broad array of federal information and assets remain at risk.
In May 2009, the Department of Transportation Inspector General issued  the results of an audit of Web applications security and intrusion detection  in air traffic control systems at the Federal Aviation Administration (FAA).  The inspector general reported that Web applications used in supporting  air traffic control systems operations were not properly secured to prevent  attacks or unauthorized access. To illustrate, vulnerabilities found in Web  application computers associated with the Traffic Flow Management  Infrastructure System, Juneau Aviation Weather System, and the  Albuquerque Air Traffic Control Tower allowed audit staff to gain  unauthorized access to data stored on these computers, including program  source code and sensitive personally identifiable information. In addition,  the inspector general reported that it found a vulnerability on FAA Web  applications that could allow attackers to execute malicious codes on FAA  users’ computers, which was similar to an actual incident that occurred in  August 2008. In February 2009, the FAA notified employees that an agency  computer had been illegally accessed and employee personal identity  information had been stolen electronically. Two of the 48 files on the  breached computer server contained personal information about more  than 45,000 FAA employees and retirees who were on the FAA payrolls as  of the first week of February 2006. Law enforcement agencies were  notified and are investigating the data theft.
In March 2009, U.S. Congressman Jason Altmire and U.S. Senator Bob  Casey announced that that they had sent a letter to the Under Secretary of  Defense for Acquisition, Technology, and Logistics, asking for additional  information on a recent security breach of the presidential helicopter,  Marine One. According to the announcement, in February 2009, a company  based in Cranberry, Pennsylvania, discovered that engineering and  communications documents containing key details about the Marine One  fleet had been downloaded to an Internet Protocol (IP) address in Iran.  The documents were traced back to a defense contractor in Maryland,  where an employee most likely downloaded a file-sharing program that  inadvertently allowed others to access this information. According to  information from the Congressman’s Web site, recent reports have said  that the federal government was warned last June that an Internet Web  site with an IP address traced to Iran was actively seeking this  information.
In March 2009, the United States Computer Emergency Readiness Team  (US-CERT) issued an updated notice to warn agencies and organizations  of the Conficker/Downadup worm activity and to help prevent further  compromises from occurring. In the notice, US-CERT warned that the  Conficker/Downadup worm could infect a Microsoft Windows system  from a thumb drive, a network share, or directly across a network if the  host is not patched.
According to a March 2009 media release from Senator Bill Nelson’s office,  cyber-invaders thought to be in China hacked into the computer network  in Senator Nelson’s office. There were two attacks on the same day in  March 2009, and another one in February 2009 that targeted work stations  used by three of Senator Nelson’s staffers. The hackers were not able to  take any classified information because that information is not kept on  office computers, a spokesman said. The media release stated that similar  incursions into computer networks in Congress were up significantly in  the past few months.
The Department of Energy’s Office of Health, Safety, and Security  announced that a password-protected compact disk (CD) had been lost  during a routine shipment on January 28, 2009. The CD contained  personally identifiable information for 59,617 individuals who currently  work or formerly worked at facilities at the Department of Energy’s Idaho  site. The investigation verified that protection measures had been applied  in accordance with requirements applicable to organizations working  under cooperative agreements and surmised that while the CD had been  lost for 8 weeks at the time of the investigation, no evidence had been  found that revealed that the personal information on the lost disk had  been compromised. The investigation concluded that OMB and  Department of Energy requirements for managing and reporting the loss of  the information had not been transmitted to the appropriate organizations  and that there was a failure to provide timely notifications of the actual or  suspected loss of information in this incident.
In January 2009, the Program Director of the Office of Personnel and  Management’s USAJOBS Web site announced that their technology  provider’s (Monster.com) database had been illegally accessed and  contact and account data had been taken, including user IDs and  passwords, e-mail addresses, names, phone numbers, and some basic  demographic data. The director pointed out that e-mail could be used for  phishing activity and advised users to change their site login password.
In December 2008, the Federal Emergency Management Administration  was alerted to an unauthorized breach of private information when an  applicant notified it that his personal information pertaining to Hurricane  Katrina had been posted on the Internet. The information posted to Web  sites contained a spreadsheet with 16,857 lines of data that included  applicant names, social security numbers, addresses, telephone numbers,  e-mail addresses, and other information on disaster applicants who had  evacuated to Texas. According to the Federal Emergency Management  Administration, it took action to work with the Web site hosting the  private information, and have that information removed from public view.  Additionally, the agency reported that it worked to remove the same  information from a second Web site. Further, the agency stated that while  it believed most of the applicant information posted on the Web sites were  properly released by them to a state agency, it did not authorize the  subsequent public posting of much of this data.
In June 2008, the Walter Reed Army Medical Center reported that officials  were investigating the possible disclosure of personally identifiable  information through unauthorized sharing of a data file containing the  names of approximately 1,000 Military Health System beneficiaries. Walter  Reed officials were notified of the possible exposure on May 21 by an  outside company. Preliminary results of an ongoing investigation  identified a computer from which the data had apparently been  compromised. Data security personnel from Walter Reed and the  Department of the Army think it is possible that individuals named in the  file could become victims of identity theft. The compromised data file did  not include protected health information such as medical records,  diagnosis, or prognosis for patients.
In March 2008, media reports surfaced noting that the passport files of  three U.S. senators, who were also presidential candidates, had been  improperly accessed by Department of State employees and contractor  staff. As of April 2008, the system contained records on about 192 million  passports for about 127 million passport holders. These records included  personally identifiable information, such as the applicant’s name, gender,  social security number, date and place of birth, and passport number. In  July 2008, after investigating this incident, the Department of State’s Office  of Inspector General reported many control weaknesses—including a  general lack of policies, procedures, guidance, and training—relating to  the prevention and detection of unauthorized access to passport and  applicant information and the subsequent response and disciplinary  processes when a potential unauthorized access is substantiated.
When incidents occur, agencies are to notify the federal information  security incident center—US-CERT. As shown in figure 1, the number of  incidents reported by federal agencies to US-CERT has risen dramatically  over the past 3 years, increasing from 5,503 incidents reported in fiscal  year 2006 to 16,843 incidents in fiscal year 2008 (slightly more than 200  percent).
Agencies report the following types of incidents based on US-CERT- defined categories:    Unauthorized access: Gaining logical or physical access without  permission to a federal agency’s network, system, application, data, or  other resource.
Denial of service: Preventing or impairing the normal authorized  functionality of networks, systems, or applications by exhausting  resources. This activity includes being the victim of or participating in a  denial of service attack.
Malicious code: Installing malicious software (e.g., virus, worm, Trojan  horse, or other code-based malicious entity) that infects an operating  system or application. Agencies are not required to report malicious logic  that has been successfully quarantined by antivirus software.
Improper usage: Violating acceptable computing use policies.
Scans/probes/attempted access: Accessing or identifying a federal  agency computer, open ports, protocols, service, or any combination of  these for later exploit. This activity does not directly result in a  compromise or denial of service.
Under investigation: Investigating unconfirmed incidents that are  potentially malicious, or anomalous activity deemed by the reporting  entity to warrant further review.
As noted in figure 2, the three most prevalent types of incidents reported  to US-CERT during fiscal years 2006 through 2008 were unauthorized  access, improper usage, and investigation (see fig. 2).
section_title: Weaknesses in Controls Highlight Deficiencies in the Implementation of Security Policies and Practices
paragraphs: Reviews at federal agencies continue to highlight deficiencies in their  implementation of security policies and procedures. In their fiscal year  2008 performance and accountability reports, 20 of the 24 agencies  indicated that inadequate information security controls were either a  material weakness or a significant deficiency (see fig. 3).
Similarly, in annual reports required under 31 U.S.C. § 3512 (commonly  referred to as the Federal Managers’ Financial Integrity Act of 1982), 11  of 24 agencies identified material weaknesses in information security.  Inspectors general have also noted weaknesses in information security,  with 22 of 24 identifying it as a “major management challenge” for their  agency.
Similarly, our audits have identified control deficiencies in both financial  and nonfinancial systems, including vulnerabilities in critical federal  systems. For example:  In 2009, we reported that security weaknesses at the Securities and  Exchange Commission continued to jeopardize the confidentiality,  integrity, and availability of the commission’s financial and sensitive  information and information systems. Although the commission had made  progress in correcting previously reported information security control  weaknesses, it had not completed action to correct 16 weaknesses. In  addition, we identified 23 new weaknesses in controls intended to restrict  access to data and systems. Thus, the commission had not fully  implemented effective controls to prevent, limit, or detect unauthorized  access to computing resources. For example, it had not always (1)  consistently enforced strong controls for identifying and authenticating  users, (2) sufficiently restricted user access to systems, (3) encrypted  network services, (4) audited and monitored security-relevant events for  its databases, and (5) physically protected its computer resources. The  Securities and Exchange Commission also had not consistently ensured  appropriate segregation of incompatible duties or adequately managed the  configuration of its financial information systems. As a result, the  Securities and Exchange Commission was at increased risk of  unauthorized access to and disclosure, modification, or destruction of its  financial information, as well as inadvertent or deliberate disruption of its  financial systems, operations, and services. The Securities and Exchange  Commission agreed with our recommendations and stated that it plans to  address the identified weaknesses.
In 2009, we reported that the Internal Revenue Service had made progress  toward correcting prior information security weaknesses, but continued to  have weaknesses that could jeopardize the confidentiality, integrity, and  availability of financial and sensitive taxpayer information. These  deficiencies included some related to controls that are intended to  prevent, limit, and detect unauthorized access to computing resources,  programs, information, and facilities, as well as a control important in  mitigating software vulnerability risks. For example, the agency continued  to, among other things, allow sensitive information, including IDs and  passwords for mission-critical applications, to be readily available to any  user on its internal network and to grant excessive access to individuals  who do not need it. In addition, the Internal Revenue Service had systems  running unsupported software that could not be patched against known  vulnerabilities. Until those weaknesses are corrected, the Internal Revenue  Service remains vulnerable to insider threats and is at increased risk of  unauthorized access to and disclosure, modification, or destruction of  financial and taxpayer information, as well as inadvertent or deliberate  disruption of system operations and services. The IRS agreed to develop a  plan addressing each of our recommendations.
In 2008, we reported that although the Los Alamos National Laboratory— one of the nation’s weapons laboratories—implemented measures to  enhance the information security of its unclassified network,  vulnerabilities continued to exist in several critical areas, including   (1) identifying and authenticating users of the network, (2) encrypting  sensitive information, (3) monitoring and auditing compliance with  security policies, (4) controlling and documenting changes to a computer  system’s hardware and software, and (5) restricting physical access to  computing resources. As a result, sensitive information on the network— including unclassified controlled nuclear information, naval nuclear  propulsion information, export control information, and personally  identifiable information—were exposed to an unnecessary risk of  compromise. Moreover, the risk was heightened because about 300 (or 44  percent) of 688 foreign nationals who had access to the unclassified  network as of May 2008 were from countries classified as sensitive by the  Department of Energy, such as China, India, and Russia. While the  organization did not specifically comment on our recommendations, it  agreed with the conclusions.
In 2008, we reported that the Tennessee Valley Authority had not fully  implemented appropriate security practices to secure the control systems  used to operate its critical infrastructures at facilities we reviewed.  Multiple weaknesses within the Tennessee Valley Authority corporate  network left it vulnerable to potential compromise of the confidentiality,  integrity, and availability of network devices and the information  transmitted by the network. For example, almost all of the workstations  and servers that we examined on the corporate network lacked key  security patches or had inadequate security settings. Furthermore,  Tennessee Valley Authority had not adequately secured its control system  networks and devices on these networks, leaving the control systems  vulnerable to disruption by unauthorized individuals. In addition, we  reported that the network interconnections provided opportunities for  weaknesses on one network to potentially affect systems on other  networks. Specifically, weaknesses in the separation of network segments  could allow an individual who had gained access to a computing device  connected to a less secure portion of the network to be able to  compromise systems in a more secure portion of the network, such as the  control systems. As a result, Tennessee Valley Authority’s control systems  were at increased risk of unauthorized modification or disruption by both  internal and external threats and could affect its ability to properly  generate and deliver electricity. The Tennessee Valley Authority agreed  with our recommendations and provided information on steps it was  taking to implement them.
In 2007, we reported that the Department of Homeland Security had  significant weaknesses in computer security controls surrounding the  information systems used to support its U.S. Visitor and Immigrant Status  Technology (US-VISIT) program for border security. For example, it had  not implemented controls to effectively prevent, limit, and detect access to  computer networks, systems, and information. Specifically, it had not   (1) adequately identified and authenticated users in systems supporting  US-VISIT; (2) sufficiently limited access to US-VISIT information and  information systems; (3) ensured that controls adequately protected  external and internal network boundaries; (4) effectively implemented  physical security at several locations; (5) consistently encrypted sensitive  data traversing the communication network; and (6) provided adequate  logging or user accountability for the mainframe, workstations, or servers.  In addition, it had not always ensured that responsibilities for systems  development and system production had been sufficiently segregated and  had not consistently maintained secure configurations on the application  servers and workstations at a key data center and ports of entry. As a  result, increased risk existed that unauthorized individuals could read,  copy, delete, add, and modify sensitive information—including personally  identifiable information—and disrupt service on Customs and Border  Protection systems supporting the US-VISIT program. The department  stated that it directed Customs and Border Protection to complete  remediation activities to address each of our recommendations.
section_title: Weaknesses Persist in All Major Categories of Controls
paragraphs: According to our reports and those of agency inspectors general,  persistent weaknesses appear in the five major categories of information  system controls: (1) access controls, which ensure that only authorized  individuals can read, alter, or delete data; (2) configuration management  controls, which provide assurance that only authorized software programs  are implemented; (3) segregation of duties, which reduces the risk that  one individual can independently perform inappropriate actions without  detection; (4) continuity of operations planning, which provides for the  prevention of significant disruptions of computer-dependent operations;  and (5) an agencywide information security program, which provides the  framework for ensuring that risks are understood and that effective  controls are selected and properly implemented. Most agencies continue  to have weaknesses in each of these categories, as shown in figure 4.
Agencies use access controls to limit, prevent, or detect inappropriate  access to computer resources (data, equipment, and facilities), thereby  protecting them from unauthorized use, modification, disclosure, and loss.  Such controls include both electronic and physical controls. Electronic  access controls include those related to boundary protection, user  identification and authentication, authorization, cryptography, and  auditing and monitoring. Physical access controls are important for  protecting computer facilities and resources from espionage, sabotage,  damage, and theft. These controls involve restricting physical access to  computer resources, usually by limiting access to the buildings and rooms  in which they are housed and enforcing usage restrictions and  implementation guidance for portable and mobile devices.
At least 23 major federal agencies had access control weaknesses during  fiscal year 2008. An analysis of our reports reveals that 48 percent of  information security control weaknesses pertained to access controls (see  fig. 5). For example, agencies did not consistently (1) establish sufficient  boundary protection mechanisms; (2) identify and authenticate users to  prevent unauthorized access; (3) enforce the principle of least privilege to  ensure that authorized access was necessary and appropriate; (4) apply  encryption to protect sensitive data on networks and portable devices;   (5) log, audit, and monitor security-relevant events; and (6) establish  effective controls to restrict physical access to information assets. Without  adequate access controls in place, agencies cannot ensure that their  information resources are protected from intentional or unintentional  harm.
Boundary protection controls logical connectivity into and out of  networks and controls connectivity to and from network connected  devices. Agencies segregate the parts of their networks that are publicly  accessible by placing these components in subnetworks with separate  physical interfaces and preventing public access to their internal  networks. Unnecessary connectivity to an agency’s network increases not  only the number of access paths that must be managed and the complexity  of the task, but the risk of unauthorized access in a shared environment. In  addition to deploying a series of security technologies at multiple layers,  deploying diverse technologies at different layers helps to mitigate the risk  of successful cyber attacks. For example, multiple firewalls can be  deployed to prevent both outsiders and trusted insiders from gaining  unauthorized access to systems, and intrusion detection technologies can  be deployed to defend against attacks from the Internet.
Agencies continue to demonstrate vulnerabilities in establishing  appropriate boundary protections. For example, two agencies that we  assessed did not adequately secure channels to connect remote users,  increasing the risk that attackers will use these channels to gain access to  restricted network resources. One of these agencies also did not have  adequate intrusion detection capabilities, while the other allowed users of  one network to connect to another, higher-security network. Such  weaknesses in boundary protections impair an agency’s ability to deflect  and detect attacks quickly and protect sensitive information and networks.
A computer system must be able to identify and authenticate different  users so that activities on the system can be linked to specific individuals.  When an organization assigns unique user accounts to specific users, the  system is able to distinguish one user from another—a process called  identification. The system also must establish the validity of a user’s  claimed identity by requesting some kind of information, such as a  password, that is known only by the user—a process known as  authentication.
Agencies did not always adequately control user accounts and passwords  to ensure that only valid users could access systems and information. In  our 2007 FISMA report, we noted several weaknesses in agencies’  identification and authentication procedures. Agencies continue to  experience similar weaknesses in fiscal years 2008 and 2009. For example,  certain agencies did not adequately enforce strong password settings,  increasing the likelihood that accounts could be compromised and used by  unauthorized individuals to gain access to sensitive information. In other  instances, agencies did not enforce periodic changing of passwords or use  of one-time passwords or passcodes, and transmitted or stored passwords  in clear text. Poor password management increases the risk that  unauthorized users could guess or read valid passwords to devices and use  the compromised devices for an indefinite period of time.
Authorization is the process of granting or denying access rights and  permissions to a protected resource, such as a network, a system, an  application, a function, or a file. A key component of granting or denying  access rights is the concept of least privilege, which is a basic principle for  securing computer resources and information and means that users are  granted only those access rights and permissions that they need to  perform their official duties. To restrict legitimate users’ access to only  those programs and files that they need to do their work, agencies  establish access rights and permissions. “User rights” are allowable  actions that can be assigned to users or to groups of users. File and  directory permissions are rules that regulate which users can access a  particular file or directory and the extent of that access. To avoid  unintentionally authorizing users access to sensitive files and directories,  an agency must give careful consideration to its assignment of rights and  permissions.
Agencies continued to grant rights and permissions that allowed more  access than users needed to perform their jobs. Inspectors general at 12  agencies reported instances where users had been granted excessive  privileges. In our reviews, we also noted vulnerabilities in this area. For  example, at one agency, users could inappropriately escalate their access  privileges to run commands on a powerful system account, many had  unnecessary and inappropriate access to databases, and other accounts  allowed excessive privileges and permissions. Another agency allowed (on  financial applications) generic, shared accounts that included the ability to  create, delete, and modify users’ accounts. Approximately 1,100 users at  yet another agency had access to mainframe system management utilities,  although such access was not necessarily required to perform their jobs.  These utilities provided access to all files stored on disk; all programs  running on the system, including the outputs; and the ability to alter  hardware configurations supporting the production environment. We  uncovered one agency that had provided a contractor with system access  that was beyond what was needed, making the agency vulnerable to  incidents on the contractor’s network. Another agency gave all users of an  application full access to the application’s source code although their  responsibilities did not require this level of privilege. Such weaknesses in  authorization place agencies at increased risk of inappropriate access to  data and sensitive system programs, as well as to the consequent  disruption of services.
Cryptography underlies many of the mechanisms used to enforce the  confidentiality and integrity of critical and sensitive information. A basic  element of cryptography is encryption. Encryption can be used to provide  basic data confidentiality and integrity by transforming plain text into  cipher text using a special value known as a key and a mathematical  process known as an algorithm. The National Security Agency  recommends disabling protocols that do not encrypt information  transmitted across the network, such as user identification and password  combinations.
Agencies did not always encrypt sensitive information on their systems or  traversing the network. In our reviews of agencies’ information security,  we found that agencies did not always encrypt sensitive information. For  example, five agencies that we reviewed did not effectively use  cryptographic controls to protect sensitive resources. Specifically, one  agency allowed unencrypted protocols to be used on its network devices.  Another agency did not require encrypted passwords for network logins,  while another did not consistently provide approved, secure transmission  of data over its network. These weaknesses could allow an attacker, or  malicious user, to view information and use that knowledge to obtain  sensitive financial and system data being transmitted over the network.
To establish individual accountability, monitor compliance with security  policies, and investigate security violations, it is crucial to determine what,  when, and by whom specific actions have been taken on a system.  Agencies accomplish this by implementing system or security software  that provides an audit trail, or logs of system activity, that they can use to  determine the source of a transaction or attempted transaction and to  monitor users’ activities. The way in which agencies configure system or  security software determines the nature and extent of the information that  can be provided by the audit trail. To be effective, agencies should  configure their software to collect and maintain audit trails that are  sufficient to track security-relevant events.
Agencies did not sufficiently log and monitor key security- and audit- related events on their network. For example, agencies did not monitor  critical portions of their networks for intrusions; record successful,  unauthorized access attempts; log certain changes to data on a mainframe  (which increases the risk of compromised security controls or disrupted  operations); and capture all authentication methods and logins to a  network by foreign nationals. Similarly, 14 agencies did not always have  adequate auditing and monitoring capabilities. For example, one agency  did not conduct a baseline assessment of an important network. This  baseline determines a typical state or pattern of network activity. Without  this information, the agency could have difficulty detecting and  investigating anomalous activity to ascertain whether or not an attack was  under way. Another agency did not perform source code scanning or have  a process for manual source code reviews, which increases the risk that  vulnerabilities would not be detected. As a result, unauthorized access  could go undetected, and if a system is modified or disrupted, the ability to  trace or recreate events could be impeded.
Physical security controls help protect computer facilities and resources  from espionage, sabotage, damage, and theft. These controls restrict  physical access to sensitive computing and communications resources,  usually by limiting access to the buildings and rooms in which the  resources are housed. Examples of physical security controls include  perimeter fencing, surveillance cameras, security guards, locks, and  procedures for granting or denying individuals physical access to  computing resources. Physical controls also include environmental  controls such as smoke detectors, fire alarms, extinguishers, and  uninterruptible power supplies. Considerations for perimeter security also  include controlling vehicular and pedestrian traffic. In addition, visitors’  access to sensitive areas must be managed appropriately.
Our analysis of inspector general, GAO, and agency reports has shown that  nine agencies did not sufficiently restrict physical access to sensitive  computing and communication resources. The physical security measures  employed by these agencies often did not comply with their own  requirements or with federal standards. Access to facilities containing  sensitive equipment and information was not always adequately restricted.  For example, at one agency with buildings housing classified networks,  cars were not stopped and inspected; a sign indicated the building’s  purpose; fencing was scalable; and access to buildings containing  computer network equipment was not controlled by electronic or other  means. Agencies did not adequately manage visitors, in one instance,  placing network jacks in an area where unescorted individuals could use  them to obtain electronic access to restricted computing resources, and in  another failing to properly identify and control visitors at a facility  containing sensitive equipment. Agencies did not always remove  employees’ physical access authorizations to sensitive areas in a timely  manner when they departed or their work no longer required such access.  Environmental controls at one agency did not meet federal guidelines,  with fire suppression capabilities, emergency lighting, and backup power  all needing improvements. Such weaknesses in physical access controls  increase the risk that sensitive computing resources will inadvertently or  deliberately be misused, damaged, or destroyed.
subsections: section_title: Configuration Management Controls Were Not Always Implemented
paragraphs: Configuration management controls ensure that only authorized and fully  tested software is placed in operation. These controls, which also limit and  monitor access to powerful programs and sensitive files associated with  computer operations, are important in providing reasonable assurance  that access controls are not compromised and that the system will not be  impaired. These policies, procedures, and techniques help ensure that all  programs and program modifications are properly authorized, tested, and  approved. Further, patch management is an important element in  mitigating the risks associated with software vulnerabilities. Up-to-date  patch installation could help mitigate vulnerabilities associated with flaws  in software code that could be exploited to cause significant damage— including the loss of control of entire systems—thereby enabling malicious  individuals to read, modify, or delete sensitive information or disrupt  operations.
Twenty-one agencies demonstrated weaknesses in configuration  management controls. For instance, several agencies did not implement  common secure configuration policies across their systems, increasing the  risk of avoidable security vulnerabilities. In addition, agencies did not  effectively ensure that system software changes had been properly  authorized, documented, and tested, which increases the risk that  unapproved changes could occur without detection and that such changes  could disrupt a system’s operations or compromise its integrity. Agencies  did not always monitor system configurations to prevent extraneous  services and other vulnerabilities from remaining undetected and  jeopardizing operations. At least six agencies did not consistently update  software on a timely basis to protect against known vulnerabilities or did  not fully test patches before applying them. Without a consistent approach  to updating, patching, and testing software, agencies are at increased risk  of exposing critical and sensitive data to unauthorized and possibly  undetected access.
section_title: Segregation of Duties Was Not Appropriately Enforced
paragraphs: Segregation of duties refers to the policies, procedures, and organizational  structure that helps ensure that one individual cannot independently  control all key aspects of a process or computer-related operation and  thereby conduct unauthorized actions or gain unauthorized access to  assets or records. Proper segregation of duties is achieved by dividing  responsibilities among two or more individuals or groups. Dividing duties  among individuals or groups diminishes the likelihood that errors and  wrongful acts will go undetected because the activities of one individual or  group will serve as a check on the activities of the other.
At least 14 agencies did not appropriately segregate information  technology duties. These agencies generally did not assign employee  duties and responsibilities in a manner that segregated incompatible  functions among individuals or groups of individuals. For instance, at one  agency, an individual who enters an applicant’s data into a financial  system also had the ability to hire the applicant. At another agency, 76  system users had the ability to create and approve purchase orders.  Without adequate segregation of duties, there is an increased risk that  erroneous or fraudulent actions can occur, improper program changes can  be implemented, and computer resources can be damaged or destroyed.
section_title: Continuity of Operations Plans Have Shortcomings
paragraphs: An agency must take steps to ensure that it is adequately prepared to cope  with the loss of operational capabilities due to an act of nature, fire,  accident, sabotage, or any other disruption. An essential element in  preparing for such a catastrophe is an up-to-date, detailed, and fully tested  continuity of operations plan. Such a plan should cover all key computer  operations and should include planning to ensure that critical information  systems, operations, and data such as financial processing and related  records can be properly restored if an emergency or a disaster occurs. To  ensure that the plan is complete and fully understood by all key staff, it  should be tested— including unannounced tests—and test plans and  results documented to provide a basis for improvement. If continuity of  operations controls are inadequate, even relatively minor interruptions  could result in lost or incorrectly processed data, which could cause  financial losses, expensive recovery efforts, and inaccurate or incomplete  mission-critical information.
Although agencies have reported increases in the number of systems for  which contingency plans have been tested, at least 17 agencies had  shortcomings in their continuity of operations plans. For example, one  agency’s disaster recovery planning had not been completed. Specifically,  disaster recovery plans for three components of the agency were in draft  form and had not been tested. Another agency did not include a business  impact analysis in the contingency plan control, which would assist in  planning for system recovery. In another example, supporting  documentation for some of the functional tests at the agency did not  adequately support testing results for verifying readability of backup tapes  retrieved during the tests. Until agencies complete actions to address  these weaknesses, they are at risk of not being able to appropriately  recover systems in a timely manner from certain service disruptions.
section_title: Agencywide Security Programs Were Not Fully Implemented
paragraphs: An underlying cause for information security weaknesses identified at  federal agencies is that they have not yet fully or effectively implemented  agencywide information security programs. An agencywide security  program, as required by FISMA, provides a framework and continuing  cycle of activity for assessing and managing risk, developing and  implementing security policies and procedures, promoting security  awareness and training, monitoring the adequacy of the entity’s computer- related controls through security tests and evaluations, and implementing  remedial actions as appropriate. Without a well-designed program,  security controls may be inadequate; responsibilities may be unclear,  misunderstood, and improperly implemented; and controls may be  inconsistently applied. Such conditions may lead to insufficient protection  of sensitive or critical resources.
Twenty-three agencies had not fully or effectively implemented  agencywide information security programs. Agencies often did not  adequately design or effectively implement policies for elements key to an  information security program. Weaknesses in agency information security  program activities, such as risk assessments, information security policies  and procedures, security planning, security training, system testing and  evaluation, and remedial action plans are described next.
In order for agencies to determine what security controls are needed to  protect their information resources, they must first identify and assess  their information security risks. Moreover, by increasing awareness of  risks, these assessments can generate support for policies and controls.
Agencies have not fully implemented their risk assessment processes. In  addition, 14 major agencies had weaknesses in their risk assessments.  Furthermore, they did not always properly assess the impact level of their  systems or evaluate potential risks for the systems we reviewed. For  example, one agency had not yet finalized and approved its guidance for  completing risk assessments. In another example, the agency had not  properly categorized the risk to its system, because it had performed a risk  assessment without an inventory of interconnections to other systems.  Similarly, another agency had not completed risk assessments for its  critical systems and had not assigned impact levels. In another instance,  an agency had current risk assessments that documented residual risk  assessed and potential threats, and recommended corrective actions for  reducing or eliminating the vulnerabilities they had identified. However,  that agency had not identified many of the vulnerabilities we found and  had not subsequently assessed the risks associated with them. As a result  of these weaknesses, agencies may be implementing inadequate or  inappropriate security controls that do not address the systems’ true risk,  and potential risks to these systems may not be known.
According to FISMA, each federal agency’s information security program  must include policies and procedures that are based on risk assessments  that cost-effectively reduce information security risks to an acceptable  level and ensure that information security is addressed throughout the life  cycle of each agency’s information system. The term ‘security policy’  refers to specific security rules set up by the senior management of an  agency to create a computer security program, establish its goals, and  assign responsibilities. Because policy is written at a broad level, agencies  also develop standards, guidelines, and procedures that offer managers,  users, and others a clear approach to implementing policy and meeting  organizational goals.
Thirteen agencies had weaknesses in their information security policies  and procedures. For example, one agency did not have updated policies  and procedures for configuring operating systems to ensure they provide  the necessary detail for controlling and logging changes. Another agency  had not established adequate policies or procedures to implement and  maintain an effective departmentwide information security program or to  address key OMB privacy requirements. Agencies also exhibited  weaknesses in policies concerning security requirements for laptops, user  access privileges, security incidents, certification and accreditation, and  physical security. As a result, agencies have reduced assurance that their  systems and the information they contain are sufficiently protected.  Without policies and procedures that are based on risk assessments,  agencies may not be able to cost-effectively reduce information security  risks to an acceptable level and ensure that information security is  addressed throughout the life cycle of each agency’s information system.
FISMA requires each federal agency to develop plans for providing  adequate information security for networks, facilities, and systems or  groups of systems. According to NIST 800-18, system security planning is  an important activity that supports the system development life cycle and  should be updated as system events trigger the need for revision in order  to accurately reflect the most current state of the system. The system  security plan provides a summary of the security requirements for the  information system and describes the security controls in place or planned  for meeting those requirements. NIST guidance also indicates that all  security plans should be reviewed and updated, if appropriate, at least  annually. Further, appendix III of OMB Circular A-130 requires security  plans to include controls for, among other things, contingency planning  and system interconnections.
System security plans were incomplete or out of date at several agencies.  For example, one agency had an incomplete security plan for a key  application. Another agency had only developed a system security plan  that covered two of the six facilities we reviewed, and the plan was  incomplete and not up-to-date. At another agency, 52 of the 57  interconnection security agreements listed in the security plan were not  current since they had not been updated within 3 years. Without adequate  security plans in place, agencies cannot be sure that they have the  appropriate controls in place to protect key systems and critical  information.
Users of information resources can be one of the weakest links in an  agency’s ability to secure its systems and networks. Therefore, an  important component of an agency’s information security program is  providing the required training so that users understand system security  risks and their own role in implementing related policies and controls to  mitigate those risks.
Several agencies had not ensured that all information security employees  and contractors, including those who have significant information security  responsibilities, had received sufficient training. For example, users of one  agency’s IT systems had not been trained to check for continued  functioning of their encryption software after installation. At another  agency, officials stated that several of its components had difficulty in  identifying and tracking all employees who have significant IT security  responsibilities and thus were unable to ensure that they received the  specialized training necessary to effectively perform their responsibilities.  Without adequate training, users may not understand system security risks  and their own role in implementing related policies and controls to  mitigate those risks.
Another key element of an information security program is testing and  evaluating system controls to ensure that they are appropriate, effective,  and comply with policies. FISMA requires that agencies test and evaluate  the information security controls of their major systems and that the  frequency of such tests be based on risk, but occur no less than annually.  NIST requires agencies to ensure that the appropriate officials are  assigned roles and responsibilities for testing and evaluating controls over  their systems.
Agencies did not always implement policies and procedures for  performing periodic testing and evaluation of their information security  controls. For example, one agency had not adequately tested security  controls. Specifically, the tests of a major application and the mainframe  did not identify or discuss the vulnerabilities that we had identified during  our audit. The same agency’s testing did not reveal problems with the  mainframe that could allow unauthorized users to read, copy, change,  delete, and modify data. In addition, although testing requirements were  stated in test documentation, the breadth and depth of the test, as well as  the results of the test, had not always been documented. Also, agencies  reported inconsistent testing of security controls among components.  Without conducting the appropriate tests and evaluations, agencies have  limited assurance that policies and controls are appropriate and working  as intended. Additionally, there is an increased risk that undetected  vulnerabilities could be exploited to allow unauthorized access to  sensitive information.
Remedial Action Processes and Plans  FISMA requires that agencies’ information security programs include a  process for planning, implementing, evaluating, and documenting remedial  actions to address any deficiencies in the information security policies,  procedures, and practices of the agency.
Since our 2007 FISMA report, we have continued to find weaknesses in  agencies’ plans and processes for remedial actions. Agencies indicated  that they had corrected or mitigated weaknesses; however, our work  revealed that those weaknesses still existed. In addition, the inspectors  general at 14 of the 24 agencies reported weaknesses in the plans to  document remedial actions. For example, at several agencies, the  inspector general reported that weaknesses had been identified but not  documented in the remediation plans. Inspectors general further reported  that agency plans did not include all relevant information in accordance  with OMB instructions. We also found that deficiencies had not been  corrected in a timely manner. Without a mature process and effective  remediation plans, the risk increases that vulnerabilities in agencies’  systems will not be mitigated in an effective and timely manner.
Until agencies effectively and fully implement agencywide information  security programs, federal data and systems will not be adequately  safeguarded to prevent disruption, unauthorized use, disclosure, and  modification. Further, until agencies implement our recommendations to  correct specific information security control weaknesses, their systems  and information will remain at increased risk of attack or compromise.
section_title: Opportunities Exist for Bolstering Federal Information Security
paragraphs: In prior reports, we and inspectors general have made hundreds of  recommendations to agencies for actions necessary to resolve prior  significant control deficiencies and information security program  shortfalls. For example, we recommended that agencies correct specific  information security deficiencies related to user identification and  authentication, authorization, boundary protections, cryptography, audit  and monitoring, physical security, configuration management, segregation  of duties, and continuity of operations planning. We have also  recommended that agencies fully implement comprehensive, agencywide  information security programs by correcting weaknesses in risk  assessments, information security policies and procedures, security  planning, security training, system tests and evaluations, and remedial  actions. The effective implementation of these recommendations will  strengthen the security posture at these agencies. Agencies have  implemented or are in the process of implementing many of our  recommendations.
In March 2009, we reported on 12 key improvements suggested by a panel  of experts as being essential to improving our national cyber security  posture (see app. III). The expert panel included former federal officials,  academics, and private-sector executives. Their suggested improvements  are intended to address many of the information security vulnerabilities  facing both private and public organizations, including federal agencies.  Among these improvements are recommendations to develop a national  strategy that clearly articulates strategic objectives, goals, and priorities  and to establish a governance structure for strategy implementation.
Due to increasing cyber security threats, the federal government has  initiated several efforts to protect federal information and information  systems. Recognizing the need for common solutions to improving  security, the White House, OMB, and federal agencies have launched or  continued several governmentwide initiatives that are intended to enhance  information security at federal agencies. These key initiatives are  discussed here.    60-day cyber review: The National Security Council and Homeland  Security Council recently completed a 60-day interagency review intended  to develop a strategic framework to ensure that federal cyber security  initiatives are appropriately integrated, resourced, and coordinated with  Congress and the private sector. The resulting report recommended,  among other things, appointing an official in the White House to  coordinate the nation’s cybersecurity policies and activities, creating a  new national cybersecurity strategy, and developing a framework for  cyber research and development.
Comprehensive National Cybersecurity Initiative: In January 2008,  President Bush began to implement a series of initiatives aimed primarily  at improving the Department of Homeland Security and other federal  agencies’ efforts to protect against intrusion attempts and anticipate future  threats. While these initiatives have not been made public, the Director of  National Intelligence stated that they include defensive, offensive,  research and development, and counterintelligence efforts, as well as a  project to improve public/private partnerships.
The Information Systems Security Line of Business: The goal of this  initiative, led by OMB, is to improve the level of information systems  security across government agencies and reduce costs by sharing common  processes and functions for managing information systems security.  Several agencies have been designated as service providers for IT security  awareness training and FISMA reporting.
Federal Desktop Core Configuration: For this initiative, OMB directed  agencies that have Windows XP deployed and plan to upgrade to Windows  Vista operating systems to adopt the security configurations developed by  the National Institute of Standards and Technology, Department of  Defense, and Department of Homeland Security. The goal of this initiative  is to improve information security and reduce overall IT operating costs.
SmartBUY: This program, led by the General Services Administration, is  to support enterprise-level software management through the aggregate  buying of commercial software governmentwide in an effort to achieve  cost savings through volume discounts. The SmartBUY initiative was  expanded to include commercial off-the-shelf encryption software and to  permit all federal agencies to participate in the program. The initiative is to  also include licenses for information assurance.
Trusted Internet Connections Initiative: This effort, directed by OMB and  led by the Department of Homeland Security, is designed to optimize  individual agency network services into a common solution for the federal  government. The initiative is to facilitate the reduction of external  connections, including Internet points of presence, to a target of 50.
We currently have ongoing work that addresses the status, planning, and  implementation efforts of several of these initiatives.
section_title: Agencies Continue to Report Progress in Implementing Requirements
paragraphs: Federal agencies reported increased compliance in implementing key  information security control activities for fiscal year 2008; however,  inspectors general at several agencies noted shortcomings with agencies’  implementation of information security requirements. OMB also reported  that agencies’ were increasingly performing key activities. Specifically,  agencies reported increases in the number and percentage of systems that  had been certified and accredited, the number and percentage of  employees and contractors receiving security awareness training, and the  number and percentage of systems with tested contingency plans.  However, the number and percentage of systems that had been tested and  evaluated at least annually decreased slightly and the number and  percentage of employees who had significant security responsibilities and  had received specialized training decreased significantly (see fig. 6).  Consistent with previous years, inspectors general continued to identify  weaknesses with the processes and practices agencies have in place to  implement FISMA requirements. Although OMB took steps to clarify its  reporting instructions to agencies for preparing fiscal year 2008 reports,  the instructions did not request inspectors general to report on agencies’  effectiveness of key activities and did not always provide clear guidance to  inspectors general.
Federal agencies rely on their employees to protect the confidentiality,  integrity, and availability of the information in their systems. It is critical  for system users to understand their security roles and responsibilities and  to be adequately trained to perform them. FISMA requires agencies to  provide security awareness training to personnel, including contractors  and other users of information systems that support agency operations  and assets. This training should explain information security risks  associated with their activities and their responsibilities in complying with  agency policies and procedures designed to reduce these risks. In  addition, agencies are required to provide appropriate training on  information security to personnel who have significant security  responsibilities.
Agencies reported a slight increase in the percentage of employees and  contractors who received security awareness training. According to  agency reports, 89 percent of total employees and contractors had  received security awareness training in 2008 compared to 84 percent of  employees and contractors in 2007. While this change marks an  improvement between fiscal years 2007 and 2008, the percentage of  employees and contractors receiving security awareness training is still  below the 91 percent reported for 2006. In addition, seven inspectors  general reported disagreement with the percentage of employees and  contractors receiving security awareness training reported by their  agencies. Additionally, several inspectors general reported specific  weaknesses related to security awareness training at their agencies; for  example, one inspector general reported that the agency lacked the ability  to document and track which system users had received awareness  training, while another inspector general reported that training did not  cover the recommended topics.
Governmentwide, agencies reported a lower percentage of employees who  had significant security responsibilities who had received specialized  training. In fiscal year 2008, 76 percent of these employees had received  specialized training compared with 90 percent of these employees in fiscal  year 2007. Although the governmentwide percentage decreased, the  majority of the 24 agencies reported increasing or unchanging percentages  of employees receiving specialized training; 8 of the 24 agencies reported  percentage decreases (see fig. 7).
At least 12 inspectors general reported weaknesses related to specialized  security training. One of the inspectors general reported that some groups  did not have a training program for personnel who have critical IT  responsibilities and another inspector general reported that the agency  was unable to effectively track contractors who needed specialized  training. Decreases in the number of individuals receiving specialized  training at some federal agencies combined with continuing deficiencies in  training programs could limit the ability of agencies to implement security  measures effectively. Providing for the confidentiality, integrity, and  availability of information in today’s highly networked environment is not  an easy or trivial task. The task is made that much more difficult if each  person who owns, uses, relies on, or manages information and information  systems does not know or is not properly trained to carry out his or her  specific responsibilities.
subsections: section_title: Inspectors General Report Using Professional Standards for Conducting Independent Evaluations More, but Opportunities to Improve Consistency Remain
paragraphs: An increasing number of inspectors general reported conducting annual  independent evaluations in accordance with professional standards and  provided additional information about the effectiveness of their agency’s  security programs. FISMA requires agency inspectors general or their  independent external auditors to perform an independent evaluation of the  information security programs and practices of the agency to determine  the effectiveness of the programs and practices. We have previously  reported that the annual inspector general independent evaluations  lacked a common approach and that the scope and methodology of the  evaluations varied across agencies. We noted that there was an  opportunity to improve these evaluations by conducting them in  accordance with audit standards or a common approach and framework.
In fiscal year 2008, 16 of 24 inspectors general cited using professional  standards to perform the annual FISMA evaluations, up from 8 inspectors  general who cited using standards the previous year. Of the 16 inspectors  general, 13 reported performing evaluations that were in accordance with  generally accepted government auditing standards, while the other 3  indicated using the “Quality Standards for Inspections” issued by the  President’s Council on Integrity and Efficiency. The remaining eight  inspectors general cited using internally developed standards or did not  indicate whether they had performed their evaluations in accordance with  professional standards.
In addition, an increasing number of inspectors general provided  supplemental information about their agency’s information security  policies and practices. To illustrate, 21 of 24 inspectors general reported  additional information about the effectiveness of their agency’s security  controls and programs that was above and beyond what was requested in  the OMB template, an increase from the 18 who had provided such  additional information in their fiscal year 2007 reports. The additional  information included descriptions of significant control deficiencies and  weaknesses in security processes that provided additional context to the  agency’s security posture.
Although inspectors general reported using professional standards more  frequently, their annual independent evaluations occasionally lacked  consistency. For example,    Three inspectors general provided only template responses and did not  identify the scope and methodology of their evaluation. (These three  inspectors general were also among those who had not reported  performing their evaluation in accordance with professional standards.)
Descriptions of the controls evaluated during the review as documented in  the scope and methodology sections differed. For example, according to  their FISMA reports, a number of inspectors general stated that their  evaluations included a review of policies and procedures, whereas others  did not indicate whether policies and procedures had been reviewed.  Additionally, multiple inspectors general also indicated that technical  vulnerability assessments had been conducted as part of the review,  whereas others did not indicate whether such an assessment had been  part of the review.
Eleven inspectors general indicated that their FISMA evaluations  considered the results of previous information security reviews, whereas  13 inspectors general did not indicate whether they considered other  information security work, if any.
The development and use of a common framework or adherence to  auditing standards could provide improved effectiveness, increased  efficiency, quality control, and consistency in inspector general  assessments.
section_title: Opportunities Remain for OMB to Improve Annual Reporting and Oversight of Agency Information Security Programs
paragraphs: Although OMB has supported several governmentwide initiatives and  provided additional guidance to help improve information security at  agencies, opportunities remain for it to improve its annual reporting and  oversight of agency information security programs. FISMA specifies that  OMB, among other responsibilities, is to develop policies, principles,  standards, and guidelines on information security and report to Congress  not later than March 1 of each year on agencies’ implementation of FISMA.  Each year, OMB provides instructions to federal agencies and their  inspectors general for preparing their FISMA reports and then summarizes  the information provided by the agencies and the inspectors general in its  report to Congress.
Over the past 4 years, we have reported that, while the periodic reporting  of performance measures for FISMA requirements and related analysis  provides valuable information on the status and progress of agency efforts  to implement effective security management programs, shortcomings in  OMB’s reporting instructions limited the utility of the annual reports.  Accordingly, we recommended that OMB improve reporting by clarifying  reporting instructions; develop additional metrics that measure control  effectiveness; request inspectors general to assess the quality of additional  information security processes such as system test and evaluation, risk  categorization, security awareness training, and incident reporting; and  require agencies to report on additional key security activities such as  patch management. Although OMB has taken some actions to enhance its  reporting instructions, it has not implemented most of the  recommendations, and thus further actions need to be taken to fully  address them.
In addition to the previously reported shortcomings, OMB’s reporting  instructions for fiscal year 2008 did not sufficiently address several  processes key to implementing an agencywide security program and were  sometimes unclear. For example, the reporting instructions did not  request inspectors general to provide information on the quality or  effectiveness of agencies’ processes for developing and maintaining  inventories, providing specialized security training, and monitoring  contractors. For these activities, inspectors general were requested to  report only on the extent to which agencies had implemented the activity  but not on the effectiveness of those activities. Providing information on  the effectiveness of the processes used to implement the activities could  further enhance the usefulness of the data for management and oversight  purposes.
OMB’s guidance to inspectors general for rating agencies’ certification and  accreditation processes was not clear. In its reporting instructions, OMB  requests inspectors general to rate their agency’s certification and  accreditation process using the terms “excellent,” “good,” “satisfactory,”  “poor,” or “failing.” However, the reporting instructions do not define or  identify criteria for determining the level of performance for each rating.  OMB also requests inspectors general to identify the aspect(s) of the  certification and accreditation process they included or considered in  rating the quality of their agency’s process. Examples OMB included were  security plan, system impact level, system test and evaluation, security  control testing, incident handling, security awareness training, and  security configurations (including patch management). While this  information is helpful and provides insight on the scope of the rating,  inspectors general were not requested to comment on the quality or  effectiveness of these items. Additionally, not all inspectors general  considered the same aspects in reviewing the certification and  accreditation process, yet all were allowed to provide the same rating.  Without clear guidelines for rating these processes, OMB and Congress  may not have a consistent basis for comparing the progress of an agency  over time or against other agencies.
In its report to Congress for fiscal year 2008, OMB did not fully summarize  the findings from the inspectors general independent evaluations or  identify significant deficiencies in agencies’ information security practices.  FISMA requires OMB to provide a summary of the findings of agencies’  independent evaluations and significant deficiencies in agencies’  information security practices. Inspectors general often document their  findings and significant information security control deficiencies in  reports that support their evaluations. However, OMB did not summarize  and present this information in its annual report to Congress. Most of the  inspectors general information summarized in the annual report was taken  from the “yes” or “no” responses or from questions having a  predetermined range of percentages as stipulated by OMB’s reporting  template. Thus, important information about the implementation of agency  information security programs and the vulnerabilities and risks associated  with federal information systems was not provided to Congress in OMB’s  annual report. This information could be useful in determining whether  agencies are effectively implementing information security policies,  procedures, and practices. As a result, Congress may not be fully informed  about the state of federal information security.
OMB also did not approve or disapprove agencies’ information security  programs. FISMA requires OMB to review agencies’ information security  programs at least annually and approve or disapprove them. OMB  representatives informed us that they review agencies’ FISMA reports and  interact with agencies whenever an issue arises that requires their  oversight. However, representatives stated that they do not explicitly or  publicly declare that an agency’s information security program has been  approved or disapproved. As a result, a mechanism for establishing  accountability and holding agencies accountable for implementing  effective programs was not used.
section_title: Conclusions
paragraphs: Weaknesses in information security controls continue to threaten the  confidentiality, integrity, and availability of the sensitive data maintained  by federal agencies. These weaknesses, including those for access  controls, configuration management, and segregation of duties, leave  federal agency systems and information vulnerable to external as well as  internal threats. The White House, OMB, and federal agencies have  initiated actions intended to enhance information security at federal  agencies. However, until agencies fully and effectively implement  information security programs and address the hundreds of  recommendations that we and agency inspectors general have made,  federal systems will remain at an increased and unnecessary risk of attack  or compromise.
Despite these weaknesses, federal agencies have continued to report  progress in implementing key information security requirements. While  NIST, inspectors general, and OMB have all made progress toward  fulfilling their statutory requirements, the current reporting process does  not produce information to accurately gauge the effectiveness of federal  information security activities. OMB’s annual reporting instructions did  not cover key security activities and were not always clear. Finally, OMB  did not include key information about findings and significant deficiencies  identified by inspectors general in its governmentwide report to Congress  and did not approve or disapprove agency information security programs.  Shortcomings in reporting and oversight can result in insufficient  information being provided to Congress and diminish its ability to monitor  and assist federal agencies in improving the state of federal information  security.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Director of the Office of Management and Budget  take the following four actions:    Update annual reporting instructions to request inspectors general to  report on the effectiveness of agencies’ processes for developing  inventories, monitoring contractor operations, and providing specialized  security training.
Clarify and enhance reporting instructions to inspectors general for  certification and accreditation evaluations by providing them with  guidance on the requirements for each rating category.
Include in OMB’s report to Congress, a summary of the findings from the  annual independent evaluations and significant deficiencies in information  security practices.
Approve or disapprove agency information security programs after review.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of this report, the Federal Chief  Information Officer (CIO) generally agreed with our overall assessment  of information security at the agencies. He also identified actions that  OMB is taking to clarify its reporting guidance and to consider more  effective security performance metrics. These actions are consistent with  the intent of two of our recommendations, that OMB clarify and enhance  reporting instructions and request inspectors general to report on  additional measures of effectiveness.
The Federal CIO did not address our recommendation to include a  summary of the findings and significant security deficiencies in its report  to Congress and did not concur with GAO’s conclusion that OMB does not  approve or disapprove agencies’ information security management  programs on an annual basis. He indicated that OMB reviews all agency  and IG FISMA reports annually; reviews quarterly information on the  major agencies’ security programs; and uses this information, and other  reporting, to evaluate agencies security programs. The Federal CIO  advised that concerns are communicated directly to the agencies. We  acknowledge that these are important oversight activities. However, as we  reported, OMB did not demonstrate that it approved or disapproved  agency information security programs, as required by FISMA.  Consequently, a mechanism for holding agencies accountable for  implementing effective programs is not being effectively used.
We are sending copies of this report to the Office of Management and  Budget and other interested parties. In addition, this report will be  available at no charge on the GAO Web site at http://www.gao.gov.
If you have any questions regarding this report, please contact me at (202)  512-6244 or by e-mail at wilshuseng@gao.gov. Contact points for our Office  of Congressional Relations and Public Affairs may be found on the last  page of this report. Key contributors to this report are listed in   appendix IV.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: In accordance with the Federal Information Security Management Act of  2002 (FISMA) requirement that the Comptroller General report  periodically to Congress, our objectives were to evaluate (1) the adequacy  and effectiveness of agencies’ information security policies and practices  and (2) federal agency implementation of FISMA requirements.
To assess the adequacy and effectiveness of agency information security  policies and practices, we analyzed our related reports issued from May  2007 through April 2009. We also reviewed and analyzed the information  security work and products of agency inspectors general. Further, we  reviewed and summarized weaknesses identified in our reports and that of  inspectors general using five major categories of information security  controls: (1) access controls, (2) configuration management controls, (3)  segregation of duties, (4) continuity of operations planning, and (5)  agencywide information security programs. Our reports generally used the  methodology contained in the Federal Information System Controls  Audit Manual. We also examined information provided by the U.S.  Computer Emergency Readiness Team (US-CERT) on reported security  incidents.
To assess the implementation of FISMA requirements, we reviewed and  analyzed the provisions of the act and the mandated annual FISMA  reports from the Office of Management and Budget (OMB), the National  Institute of Standards and Technology (NIST), and the CIOs and IGs of 24  major federal agencies for fiscal years 2007 and 2008. We also examined  OMB’s FISMA reporting instructions and other OMB and NIST guidance.
We also held discussions with OMB representatives and agency officials  from the National Institute of Standards and Technology and the  Department of Homeland Security’s US-CERT to further assess the  implementation of FISMA requirements. We did not verify the accuracy of  the agencies’ responses; however, we reviewed supporting documentation  that agencies provided to corroborate information provided in their  responses. We did not include systems categorized as national security  systems in our review, nor did we review the adequacy or effectiveness of  the security policies and practices for those systems.
We conducted this performance audit from December 2008 to May 2009 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
section_title: Appendix II: Comments from the Office of Management and Budget
section_title: Appendix III: Cybersecurity Experts Highlighted Key Improvements for Strengthening the Nation’s Cyber Security
paragraphs: In March 2009, we convened a panel of experts to discuss how to improve  key aspects of the national cyber security strategy and its implementation  as well as other critical aspects of the strategy, including areas for  improvement. The experts, who included former federal officials,  academics, and private-sector executives, highlighted 12 key  improvements that are, in their view, essential to improving the strategy  and our national cyber security posture. These improvements are in large  part consistent with our previously mentioned reports and extensive  research and experience in this area.
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Charles Vrabel (Assistant  Director); Debra Conner; Larry Crosland; Sharhonda Deloach; Neil  Doherty; Kristi Dorsey; Rosanna Guererro; Nancy Glover; Rebecca Eyler;  Mary Marshall; and Jayne Wilson made key contributions to this report.
section_title: Related GAO Products
paragraphs: Cybersecurity: Continued Federal Efforts Are Needed to Protect Critical  Systems and Information. GAO-09-835T. Washington, D.C.: June 25, 2009.
Privacy and Security: Food and Drug Administration Faces Challenges  in Establishing Protections for Its Postmarket Risk Analysis System.  GAO-09-355. Washington, D.C.: June 1, 2009.
Aviation Security: TSA Has Completed Key Activities Associated with  Implementing Secure Flight, but Additional Actions Are Needed to  Mitigate Risks. GAO-09-292. Washington, D.C.: May 13, 2009.
Information Security: Cyber Threats and Vulnerabilities Place Federal  Systems at Risk. GAO-09-661T. Washington, D.C.: May 5, 2009.
Freedom of Information Act: DHS Has Taken Steps to Enhance Its  Program, but Opportunities Exist to Improve Efficiency and Cost- Effectiveness. GAO-09-260. Washington, D.C.: March 20, 2009.
Information Security: Securities and Exchange Commission Needs to  Consistently Implement Effective Controls. GAO-09-203. Washington,  D.C.: March 16, 2009.
National Cyber Security Strategy: Key Improvements Are Needed to  Strengthen the Nation’s Posture. GAO-09-432T. Washington, D.C.: March  10, 2009.
Information Security: Further Actions Needed to Address Risks to Bank  Secrecy Act Data. GAO-09-195. Washington, D.C.: January 30, 2009.
Information Security: Continued Efforts Needed to Address Significant  Weaknesses at IRS. GAO-09-136. Washington, D.C.: January 9, 2009.
Nuclear Security: Los Alamos National Laboratory Faces Challenges in  Sustaining Physical and Cyber Security Improvements. GAO-08-1180T.  Washington, D.C.: September 25, 2008.
Critical Infrastructure Protection: DHS Needs to Better Address Its  Cyber Security Responsibilities. GAO-08-1157T. Washington, D.C.:  September 16, 2008.
Critical Infrastructure Protection: DHS Needs to Fully Address Lessons  Learned from Its First Cyber Storm Exercise. GAO-08-825. Washington,  D.C.: September 9, 2008.
Information Security: Actions Needed to Better Protect Los Alamos  National Laboratory’s Unclassified Computer Network. GAO-08-1001.  Washington, D.C.: September 9, 2008.
Cyber Analysis and Warning: DHS Faces Challenges in Establishing a  Comprehensive National Capability. GAO-08-588. Washington, D.C.: July  31, 2008.
Information Security: Federal Agency Efforts to Encrypt Sensitive  Information Are Under Way, but Work Remains. GAO-08-525.  Washington, D.C.: June 27, 2008.
Information Security: FDIC Sustains Progress but Needs to Improve  Configuration Management of Key Financial Systems. GAO-08-564.  Washington, D.C.: May 30, 2008.
Information Security: TVA Needs to Address Weaknesses in Control  Systems and Networks. GAO-08-526. Washington, D.C.: May 21, 2008.
Information Security: TVA Needs to Enhance Security of Critical  Infrastructure Control Systems and Networks. GAO-08-775T. Washington,  D.C.: May 21, 2008.
Information Security: Progress Reported, but Weaknesses at Federal  Agencies Persist. GAO-08-571T. Washington, D.C.: March 12, 2008.
Information Security: Securities and Exchange Commission Needs to  Continue to Improve Its Program. GAO-08-280. Washington, D.C.:  February 29, 2008.
Information Security: Although Progress Reported, Federal Agencies  Need to Resolve Significant Deficiencies. GAO-08-496T. Washington, D.C.:  February 14, 2008.
Information Security: Protecting Personally Identifiable Information.  GAO-08-343. Washington, D.C.: January 25, 2008.
Information Security: IRS Needs to Address Pervasive Weaknesses.   GAO-08-211. Washington, D.C.: January 8, 2008.
Veterans Affairs: Sustained Management Commitment and Oversight  Are Essential to Completing Information Technology Realignment and  Strengthening Information Security. GAO-07-1264T. Washington, D.C.:  September 26, 2007.
Critical Infrastructure Protection: Multiple Efforts to Secure Control  Systems Are Under Way, but Challenges Remain. GAO-07-1036.  Washington, D.C.: September 10, 2007.
Information Security: Sustained Management Commitment and  Oversight Are Vital to Resolving Long-standing Weaknesses at the  Department of Veterans Affairs. GAO-07-1019. Washington, D.C.:  September 7, 2007.
Information Security: Selected Departments Need to Address Challenges  in Implementing Statutory Requirements. GAO-07-528. Washington, D.C.:  August 31, 2007.
Information Security: Despite Reported Progress, Federal Agencies Need  to Address Persistent Weaknesses. GAO-07-837. Washington, D.C.: July 27,  2007.
Information Security: Homeland Security Needs to Immediately Address  Significant Weaknesses in Systems Supporting the US-VISIT Program.  GAO-07-870. Washington, D.C.: July 13, 2007.
Information Security: Homeland Security Needs to Enhance  Effectiveness of Its Program. GAO-07-1003T. Washington, D.C.: June 20,  2007.
Information Security: Agencies Report Progress, but Sensitive Data  Remain at Risk. GAO-07-935T. Washington, D.C.: June 7, 2007.
Information Security: Federal Deposit Insurance Corporation Needs to  Sustain Progress Improving Its Program. GAO-07-351. Washington, D.C.:  May 18, 2007.