Information Security: FCC Made Significant Progress, but Needs to Address Remaining Control Deficiencies and Improve Its Program
Released: 2020-04-24T00:00:00

Letter

Background

Established by the Communications Act of 1934, FCC regulates interstate and international communications by radio, television, wire, satellite, and cable in all 50 states, the District of Columbia, and U.S. territories. FCC is responsible for, among other things, making available nationwide worldwide wire and radio communication service. More recently, it has been responsible for promoting competition and reducing regulation of the telecommunications industry in order to secure lower prices and higher quality services for consumers.

FCC’s functions include: issuing licenses for broadcast television and radio; overseeing licensing, enforcement, and regulatory functions of carriers of cellular phones and other personal communication services; regulating the use of radio spectrum and conducting auctions of licenses for spectrum; investigating complaints and taking enforcement actions if it finds that there have been violations of the various communications laws and commission rules that are designed to protect consumers; addressing issues related to public safety, homeland security, emergency management, and preparedness; educating and informing consumers about communications goods and reviewing mergers of companies holding FCC-issued licenses.

FCC Relies on Information Technology to Support Its Operations

FCC relies extensively on computerized systems to support its mission- related operations, and on information security controls to protect the commission’s data. FCC’s Information Technology Center, within the Office of the Managing Director, uses IT to perform the commission’s business operations. Through its computer network and systems, the commission collects and maintains nonpublic information, including proprietary information of businesses regulated by the commission, as well as information available to the public through rulemaking proceedings.

FCC Has Defined Organizational Roles and Responsibilities for Information Security

FCC’s Chairman, chief information officer (CIO), and chief information security officer (CISO) each have specific responsibilities for information security. Specifically, the FCC Chairman has responsibility for, among other things: 1. providing information security protections commensurate with the risk and magnitude of harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the commission’s information systems and information; 2. ensuring that senior officials provide security for the information and systems that support the operations and assets under their control; and 3. delegating to the CIO the authority to ensure compliance with the information security requirements imposed on the commission.

In addition, the CIO is responsible for establishing and enforcing policies and procedures for protecting information resources. Toward this end, the CIO has designated and assigned responsibilities to the CISO for managing the cybersecurity program. The CISO, among other things, is responsible for providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the commission.

Federal Law and Guidance Establish Security Requirements to Protect Federal Information and Systems

The Federal Information Security Modernization Act of 2014 (FISMA) provides a comprehensive framework for information security controls over information resources that support federal operations and assets. The law also requires each agency to develop, document, and implement an agency-wide information security program to provide risk-based protections for the information and information systems that support the operations and assets of the agency.

Such a program should include assessing risks; developing and implementing policies and procedures to cost-effectively reduce risks; developing and implementing plans for providing adequate information security for networks, facilities, and systems; and providing security awareness and specialized training. Further, the program should include testing and evaluating the effectiveness of controls; planning, implementing, evaluating, and documenting remedial actions to address information security deficiencies; developing and implementing procedures for detecting, reporting, and responding to security incidents; and ensuring continuity of operations.

FISMA requires agencies to comply with the federal information processing standards (FIPS) publications issued by NIST and Office of Management and Budget (OMB) Circular A-130 requires agencies to comply with the information security guidelines prescribed in NIST special publications. Consequently, NIST FIPS publications and special publications contain many of the cybersecurity-related requirements for federal agencies. For example, NIST FIPS Publication 199 requires agencies to categorize their information and information systems according to the potential harm and impact to agency assets, operations, or individuals should the confidentiality, integrity, or availability of its information and information systems be compromised through unauthorized access, use, disclosure, disruption, modification, or destruction.

In addition, NIST FIPS Publication 200 requires agencies to meet minimum security requirements by selecting the appropriate security controls, as described in NIST Special Publication 800-53. This special publication provides a catalog of 18 security control areas for federal information systems and a process for selecting controls to protect organizational operations and assets. The publication provides baseline security controls for low-, moderate-, and high-impact systems, and agencies have the ability to tailor or supplement their security requirements and policies based on agency mission, business requirements, and operating environment.

Further, in May 2017, the President issued an executive order requiring agencies to immediately begin using NIST’s cybersecurity framework for managing their cybersecurity risks. The framework, which provides guidance for cybersecurity activities, is based on five core security functions: Identify: Develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities.

Protect: Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services.

Detect: Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event.

Respond: Develop and implement the appropriate activities to take action regarding a detected cybersecurity incident.

Recover: Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident.

According to NIST, these five functions occur concurrently and continuously, and provide a strategic view of the life cycle of an organization’s management of cybersecurity risk. Within the five functions are 23 categories and 108 subcategories that include information security program-related controls and technical controls for achieving the intent of each function. Appendix II provides a description of the framework categories and subcategories of controls.

FCC Experienced a Service Disruption in May 2017

On May 7 and 8, 2017, FCC experienced a dramatic surge in the number of comments sent to the commission through its ECFS during a public comment period. This surge led to a disruption of services, which prevented the system from being able to accept additional comments for a period of time. The FCC Office of Inspector General determined that the system service disruption was likely due to a combination of the sudden increase in traffic from commenters all trying to access the system’s website over a short period of time and system design deficiencies that negatively impacted the capacity and performance of the system to collect and process the increase in traffic. Figure 1 presents a timeline of the May 2017 ECFS service disruption and subsequent related events. Additional details on the timeline are provided in appendix III.

FCC Increased ECFS’s Capacity and Performance to Reduce Risk of Future Service Disruptions

In response to the ECFS service disruption that occurred on May 7 and 8, 2017, FCC Information Technology Center officials took four key actions to reduce the risk of future service disruptions to the system. 1. Conducted Internal Assessments In response to the service disruption, in early May 2017, the FCC CIO initially stated that the cause was a cyberattack on the ECFS. However, upon further assessment, FCC Information Technology Center officials later determined that the disruption was caused by a surge in comment traffic to the system and existing system performance and capacity deficiencies.

In response to multiple congressional inquiries, in late July 2017, FCC Information Technology Center officials assessed the extent to which malicious intent was involved in causing the disruption based on whether: (a) internet protocol (IP) addresses from foreign sources were present on the commission’s network at the time of the May 2017 event; (b) comment submissions were denied (i.e., dropped) from the commission’s network, (c) observable botnet traffic was present; and (d) duplicate comment submissions were accepted into ECFS. The assessment concluded that the commission did not have sufficient information and tools to determine whether there was any malicious intent. 2. Deployed Additional Virtual Hardware

Following the disruption, in early May 2017, FCC deployed additional virtual hardware to address system performance issues and support system stabilization efforts of ECFS during the period in which service was disrupted.

In early July 2017, the commission installed security sensors and forwarding agents on the ECFS virtual servers. These devices are intended to provide additional layers of security capability for the system.

In mid-July 2017, FCC automated the process for deploying virtual hardware resources to support system availability subsequent to the May 2017 service disruption. 3. Optimized and Acquired System Software

From late May 2017 to early June 2017, FCC acquired a diagnostic tool to measure system performance. According to the commission, this tool is used to determine the maximum amount of simultaneous user capacity within ECFS during periods of high web traffic.

In early June 2017, the commission optimized the search functionality within the ECFS database to reduce the system response time.

In mid-June 2017, FCC removed redundant internal processes for ECFS web requests to increase the responsiveness of the system.

During late July 2017, the commission acquired a security information and event management tool to collect and analyze security-related events that may indicate a cybersecurity incident.

In late August 2017, FCC established rate control limits within ECFS to safeguard against potential distributed denial-of-service attacks aiming to flood one target with network traffic. 4. Updated Incident Response Policy and Procedures In January 2018 and March 2018, during its annual policy review, FCC Information Technology Center officials updated the commission’s incident response and reporting policy and procedures to incorporate lessons learned from the May 2017 ECFS service disruption and clarify their processes. For example, FCC Information Technology Center officials revised the commission’s incident response procedures to document internal escalation time frames for notifying management of potential security incidents and reporting the incidents to the United States Computer Emergency Readiness Team within 1 hour of identification of an incident.

Figure 2 shows a chronological sequence of the hardware and software improvements that FCC officials implemented after the May 2017 event.

FCC provided evidence that indicated its actions to add additional hardware and software resources increased ECFS’s capacity and performance and demonstrated that the system was stable from June 2017 through December 2017. For example, FCC acquired a performance diagnostic tool in late May 2017, which was designed to determine the maximum number of potential simultaneous public users within ECFS during periods of high web traffic. Using the diagnostic tool, FCC Information Technology Center officials determined in June 2017, that the system became unstable when the number of simultaneous simulated public users reached 500. However, by December 2017, the system had demonstrated that it could accept a capacity of over 3,000 simultaneous public users without a service disruption.

FCC data showed that the increased capacity and improved performance of the ECFS prevented further service disruptions during periods of sharp spikes in the volume of comments received. For example, on May 8, 2017, service was disrupted on the system when it received a peak of about 249,000 comments in 1 day, whereas on July 12, 2017, the system accepted and processed at least 1.4 million comments in 1 day without a reported service disruption. Similar spikes in traffic volumes that occurred through December 2017 also did not result in service disruptions. Figure 3 shows the daily comment submissions to ECFS from May 2017 through December 2017 and demonstrates FCC’s ability to accept a higher volume of comments without a service disruption.

FCC Did Not Consistently Implement Security Controls, Which Placed Selected Systems at Risk

We reported in September 2019 that FCC had implemented numerous security controls for the three systems we reviewed, but it had not consistently implemented the NIST cybersecurity framework’s five core security functions to effectively protect the confidentiality, integrity, and availability of these systems and the information maintained on them. Deficiencies existed in the FCC information security program and technical controls for the five core functions that were intended to (1) identify risk, (2) protect systems from threats and vulnerabilities, (3) detect cybersecurity events, (4) respond to these events, and (5) recover system operations when disruptions occur. These deficiencies increased the risk that sensitive information could be disclosed or modified without authorization or be unavailable when needed.

As shown in table 1, deficiencies existed in all five core security functions for the FCC systems we reviewed. Also shown are the numbers of recommendations we made to FCC to rectify the deficiencies.

FCC Generally Identified Risks and Developed Security Plans for Selected Systems, but Shortcomings Remained

Activities associated with the identify core security function are intended to help an agency to develop an understanding of its resources and related cybersecurity risks to its organizational operations, systems, and data. Essential elements of a FISMA-mandated information security program include assessing risks, developing system security plans, and authorizing information systems to operate. NIST guidance states that agencies should assess risks and authorize systems on an ongoing basis. Additionally, FCC requires that security plans, risk assessments, and system authorizations be reviewed annually or whenever significant changes occur to the information system, computing environment, or business operations.

Consistent with its guidance, FCC had developed system security plans for each of the three systems we reviewed and had updated the risk assessments for two of the systems in 2017 and 2018, respectively. However, as of March 2019, the commission had not reviewed or updated the risk assessment for the third system reviewed since May 2017—a lag of about 22 months. Commission officials stated that they had not reviewed or updated the system’s risk assessment because the commission had implemented a new risk assessment process and officials had not yet had time to review and update documentation for this system.

In addition, FCC continued to operate two of the three selected systems on expired authorizations to operate. Although FCC granted a full authorization to operate to one system in May 2018, the commission allowed the authorizations for the other two systems we reviewed to expire. Both of these systems had received a conditional authorization to operate so that the systems could continue to operate while the commission mitigated known system vulnerabilities. However, in December 2018, the conditional authorizations for both systems expired because, according to FCC officials, the commission had not mitigated the vulnerabilities. Nevertheless, FCC continued to operate the systems.

By not regularly updating the risk assessment of one system and continuing to operate another system without a current authorization to operate, FCC unnecessarily exposed the information on these systems to increased risks of unauthorized changes and access to information.

Subsequent to our September 2019 report, FCC reviewed and updated the system’s risk assessment in accordance with its new risk assessment process. In addition, FCC granted a full authorization to operate to one of the systems in October 2019, but does not expect to grant a full authorization to operate for the other system until later in 2020.

FCC’s Contract Provisions with Its Cloud Service Provider Did Not Reflect All Applicable Security Requirements

NIST SP 800-144, Guidelines on Security and Privacy in Public Cloud Computing, states that a service-level agreement should define the terms and conditions for access and use of the services offered by the cloud service provider. In addition, FedRAMP Control Specific Contract Clauses provides security control specifications that may need to be included in the task order for the service and specified in the service level agreement. These contract clauses include specifications related to data jurisdiction, audit records storage, time frames for reporting security incidents, and system boundary protection.

FCC’s task order and service level agreement with its cloud service provider specified activities the provider was to perform, such as providing access and support for products and services, and completing performance deliverables to ensure service availability. However, FCC had not documented specific contract clauses associated with implementing security control requirements related to retaining audit records, meeting reporting incident time frames, and protecting system boundaries in accordance with FedRAMP.

According to FCC’s associate chief information officer, the commission relied on FedRAMP’s oversight to ensure that its cloud provider implemented security controls that comply with federal data requirements. However, FedRAMP assesses and monitors only the security controls that the program and cloud service provider agree that the provider will implement. These agreed-upon controls may not include an agency’s specific security requirements. Thus, responsibility falls on FCC to ensure that its information security requirements are being implemented in cloud computing environments.

Nevertheless, by not specifying its specific control requirements when procuring services from its cloud provider, FCC increased the risk that its data and sensitive regulatory information will not be adequately protected in the event that its cloud service provider experiences a security breach.

Subsequent to our September 2019 report, FCC developed a plan of action and milestones (POA&M) for this deficiency and stated that it plans to rectify the deficiency by May 2020.

FCC Did Not Consistently Implement Appropriate Safeguards to Protect Information on Selected Systems

Activities associated with the protect core security function are intended to help agencies develop and implement appropriate system safeguards. These activities include limiting access to computing resources to authorized users, processes and devices; encrypting data to protect its confidentiality and integrity; configuring devices securely; and updating software to protect systems from known vulnerabilities.

FCC implemented activities that established multiple layers of technical controls, including access controls and firewalls, encryption of sensitive data, and system configuration management. However, we reported in September 2019 that implementation of these technical controls were not consistent. For example, 37 technical control deficiencies and an information security program-related deficiency diminished the effectiveness of the controls protecting the systems we reviewed. A brief summary of the results of our tests of FCC’s controls for protecting the three systems we reviewed follows.

FCC Did Not Consistently Implement Effective Access Controls

FCC policy states that, in accordance with NIST SP 800-53 guidelines, users should not share the same identifier and the commission should configure its information systems to require users to create complex passwords. FCC’s policy also stipulates that the commission employ the principle of “least privilege” and enforce approved authorizations for controlling the flow of information within the system and between interconnected systems.

However, FCC did not consistently implement technical controls to effectively limit access to the systems we reviewed, as the following examples illustrate.

Although FCC policy states that individual user accounts are not to be shared, the commission allowed multiple users to share the credentials of several privileged accounts.

While FCC policy established minimum requirements for password complexity and account lock-out provisions, the commission did not routinely enforce these requirements.

While FCC policy requires limiting access rights for users to only those they need to perform their work, the commission inappropriately granted excessive permissions to users to access server configuration files.

Although FCC established a policy for monitoring and controlling access between systems, it did not securely configure network devices to effectively control access and communications between systems.

Access control deficiencies existed primarily because FCC network administrators did not adequately monitor configuration settings and did not implement sufficient controls to enforce consistent authentication and authorization across all of the commission’s systems that we reviewed.

However, until FCC fully implements those actions and remediates related technical deficiencies, the commission remains at increased risk that unauthorized individuals or attackers could obtain inappropriate access to its network devices, firewalls, and servers, and compromise its network.

As of November 2019, FCC had acted to address several technical control deficiencies related to access control.

FCC Did Not Consistently Encrypt Sensitive Data

NIST SP 800-53 recommends that organizations employ cryptographic mechanisms to prevent the unauthorized disclosure of information during transmission and establish a trusted communications path between users and security functions of information systems. NIST also requires that, when agencies use encryption, they use an encryption algorithm that complies with FIPS Publication 140-2. In addition, FCC’s System and Communication Protection Policy states that confidentially sensitive data must be encrypted before being transmitted using any nonprotected communication method and that all passwords must be encrypted.

However, in seven instances, the commission did not consistently deploy strong encryption capabilities to protect sensitive data or establish a secure communications path between users and information systems. For example, FCC sometimes sent data in clear text over the network and did not enable FIPS 140-2 compliant encryption algorithms on certain devices. These deficiencies existed primarily because commission personnel did not adequately monitor configuration settings. By not consistently deploying strong encryption capabilities, FCC limits its ability to protect the confidentiality and integrity of its sensitive information.

According to Information Technology Center officials, as of November 2019, the commission was still working toward full compliance with federal encryption standards.

FCC Did Not Consistently Configure Servers Securely or Update Software in a Timely Manner

NIST SP 800-53 states that agencies should configure security settings to the most restrictive mode consistent with operational requirements and disable services within the information system deemed to be unnecessary or non-secure. FCC policy on risk assessment states that systems and devices should be scanned periodically and software patches should be applied for all known critical security vulnerabilities. In addition, OMB Circular A-130 states that agencies are to implement current updates and patches for all software components of information systems, and prohibit the use of unsupported systems and system components.

Although FCC established policies for applying software patches on a prescribed basis, it did not update software in a consistent or timely manner to effectively protect the three systems we reviewed. For example, FCC did not apply software patches in a timely manner to resolve known security vulnerabilities, and used unsupported or out-of- date system software on multiple network devices, firewalls, and servers.

Patching control deficiencies existed because FCC did not adequately monitor configuration settings of devices on its network. According to Information Technology Center officials, as of February 2019, the commission was in the process of (1) migrating and modernizing its systems’ portfolio and (2) implementing an application monitoring and testing tool to reduce patching times. However, until FCC applies software patches in a timely manner, and replaces unsupported software and devices, it will remain at increased risk that individuals could exploit known vulnerabilities to gain unauthorized access to its computing resources.

As of November 2019, FCC had taken corrective actions to address certain technical control deficiencies related to configuring servers securely and updating software in a timely manner.

Although FCC Had Documented Security Policies, It Had Not Documented Operational Procedures

Developing, documenting, and implementing information security policies and procedures are essential elements of an agency’s FISMA-mandated information security program. FCC’s Policy for Information Security and Privacy states that FCC shall implement procedures and controls at all levels to protect the confidentiality and integrity of information stored and processed on the commission’s systems, and to ensure that the systems and information are available to authorized persons when required.

Although FCC developed and documented commission-wide policies addressing the 18 control areas—such as access control, configuration management, security awareness training, and contingency planning— identified in NIST SP 800-53, the commission had not fully developed or documented the detailed operating procedures that are needed to effectively implement its security policies. For example, FCC had not documented detailed procedures for implementing the following NIST- specified control areas: (1) access control, (2) configuration management, (3) identification and authentication, (4) system maintenance, (5) media protection, (6) physical and environmental protection, (7) information security program management, (8) risk assessment, (9) system and services acquisition, (10) system and communication protection, and (11) system and information integrity. The lack of detailed operating procedures likely was an underlying cause for many of the technical control deficiencies we identified.

According to the FCC CISO, as of February 2019, the commission was in the process of reviewing and revising its information security policies and had issued POA&Ms to develop and document the missing procedures. Nevertheless, until FCC fully develops and documents detailed operating procedures for implementing its security policies, the commission faces increased risks that it will not effectively protect its information systems and information from cyber threats.

FCC Had Not Effectively Implemented Controls Intended to Detect Cybersecurity Events or Deficiencies

The detect core security function is intended to allow for the timely discovery of cybersecurity events and deficiencies. Controls associated with this function include logging and monitoring system activities, and assessing security controls in place. NIST SP 800-53 states that agencies should enable system logging features and retain sufficient audit logs to support the investigations of security incidents and monitoring of select activities for significant security-related events. Additionally, NIST SP 800-53 and industry leading practices state that organizations should increase their situational awareness through enhanced monitoring capabilities to analyze network traffic data over an extended period of time at external boundaries and inside their internal network to identify anomalous, inappropriate, or unusual malicious activities. Lastly, FISMA requires each agency to periodically test and evaluate the effectiveness of its information security controls in place applicable to policies, procedures, and practices.

In September 2019, we reported that FCC had implemented security monitoring controls, such as performing regular vulnerability scanning and deploying a system information and event management tool, to detect the presence of potential malicious threats. However, six technical control deficiencies in these capabilities diminished the effectiveness of the controls to detect cybersecurity events in the systems we reviewed. For example, FCC did not fully capture system log data on certain devices and had limited network monitoring visibility into portions of its data center environment.

According to Information Technology Center officials, FCC had deficiencies in logging, retention, and monitoring because the commission had not fully configured its security information and event monitoring tool to capture and monitor sufficient system log and network traffic data to adequately detect cybersecurity events. As a result, FCC may not be able to detect or investigate anomalous activities inside its network.

In addition, although the commission established a process for assessing the effectiveness of the security controls for its systems, its control tests and evaluations were not sufficiently robust. For example, the commission’s evaluations did not identify many of the security control deficiencies we identified. Consequently, FCC had limited assurance that the security controls were in place and operating as intended.

As of November 2019, FCC had acted to address several technical control deficiencies, and associated recommendations, such as capturing network traffic data and providing for real-time network monitoring; however, other technical control deficiencies remain.

FCC Did Not Fully Implement Its Incident Response Controls and Remediate Deficiencies in a Timely Manner

The respond core security function is intended to support the ability to contain the impact of a potential cybersecurity event. Controls associated with this function include implementing an incident response capability and remediating newly identified deficiencies.

We reported in September 2019 that, as part of its information security program, FCC had implemented controls for incident response by developing, documenting, and annually updating its incident handling policy and procedures, along with its guidelines for remediating deficiencies. However, two information security program-related deficiencies and a technical control deficiency diminished the effectiveness of the controls to respond to cybersecurity events for the systems we reviewed. For example, the commission did not adequately address security incidents and mitigate known deficiencies in a timely manner.

FCC Had Developed and Documented an Incident Response Capability, but Did Not Report Several Incidents in a Timely Manner

NIST SP 800-53 and SP 800-61 state that agencies should develop, document, and implement incident response policy and procedures, and keep them updated according to agency requirements. FCC incident response policy also states that all employees are required to report suspected security incidents to the FCC Network Security Operations Center (NSOC) group within 1 hour of discovery or detection, and all other incidents within 24 hours of discovery. Further, FCC’s incident response procedures require internal escalation and external notification to the United States Computer Emergency Readiness Team (US-CERT) within 1 hour.

FCC had developed, documented, and updated its incident response policy and procedures on an annual basis to address security incidents.

The commission also established a NSOC group as the single point of contact for potential security incidents.

However, FCC did not report internally to the NSOC group or externally to US-CERT in a timely manner for three of 10 security incidents we reviewed. Specifically,

A FCC employee took 2 days to report the existence of an information spillage incident to the NSOC instead of the required 1-hour reporting time frame.

The NSOC group took approximately 4 hours to report a December 2017 distributed denial-of-service attack incident and a February 2018 malicious attack incident to the US-CERT, instead of the 1 hour required for each.

According to the FCC CISO, the commission plans to review its incident response policy and procedures, as well as re-train its staff, to ensure that staff consistently follow the commission’s policy and US-CERT incident notification guidelines.

Subsequent to the issuance of our September 2019 report, FCC indicated that it plans to address these matters by October 2020. Until it does so, the commission may impede its ability to receive timely assistance from appropriate federal agencies and mitigate any harm.

FCC Had Action Plans to Remedy Identified Deficiencies for Selected Systems, but Did Not Implement Them in a Timely Manner

NIST 800-53 states that agencies are to develop a POA&M for an information system to document the agencies’ planned remedial actions to correct identified deficiencies. FCC’s Plan of Action and Milestone Guide also states that the maximum completion time frames for implementing POA&M items related to critical and high severity level deficiencies are 30 and 60 days, respectively.

Although FCC developed a remedial action process and maintained a management system to document and track the status of POA&M items, it did not complete remedial actions in a timely manner for the three systems we reviewed. Specifically, FCC did not remedy critical and high severity level deficiencies within the required time frames as stated in its policy. For example,

FCC took an average of approximately 3 months to implement four critical severity level POA&M items for one system.

FCC took an average of more than 1 year to remediate three critical and nine high severity level POA&M items for another system. Additionally, as of October 2018, this system had seven open critical and four open high severity level POA&M items that exceeded the remediation threshold on average by 1 year, 4 months, and 5 months, respectively.

FCC took an average of more than 3 years to implement two critical and seven high severity level POA&M items for the third system.

FCC officials attributed these delays to operational priorities and resource constraints, such as financial, personnel, and technological factors. However, such longstanding delays in remediating weaknesses pose a significant threat to the overall security posture of the commission, since the delays could allow intruders to exploit critical and high severity level deficiencies to gain access to FCC’s information resources.

As of November 2019, FCC stated that it planned to address security program deficiencies related to remediating weaknesses in a timely manner by October 2020.

FCC Developed Contingency Plans, but Had Not Developed Restoration Procedures or Conducted Annual Disaster Recovery Testing

The recover core security function is intended to support timely recovery of system operations to reduce the impact from a cybersecurity event. Controls associated with this function include developing and testing contingency plans to ensure that, when unexpected events occur, critical operations can continue without interruption or can be promptly resumed, and that information resources are protected.

In September 2019, we reported that, as part of its information security program, FCC had developed contingency plans for selected systems and established priorities for application disaster recovery. However, two information security program-related deficiencies diminished the effectiveness of the controls to recover the systems we reviewed. Specifically, the commission did not document detailed procedures for restoring two of the three systems conduct an annual test of its disaster recovery plan for the three selected systems in fiscal year 2018.

FCC Established Contingency Plan Restoration Procedures for One System, but Had Not Fully Documented Restoration Procedures for Two Other Systems Reviewed

NIST SP 800-34 Contingency Planning Guide for Federal Information Systems states that an information system contingency plan should provide detailed procedures to restore the information system or components to a known state. In addition, FCC’s Policy for Contingency Planning states that system contingency plans should reflect the restoration activities required for information systems to recover after an incident.

FCC developed and documented a contingency plan for one system that specified detailed procedures for restoring system operations, data, and supporting applications. However, FCC did not include detailed procedures for restoring the other two systems we reviewed in their respective contingency plans—both of which are major application systems. For example, the contingency plans for these two systems did not specify procedures for restoration activities such as restoring critical operating system, application software, and system data to a known state.

According to Information Technology Center officials, they did not consider the two systems as supporting mission essential functions, which would necessitate the inclusion of the applications in the detailed restoration procedures. However, both of the systems are major application systems and support mission essential functions at FCC.

Subsequent to our September 2019 report, FCC documented detailed restoration procedures in the two other systems’ contingency plans that included activities associated with restoring critical operating system, application software, and system data to a known state. By doing so, FCC increased the likelihood that it will be able to restore operations to its mission essential functions in the event of a disaster.

FCC Had Not Tested Disaster Recovery Capabilities on an Annual Basis

NIST SP 800-84 states that a disaster recovery test should assess the ability of an agency to restore IT processing capabilities in the event of a disruption. Moreover, FCC’s policy for contingency planning states that all information system and facility disaster recovery plans should be tested annually to determine the effectiveness of the plan and the organizational readiness to execute the plan.

In September 2019, we reported that FCC did not conduct test exercises of the disaster recovery plans for the three systems we reviewed during fiscal year 2018, nor did it test system backup, recovery, restoration, and reconstitution procedures for these systems. According to FCC officials, the test exercise did not take place in fiscal year 2018 because other business operation activities took precedence over the exercise since the test exercise requires all mission-essential function applications to be unplugged.

As a result, FCC had limited assurance that it would be able to recover from unexpected disruptions in a timely and efficient manner. While it did not complete the exercise in fiscal year 2018, FCC did subsequently conduct a disaster recovery exercise at the beginning of fiscal year 2019. By doing so, FCC increased its assurance that it would be able to recover use of its systems from unexpected disruptions in a timely and efficient manner.

FCC Has Implemented Most Recommendations in Our September 2019 Report and Plans to Implement the Remainder

In our September 2019 report, we made 136 recommendations to FCC to bolster its agency-wide information security program and strengthen its technical security controls. Specifically, we recommended that FCC take nine actions to improve its information security program by, among other things, authorizing systems to operate, documenting operating procedures, resolving known vulnerabilities and reporting security incidents in a timely manner, and testing disaster recovery plans. We also recommended that FCC take 127 actions to address technical control deficiencies by implementing stronger access controls, encrypting sensitive data, configuring network devices securely, strengthening firewall rules, implementing audit and monitoring controls more effectively, among other actions.

Since the issuance of our September 2019 report, FCC has made significant progress in implementing the recommendations we made to improve its information security program and resolve the technical control deficiencies in the information systems we reviewed.

Specifically, as of November 2019, FCC had implemented 85 (63 percent) of the 136 recommendations we made in the September 2019 report and had effectively resolved the underlying deficiencies associated with the recommendations. The commission also had partially, but not fully, implemented 10 recommendations. In these instances, FCC provided evidence that it had resolved a portion of the underlying control deficiency, but had not completed all of the actions necessary to fully resolve the underlying control deficiencies. FCC did not provide any evidence that it had begun implementing the remaining 41 (30 percent) recommendations. The status of our recommendations to FCC is illustrated in figure 4.

Table 2 provides additional details on the status of FCC’s actions to implement our recommendations to improve its information security program and the technical controls for the systems we reviewed.

By implementing 85 recommendations, FCC (as of November 2019) had reduced risks associated with certain key activities. Specifically, FCC’s actions to implement four information security program-related recommendations included conducting a disaster recovery test exercise, documenting detailed system restoration procedures, and updating risk assessments to reflect the commission’s current computing environment.

Regarding the technical controls, the commission had implemented 81 of our recommendations to rectify technical control-related deficiencies. For example, FCC strengthened firewall rules and access controls on its information system servers and internal networks—that we highlighted in our September 2019 report as being particularly vulnerable and requiring the commission to take immediate corrective actions.

FCC also had developed a POA&M for each of the identified information security program-related and technical control deficiencies that remained open as of November 2019. The POA&M items contained required elements, such as severity levels (i.e., high, medium, and low) for identified weaknesses; identified estimated costs; designated points of contact; and established time frames for resolving those weaknesses and fully implementing the related recommendations. The commission’s plans called for it to implement the majority of the remaining information security program and technical control-related recommendations by May 1, 2020, and all recommendations by April 30, 2021, as shown in figure 5.

Fully implementing the remaining recommendations is essential to ensuring that the commission’s systems and sensitive information are adequately protected from cyber threats. Key actions that remain include: documenting operational procedures, applying security patches and software updates, and enhancing network monitoring capabilities.

Until FCC fully implements all of our recommendations and resolves the associated deficiencies, its information systems and information will remain at increased risk of misuse, improper disclosure or modification, and loss.

Agency Comments

We received written comments on a draft of this report from FCC. In its comments, which are reprinted in appendix IV, the commission expressed its commitment to protecting the confidentiality, integrity, and availability of its information systems. FCC noted our evaluation of its efforts to implement 85 of the 136 recommendations made in our September 2019 report and stated that it had also addressed nine additional recommendations. The commission further stated that it plans to address the remaining recommendations over the next 14 months with full mitigation anticipated by April 2021.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the appropriate congressional committees. We are sending copies of this report to the appropriate congressional committees, the Federal Communications Commission, the commission’s Office of the Inspector General, and interested congressional parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, our primary point of contact is Vijay A. D’Souza at (202) 512-6240 or dsouzav@gao.gov. You may also contact Seto J. Bagdoyan at (202) 512-4749 or bagdoyans@gao.gov. GAO staff who made key contributions to this report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to determine 1) the actions FCC took to respond to the May 2017 event that affected the Electronic Comment Filing System (ECFS), and 2) the extent to which FCC implemented security controls to effectively protect the confidentiality, integrity, and availability of selected systems. In September 2019, we issued a report which detailed the findings from our work in response to these two objectives. In the report, we made 127 recommendations to FCC to resolve the technical security control deficiencies in the information systems we reviewed and nine additional recommendations to improve its information security program. We designated that report as “limited official use only” (LOUO) and did not release it to the general public because of the sensitive information it contained.

This report publishes the findings discussed in our September 2019 report, but we have removed all references to the sensitive information. Specifically, we deleted the names of the information system software, network devices, and resource tools that we examined, disassociated identified control deficiencies from named systems, deleted certain details about information security controls and control deficiencies, and omitted an appendix that was contained in the LOUO report. The appendix contained sensitive details about the technical security control deficiencies in the FCC’s information systems and computer networks that we reviewed, and the 127 recommendations we made to mitigate those deficiencies. We also provided a draft of this report to FCC officials to review and comment on the sensitivity of the information contained herein and to affirm that the report can be made available to the public without jeopardizing the security of the commission’s information systems and networks.

In addition, this report addresses a third objective that was not included in the September 2019 report. Specifically, this objective was to determine the extent to which FCC had taken corrective actions to address the previously identified security program and technical control deficiencies and related recommendations for improvement that we identified in the earlier report.

To address the first objective, we reviewed FCC’s security and incident response policies and procedures, examined related reports prepared by the commission and its Office of Inspector General, reviewed an internal assessment of the May 2017 event that was performed by the FCC Information Technology Center, and reviewed artifacts associated with system enhancement and performance such as change requests and email. We also extracted comment submission data derived from the data.gov application programming interface between May 1, 2017 and December 31, 2017 to identify the peak periods of increased comment submissions during and after the May 2017 event.

In addition, we examined the aforementioned documents to assess whether the updated incident response policy and procedures, along with system enhancement and performance artifacts, were directly related to changes made subsequent to the May 2017 event. Lastly, we interviewed FCC Information Technology Center officials, including system and security staff, and Office of Inspector General officials to identify FCC’s actions to respond to the May 2017 event.

To address the second objective, we reviewed FCC’s overall network environment, identified interconnectivity and control points, and examined controls for the commission’s networks and facilities. We performed this work at FCC facilities located in West Virginia, Pennsylvania, and Washington, D.C.

As noted in our September 2019 report, we determined the extent to which FCC had implemented security controls to effectively protect the confidentiality, integrity, and availability of selected systems. To do so, we selected three of the commission’s information systems for review. We selected these systems because they (1) are essential to FCC’s mission and (2) were assigned a Federal Information Processing Standards Publication 199 rating of moderate or high impact. The results of our review of these systems is not generalizable to the commission’s other systems.

To evaluate FCC’s controls for its information systems, we used GAO’s Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized information. We based our assessment of controls on requirements of the Federal Information Security Modernization Act of 2014 (FISMA), which establishes key elements for an effective agency-wide information security program; National Institute of Standards and Technology (NIST) guidelines and standards; FCC policies and procedures; and standards and guidelines from relevant security organizations, such as the National Security Agency, and the Center for Internet Security.

For reporting purposes, we categorized the security controls that we assessed into the five core security functions described in the NIST cybersecurity framework. The five core security functions are: Identify: Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities.

Protect: Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services.

Detect: Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event.

Respond: Develop and implement the appropriate activities to take action regarding a detected cybersecurity event.

Recover: Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event.

These core security functions are described in more detail in appendix II.

For each of the five core security functions, we examined selected FCC security controls and related documentation:

For the identify core security function, we examined FCC’s reporting for its hardware and software assets; analyzed risk assessments for the three selected systems to determine whether threats and vulnerabilities were being identified; analyzed FCC policies and procedures to determine their effectiveness in providing guidance to personnel responsible for securing information and information systems; and analyzed security plans for the three selected systems to determine if those plans had been documented and updated according to federal guidance.

For the protect core security function, we examined access controls for the three systems. These controls included the password complexity and settings to determine if password management was being enforced; administrative users’ system access permissions to determine whether their authorizations exceeded the access necessary to perform their assigned duties; and firewall configurations, among other things, to determine whether system boundaries had been adequately protected. We also examined configurations for providing secure data transmissions across the network to determine whether sensitive data were being encrypted. In addition, we examined configuration settings for routers, network management servers, switches, and firewalls to determine if settings adhered to configuration standards, and we inspected key servers and network devices to determine if critical patches had been installed and/or were up to date.

For the detect core security function, we analyzed security control assessments, and centralized logging and network traffic monitoring capabilities for key assets connected to the network.

For the respond core security function, we reviewed FCC’s implementation of incident response practices, including an examination of incident tickets for 10 incidents the commission considered most significant from January 1, 2017 to May 29, 2018; and examined the commission’s process for correcting identified deficiencies for the three selected systems.

For the recover core security function, we examined contingency and disaster recovery plans for the three selected systems to determine whether those plans had been developed and tested.

For the core security functions, as appropriate, we evaluated elements of FCC’s information security program. For example, we analyzed risk assessments, security plans, remedial action plans, and contingency plans for each of the three selected systems. We also evaluated FCC’s security policies and procedures. In assessing FCC’s controls associated with these core functions, we interviewed FCC’s Information Technology Center personnel, chief information officer, chief information security officer, general counsel, inspector general, and Public Safety and Homeland Security Bureau officials, as needed.

To determine the reliability of FCC’s computer-processed data for incident response records, we evaluated the materiality of the data to our audit objective and assessed the data by various means, including reviewing related documents, interviewing knowledgeable FCC officials, and reviewing internal controls. Through a combination of these methods, we concluded that the data were sufficiently reliable for the purposes of our work.

To accomplish our third objective—on FCC’s actions to address the previously identified security program and technical control deficiencies and related recommendations—we requested that the commission provide a status report of its actions to implement each of the recommendations. For each recommendation that FCC indicated it had implemented as of November 2019, we examined supporting documents, observed or tested the associated security control or procedure, and/or interviewed the responsible agency officials to assess the effectiveness of the actions taken to implement the recommendation or otherwise resolve the underlying control deficiency. Based on this assessment and FCC status reports, we defined the status of each recommendation according to three categories: fully implemented—FCC had implemented the recommendation (i.e., the commission provided evidence showing that it had effectively resolved the underlying control deficiency); partially implemented—FCC had made progress toward, but had not completed implementing the recommendation (i.e., the commission provided evidence showing that it had effectively resolved a portion of the underlying control deficiency); and not started—FCC did not provide evidence that it had acted to implement the recommendation (i.e., the commission provided no evidence showing that it had effectively resolved the underlying control deficiency).

We conducted the performance audit for the first two objectives from February 2018 through September 2019 in accordance with generally accepted government auditing standards. We conducted work supporting the third objective and, where applicable, included updates to our work in the second objective, from October 2019 through March 2020 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings.

Appendix II: National Institute of Standards and Technology’s Cybersecurity Framework

The National Institute of Standards and Technology’s cybersecurity framework consists of five core functions: identify, protect, detect, respond, and recover. Within the five functions are 23 categories and 108 subcategories of security-related controls (see table 3).

Appendix III: Timeline of May 2017 Event Involving the FCC Electronic Comment Filing System

Below is a timeline of the Federal Communications Commission’s (FCC) May 2017 Electronic Comment Filing System (ECFS) event and subsequent related events:

On April 27, 2017, FCC issued the Restoring Internet Freedom Notice of Proposed Rulemaking in the Federal Register. The notice directed interested parties to submit comments via FCC’s ECFS.

On the evening of May 7, 2017, a late night talk show aired a segment on the Restoring Internet Freedom notice and encouraged viewers to submit comments via ECFS.

On the evening of May 7, 2017, according to a report by the FCC Office of Inspector General (IG), ECFS experienced a significant increase in the level of comment traffic attempting to access the system, resulting in the disruption of system availability. A contractor providing web performance and cloud security solutions to FCC identified a 3,116 percent increase in traffic to ECFS between May 7 and May 8, 2017.

In the early morning of May 8, 2017, ECFS became unavailable to commenters. FCC’s vendor sent automated alerts indicating a spike in network traffic, in addition to preliminary network statistical data, to FCC.

During the mid-morning of May 8, 2017, FCC’s Information Technology Center responded to the alerts from the vendor and initiated stabilization efforts to ECFS.

During the afternoon of May 8, 2017, FCC issued a press release in which FCC’s chief information officer (CIO) at that time provided a statement about the cause of delays experienced by commenters trying to file comments on the ECFS. The CIO’s statement said that FCC was subjected to multiple distributed denial-of-service attacks. He further stated that, “these were deliberate attempts by external actors to bombard the FCC’s comment system with a high amount of traffic.”

During May 9-10, 2017, FCC restored ECFS but still experienced response-time problems relating to system performance.

On May 10, 2017, FCC’s Information Technology Center responded to inquiries from the Federal Bureau of Investigations and FCC OIG via email and phone.

On June 21, 2017, the FCC OIG opened a full investigation into the event because of, according to the OIG, the importance of FCC’s cybersecurity posture and the possibility that cybercrimes had been committed that had the potential of being ongoing threats to the integrity of FCC’s computer systems.

On January 4, 2018, FCC OIG referred the investigation to the Justice Department.

On August 7, 2018, the FCC OIG published an investigative report on the ECFS event. According to the OIG report, the allegations of multiple distributed denial-of-service attacks alleged by the FCC CIO at that time were not substantiated. The FCC OIG concluded that the spikes in web traffic to ECFS had coincided exactly with the timing of the late night television show where the host discussed the FCC’s Restoring Internet Freedom proceeding and encouraged viewers to visit the commission’s website and file comments. The FCC OIG’s report also indicated that the commission did not define the event (i.e., any observable occurrence in a network or system) as a cybersecurity incident (i.e., an imminent threat or violation of computer security policies, or security practices). Therefore, according to the OIG report, FCC did not take actions to: refer the matter to the United States Computer Emergency Readiness Team (US-CERT) in accordance with federal policy, implement internal incident handling procedures in accordance with its incident handling policy, or conduct a thorough analysis before or after the event to determine if it was an incident.

On August 16, 2018, the FCC Chairman testified at a Senate Committee on Commerce, Science and Transportation oversight hearing on the conclusions of the FCC OIG investigative report on the ECFS event.

Appendix IV: Comments from the Federal Communications Commission

Appendix V: GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the contacts named above, Gary Austin, David Bruno, Tammi Kalugdan, Duc Ngo, and Christopher Warweg (assistant directors); David Hong (analyst-in-charge); Breanne Cave; Chris Businsky, Jr.; Saar Dagani; Marshall Williams, Jr.; Corey Evans; Andrew Howard; Elizabeth Kowalewski; Priscilla Smith; Henry Sutanto; and April Yeaney made significant contributions to this report.