Information Security: Department of Homeland Security Faces Challenges in Fulfilling Statutory Requirements
Released: 2005-04-14T00:00:00

Letter

Background

Since the early 1990s, increasing computer interconnectivity—most notably growth in the use of the Internet—has revolutionized the way that our government, our nation, and much of the world communicate and conduct business. While the benefits have been enormous, without proper safeguards, this widespread interconnectivity also poses significant risks to the government’s computer systems and, more importantly, to the critical operations and infrastructures they support.

We recently reported that, while federal agencies showed improvement in addressing information security, they also continued to have significant control weaknesses in federal computer systems that put federal operations and assets at risk of inadvertent or deliberate misuse, financial information at risk of unauthorized modification or destruction, sensitive information at risk of inappropriate disclosure, and critical operations at the risk of disruption. The significance of these weaknesses led us to conclude in the audit of the federal government’s fiscal year 2004 financial statements that information security was a material weakness. Our audits also identified instances of similar types of weaknesses in non-financial systems. Weaknesses continued to be reported in each of the six major areas of general controls—the policies, procedures, and technical controls that apply to all or a large segment of an entity’s information systems and help ensure their proper operation.

To fully understand the significance of the weaknesses we identified, it is necessary to link them to the risks they present to federal operations and assets. Virtually all federal operations are supported by automated systems and electronic data, and agencies would find it difficult, if not impossible, to carry out their missions and account for their resources without these information assets. Hence, the degree of risk caused by security weaknesses is high. The weaknesses identified place a broad array of federal operations and assets at risk. For example: ● resources, such as federal payments and collections, could be lost ● computer resources could be used for unauthorized purposes or to launch attacks on others; ● sensitive information, such as taxpayer data, social security records, medical records, and proprietary business information could be inappropriately disclosed, browsed, or copied for purposes of industrial espionage or other types of crime; ● critical operations, such as those supporting national defense and emergency services, could be disrupted; ● data could be modified or destroyed for purposes of fraud, identity theft, or disruption; and ● agency missions could be undermined by embarrassing incidents that result in diminished confidence in their ability to conduct operations and fulfill their fiduciary responsibilities.

Congress and the administration have established specific information security requirements in both law and policy to help protect the information and information systems that support these critical operations and assets.

FISMA Authorized and Strengthened Information Security Requirements

Enacted into law on December 17, 2002, as Title III of the E- Government Act of 2002, FISMA authorized and strengthened information security program, evaluation, and reporting requirements. FISMA assigns specific responsibilities to agency heads, chief information officers, and IGs. It also assigns responsibilities to OMB, which include developing and overseeing the implementation of policies, principles, standards, and guidelines on information security and reviewing at least annually, and approving or disapproving, agency information security programs.

Overall, FISMA requires each agency to develop, document, and implement an agencywide information security program. This program should provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. Specifically, this program is to include: ● periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems; ● risk-based policies and procedures that cost-effectively reduce information security risks to an acceptable level and ensure that information security is addressed throughout the life cycle of each information system; ● subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems; ● security awareness training for agency personnel, including contractors and other users of information systems that support the operations and assets of the agency; ● periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; ● a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; ● procedures for detecting, reporting, and responding to security ● plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency.

FISMA also established a requirement that each agency develop, maintain, and annually update an inventory of major information systems operated by the agency or that are under its control. This inventory is to include an identification of the interfaces between each system and all other systems or networks, including those not operated by or under the control of the agency.

Each agency is also required to have an annual independent evaluation of its information security program and practices, including control testing and compliance assessment. Evaluations of non-national security systems are to be performed by the agency IG or by an independent external auditor, while evaluations related to national security systems are to be performed only by an entity designated by the agency head.

The agencies are to report annually to OMB, selected congressional committees, and the Comptroller General on the adequacy of information security policies, procedures, practices, and compliance with FISMA requirements. In addition, agency heads are required to make annual reports of the results of their independent evaluations to OMB. OMB is also required to submit a report to Congress no later than March 1 of each year on agency compliance, including a summary of the findings of agencies’ independent evaluations.

Other major provisions require NIST to develop, for systems other than national security systems: (1) standards to be used by all agencies to categorize all their information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels; (2) guidelines recommending the types of information and information systems to be included in each category; and (3) minimum information security requirements for information and information systems in each category. NIST must also develop a definition and guidelines concerning detection and handling of information security incidents and guidelines, developed in conjunction with the Department of Defense (DOD) and the National Security Agency, for identifying an information system as a national security system.

OMB Reporting Instructions and Guidance Emphasize Performance Measures

Consistent with FISMA requirements, OMB issues guidance to the agencies on their annual reporting requirements. On August 23, 2004, OMB issued its fiscal year 2004 reporting instructions. The reporting instructions, similar to the 2003 instructions, emphasized a strong focus on performance measures and formatted these instructions to emphasize a quantitative response. OMB has developed performance measures in the following areas, including: ● certification and accreditation, ● annual review of agency systems, ● annual review of contractor operations or facilities, ● annual security awareness training for employees and contractors, ● annual specialized training for employees with significant security ● testing of contingency plans.

Further, OMB provided instructions for continued agency reporting on the status of remediation efforts through plans of action and milestones. Required for all programs and systems where an IT security weakness has been found, these plans list the weaknesses and show estimated resource needs or other challenges to resolving them, key milestones and completion dates, and the status of corrective actions. The plans are to be submitted twice a year. In addition, agencies are to submit quarterly updates that indicate the number of weaknesses for which corrective action was completed on time (including testing), is ongoing and on track to be completed as originally scheduled, or has been delayed, as well as the number of new weaknesses discovered since the last update.

The IGs’ reports were to be based on the results of their independent evaluations, including work performed throughout the reporting period (such as financial statements or other audits). While OMB asked the IGs to respond to the same questions as the agencies, it also asked them to assess whether their agency had developed, implemented, and was managing an agencywide plan of actions and milestones. Further, OMB asked the IGs to assess the certification and accreditation process at their agencies. OMB did not request that the IGs validate agency responses to the performance measures. Instead, as part of their independent evaluations of a subset of agency systems, IGs were asked to assess the reliability of the data for those systems that they evaluated.

Recently-created Department of Homeland Security is Large and Complex

In the aftermath of September 11, invigorating the nation’s homeland security missions became one of the federal government’s most significant challenges. The Homeland Security Act of 2002 created DHS, combining 22 agencies into one department. DHS, with an estimated 170,000 employees, is the third largest government agency. Not since the creation of DOD more than 50 years ago had the government sought an integration and transformation of this magnitude.

GAO designated implementing and transforming DHS as high risk in 2003 because DHS had to transform 22 agencies—several with major management challenges—into one department, and failure to effectively address its management challenges and program risks could have serious consequences for our national security. DHS combined 22 agencies specializing in various disciplines: law enforcement, border security, biological research, disaster mitigation, and computer security, for instance. Further, DHS oversees a number of non-homeland-security activities, such as the Coast Guard’s marine safety responsibilities and the Federal Emergency Management Agency’s natural disaster response functions.

DHS has lead responsibility for preventing terrorist attacks in the United States, reducing the vulnerability of the United States to terrorist attacks, and minimizing the damage and assisting in the recovery from attacks that do occur. DHS has five under secretaries with responsibility over directorates for management, science and technology, information analysis and infrastructure protection, border and transportation security, and emergency preparedness and response. In addition, the department has four other organizations that report directly to the Secretary.

DHS uses a variety of major applications and general support systems in support of operational and administrative requirements. In its 2004 FISMA report, DHS stated that it had 395 systems and 61 contractor operations. These systems often served specific organizations that are now merged with others, resulting in interoperability issues, data management concerns, and incompatible environments or duplicative processes.

Department of Homeland Security’s FISMA Reports Highlight Increases in Performance Measures, but Challenges Remain

In its FISMA-mandated report for fiscal year 2004, DHS generally reported increases in compliance with information security requirements as compared with 2003. However, DHS continues to face significant challenges. The following key performance measures showed increased performance and/or continuing challenges: ● percentage of systems certified and accredited; ● percentage of agency systems reviewed annually; ● percentage of contractor operations reviewed annually; ● percentage of employees and contractors receiving annual security ● percentage of employees with significant security responsibilities receiving specialized security training annually; and ● percentage of systems with contingency plans tested.

Figure 1 illustrates the reported overall status of DHS in meeting these performance measures and the changes between fiscal years 2003 and 2004.

DHS has yet to develop a complete and accurate inventory, or an effective plan of action and milestones. Finally, figure 2 illustrates how DHS compares to the governmentwide results for the performance measures when compared to the aggregated data of all 24 CFO agencies.

Included in OMB’s policy for federal information security is a requirement that agency management officials formally authorize their information systems to process information and, thereby, accept the risk associated with their operation. This management authorization (accreditation) is to be supported by a formal technical evaluation (certification) of the management, operational, and technical controls established in an information system’s security plan. In 2003, agencies were required to report separately on risk assessments and security plans. In 2004, OMB eliminated this separate reporting in its guidance and directed agencies to complete risk assessments and security plans for the certification and accreditation process to be accomplished. As a result, the performance measure for certification and accreditation now also reflects the level of agency compliance for risk assessments and security plans. For FISMA reporting, OMB requires agencies to report the number of systems authorized for processing after completing certification and accreditation.

DHS reported a significant increase for this performance measure in its fiscal year 2004 report. The Department reported that approximately 68 percent of its systems had been certified and accredited, an increase of 26 percent over fiscal year 2003. Governmentwide, 77 percent of all systems were certified and accredited compared to the 68 percent at DHS. If agencies do not certify and accredit their systems, they cannot be assured that risks have been identified and mitigated to an acceptable level.

Moreover, the DHS IG reported in its 2004 FISMA report that the certification and accreditation process at the Department was poor. The report noted that the certification and accreditation process was not performed consistently across the Department. In addition, there were instances where certified and accredited systems lacked key security documentation such as up-to-date and approved security plans, a current risk assessment, and contingency plans. As a result, the agency reported performance data may not accurately reflect the status of DHS’s efforts to implement this requirement.

Annual Review of Agency Systems FISMA requires that agency information security programs include periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices to be performed with a frequency that depends on risk, but no less than annually. This is to include testing of management, operational, and technical controls for every information system identified in the FISMA-required inventory of major systems. Periodically evaluating the effectiveness of security policies and controls and acting to address any identified weaknesses are fundamental activities that allow an organization to manage its information security risks cost effectively, rather than reacting to individual problems ad hoc only after a violation has been detected or an audit finding has been reported. Further, management control testing and evaluation as part of program reviews is an additional source of information that can be considered along with control testing and evaluation in IG and GAO audits to help provide a more complete picture of the agencies’ security postures. As a performance measure for this requirement, OMB requires that agencies report the number of systems that they have reviewed during the year.

DHS reported performing an annual review on an increased percentage of its systems. It reported in 2004 that it had reviewed 54 percent of its systems, as compared to 44 percent in 2003. In 2004, 23 of the 24 CFO agencies reported that they had reviewed 90 percent or more of their systems. Annual security testing helps to provide assurance to the agencies that security controls are in place and functioning correctly. Without such testing, agencies cannot be assured that their information and systems are protected.

Annual Review of Contractor Operations Under FISMA, agency heads are responsible for providing information security protections for information collected or maintained by or on behalf of the agency and information systems used or operated by an agency or by a contractor. Thus, agency information security programs apply to all organizations that possess or use federal information or that operate, use, or have access to federal information systems on behalf of a federal agency. Other such organizations may include contractors, grantees, state and local governments, and industry partners. This underscores longstanding OMB policy concerning sharing government information and interconnecting systems: federal security requirements continue to apply and the agency is responsible for ensuring appropriate security controls.

At DHS, the key performance measure of annually reviewing contractor operations showed a minor decrease from 73 percent in 2003 to 67 percent in 2004. Twenty of the Department’s contractor operations were not reviewed. The governmentwide performance measure was reported as 83 percent of all contractor operations reviewed. If agencies do not review contractor operations, they cannot be assured that federal data is being handled in accordance with agency requirements.

FISMA requires agencies to provide security awareness training to inform personnel, including contractors and other users of information systems that support the operations and assets of the agency, of information security risks associated with their activities, and the agency’s responsibilities in complying with policies and procedures designed to reduce these risks. Our studies of best practices at leading organizations have shown that such organizations took steps to ensure that personnel involved in various aspects of their information security programs had the skills and knowledge they needed. Agencies reported that they provided security awareness training to the majority of their employees and contractors. As performance measures for FISMA training requirements, OMB has the agencies report the number of employees and contractors who received IT security training during fiscal year 2004.

DHS reported a substantial increase in the percentage of employees and contractors who received security awareness training in fiscal year 2004. The Department reported that it had trained 85 percent of its staff compared to 14 percent in 2003. As a result, reported performance is comparable to the majority of agencies in this performance measure, as seventeen agencies reported that they had trained more than 90 percent of their employees and contractors in basic security awareness.

Under FISMA, agencies are required to provide training in information security to personnel with significant security responsibilities. As previously noted, our study of best practices at leading organizations has shown that such organizations recognized that staff expertise needed to be updated frequently to keep security employees updated on changes in threats, vulnerabilities, software, security techniques, and security monitoring tools. OMB directs agencies to report on the percentage of their employees with significant security responsibilities who received specialized training.

DHS presented substantial improvement in this performance measure, reporting that it had provided specialized training to more than 90 percent of its employees who have significant security responsibilities. Not only was this a significant improvement over the 66 percent reported in 2003, it also places DHS among the top ten agencies governmentwide for this performance measure. Given the rapidly changing threats in information security, agencies need to keep their IT security employees up-to-date on changes in technology. Otherwise, agencies may face increased risk of security breaches.

Contingency plans provide specific instructions for restoring critical systems, including such elements as arrangements for alternative processing facilities in case the usual facilities are significantly damaged or cannot be accessed due to unexpected events such as temporary power failure, accidental loss of files, or a major disaster. It is important that these plans be clearly documented, communicated to potentially affected staff, and updated to reflect current operations.

The testing of contingency plans is essential to determining whether plans will function as intended in an emergency situation. The frequency of plan testing will vary depending on the criticality of the entity’s operations. The most useful tests involve simulating a disaster situation to test overall service continuity. Such a test would include testing whether the alternative data processing site will function as intended and whether critical computer data and programs recovered from off-site storage are accessible and current. In executing the plan, managers will be able to identify weaknesses and make changes accordingly. Moreover, tests will assess how well employees have been trained to carry out their roles and responsibilities in a disaster situation. To show the status of implementing this requirement, OMB requires that agencies report the number of systems that have a contingency plan and the number that have contingency plans that have been tested.

DHS reported a modest increase in the percentage of contingency plans tested. The department stated that it had tested contingency plans for 21 percent of its systems, an 8 percentage point increase over 2003. Moreover, analysis of the numbers reveals that DHS tested 82 plans, which was almost double what it tested in 2003. However, the majority of its systems do not have tested contingency plans. Overall, federal agencies reported that 57 percent of systems had contingency plans that had been tested. Without testing, agencies can have limited assurance that they will be able to recover mission-critical applications, business processes, and information in the event of an unexpected interruption.

In addition to the performance measures, there are other requirements that agencies must meet under FISMA. Agencies are required to have a complete and accurate inventory of their major systems and any interdependencies. They are also required to have a remediation process for correcting identified information security weaknesses.

The total number of agency systems is a key element in OMB’s performance measures, in that agency progress is indicated by the percentage of total systems that meet specific information security requirements. Thus, inaccurate or incomplete data on the total number of agency systems affects the percentage of systems shown as meeting the requirements. Further, a complete inventory of major information systems is a key element of managing the agency’s IT resources, including the security of those resources.

DHS reported that it did not have a complete and accurate inventory in either 2003 or 2004. Without reliable information on DHS’s inventories, the Department, the administration, and Congress cannot be fully assured of DHS’s progress in implementing FISMA.

FISMA requires each agency to develop a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in the information security policies, procedures and practices of the agency. OMB’s implementing guidance refers to this process as a security plan of action and milestones. The chief information officer (CIO) is to manage the process for the agencies and program officials are required to regularly update the CIO on their progress in implementing remedial actions. This process allows both the CIO and the IG to monitor agency-wide progress, identify problems, and provide accurate reporting. In its annual reporting guidance, OMB asks the agency IGs to report on the status of the plan of action and milestones at their agencies. IGs were asked to evaluate the process based on the following criteria: ● known IT security weaknesses from all components are ● program officials develop, implement and manage plans for the systems they own and operate that have an IT security weakness; ● program officials report to the CIO on a regular basis (at least quarterly) on their remediation progress; ● CIO develops, implements and manages plans for the systems they own and operate that have an IT security weakness; ● CIO centrally tracks, maintains, and reviews all plan activities on at least a quarterly basis; ● The plan is the authoritative agency tool for agency and IG management to identify and monitor agency actions for corrected information security weaknesses; ● System-level plans are tied directly to the system budget request through the IT business case as required in OMB budget guidance; ● IG has access to the plans as requested; ● IG findings are incorporated into the process; and ● the process prioritizes IT security weaknesses to help ensure that significant weaknesses are addressed in a timely manner and receive appropriate resources.

In its 2004 FISMA report, the DHS IG described problems with the plan of action and milestones process at DHS. According to the IG, seven of the nine major department components reviewed lacked a documented and implemented plan of action and milestones. Further, the IG stated that the CIO did not receive reports of remediation progress and did not ensure that components updated the status of their progress. Linkage of the plans to budget requests was reported as minimal at the component level. Seven of the nine components reviewed did not have a formal process to prioritize their IT security weaknesses. Finally, the IG reported that its findings were not incorporated into the plan of action and milestones at DHS. Without an effective, implemented remediation process, DHS cannot be assured that identified security weaknesses are tracked and corrected.

In summary, DHS generally showed increases in the OMB performance measures for FISMA implementation in fiscal year 2004. However, it still faces challenges in implementing the statutory requirements. It faces significant challenges in both inventory development and the implementation of its remediation process. Accordingly, if information security is to continue to improve, agency management must remain committed to these efforts. The annual reports and performance measures will continue to be key tools for holding DHS accountable and providing a barometer of the overall status of its information security.

Mr. Chairman, this concludes my statement. I would be happy to answer any questions from you or members of the Committee.

Should you have any questions about this testimony, please contact me at (202) 512-3317 or Suzanne Lightman, Assistant Director, at (202) 512-8146 or by e-mail at wilshuseng@gao.gov and lightmans@gao.gov, respectively.

Other individuals making key contributions to this testimony include Larry Crosland, Season Dietrich, Nancy Glover, Carol Langelier, and Stephanie Lee.