Information Security: Continued Efforts Needed to Sustain Progress in Implementing Statutory Requirements
Released: 2004-03-16T00:00:00

Letter

Background

Our recent analyses of audit results for federal agencies showed improvement, but continued to show significant weaknesses in federal computer systems that put critical operations and assets at risk of inadvertent or deliberate misuse, financial information at risk of unauthorized modification or destruction, sensitive information at risk of inappropriate disclosure, and critical operations at risk of disruption. The significance of these weaknesses led GAO to recently conclude that information security was a material weakness in our audit of the federal government’s fiscal year 2003 financial statements. Audits also identified instances of similar types of weaknesses in non-financial systems, which continue to receive increased audit coverage in response to FISMA requirements. Weaknesses continued to be reported in each of the six major areas of general controls—the policies, procedures, and technical controls that apply to all or a large segment of an entity’s information systems and help ensure their proper operation. These six areas are (1) security program management, a principal focus of FISMA, which provides the framework for ensuring that risks are understood and that effective controls are selected and properly implemented; (2) access controls, which ensure that only authorized individuals can read, alter, or delete data; (3) software development and change controls, which ensure that only authorized software programs are implemented; (4) segregation of duties, which reduces the risk that one individual can independently perform inappropriate actions without detection; (5) operating systems controls, which protect sensitive programs that support multiple applications from tampering and misuse; and (6) service continuity, also addressed by FISMA, which ensures that computer-dependent operations experience no significant disruptions.

To fully understand the significance of the weaknesses we identified, it is necessary to link them to the risks they present to federal operations and assets. Virtually all federal operations are supported by automated systems and electronic data, and agencies would find it difficult, if not impossible, to carry out their missions and account for their resources without these information assets. Hence, the degree of risk caused by security weaknesses is extremely high. The weaknesses identified place a broad array of federal operations and assets at risk. For example, resources, such as federal payments and collections, could be lost or stolen; computer resources could be used for unauthorized purposes or to launch sensitive information, such as taxpayer data, social security records, medical records, and proprietary business information, could be inappropriately disclosed, browsed, or copied for purposes of espionage or other types of crime; critical operations, such as those supporting national defense and emergency services, could be disrupted; data could be modified or destroyed for purposes of fraud or disruption; agency missions could be undermined by embarrassing incidents that result in diminished confidence in their ability to conduct operations and fulfill their fiduciary responsibilities.

Congress and the administration have established specific information security requirements in both law and policy to help protect the information and information systems that support these critical operations.

FISMA Permanently Authorizes and Strengthens Information Security Requirements

On October 30, 2000, Congress passed GISRA, which was signed into law and became effective November 29, 2000, for a period of 2 years. GISRA supplemented information security requirements established in the Computer Security Act of 1987, the Paperwork Reduction Act of 1995, and the Clinger-Cohen Act of 1996 and was consistent with existing information security guidance issued by OMB and NIST, as well as audit and best practice guidance issued by GAO. Most importantly, however, GISRA consolidated these separate requirements and guidance into an overall framework for managing information security and established new annual review, independent evaluation, and reporting requirements to help ensure agency implementation and both OMB and congressional oversight.

Enacted into law on December 17, 2002, as title III of the E-Government Act of 2002, FISMA permanently authorized and strengthened GISRA’s information security program, evaluation, and reporting requirements. Like GISRA, FISMA assigns specific responsibilities to agency heads, chief information officers (CIO), and IGs. It also assigns responsibilities to OMB, which include developing and overseeing the implementation of policies, principles, standards, and guidelines on information security; and reviewing at least annually, and approving or disapproving, agency information security programs. FISMA continues to delegate OMB responsibilities for national security systems to the Secretary of Defense and the Director of Central Intelligence.

Overall, FISMA requires each agency, including agencies with national security systems, to develop, document, and implement an agencywide information security program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. Specifically, this program is to include periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems; risk-based policies and procedures that cost-effectively reduce information security risks to an acceptable level and ensure that information security is addressed throughout the life cycle of each information system; subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems; security awareness training for agency personnel, including contractors and other users of information systems that support the operations and assets of the agency; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security incidents; plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency.

FISMA also established a requirement that each agency develop, maintain, and annually update an inventory of major information systems (including major national security systems) operated by the agency or under its control. This inventory is to include an identification of the interfaces between each system and all other systems or networks, including those not operated by or under the control of the agency.

The law also requires an agency’s CIO to designate a senior agency information security officer who, for the agency’s FISMA-prescribed information security responsibilities, shall carry out the CIO’s responsibilities; possess professional qualifications, including training and experience, required to administer the required functions; have information security duties as that official’s primary duty; and head an office with the mission and resources to assist in ensuring agency compliance.

Under FISMA, each agency must continue to have an annual independent evaluation of its information security program and practices, including control testing and compliance assessment. Evaluations of non-national- security systems are to be performed by the agency IG or by an independent external auditor, while evaluations related to national security systems are to be performed only by an entity designated by the agency head.

FISMA requires each agency to report annually to OMB, selected congressional committees, and the Comptroller General on the adequacy of information security policies, procedures, and practices, and compliance with FISMA’s requirements. In addition, agency heads are required to annually report the results of their independent evaluations to OMB, except that to the extent an evaluation pertains to a national security system, only a summary and assessment of that portion of the evaluation is reported to OMB. OMB is also required to submit a report to the Congress no later than March 1 of each year on agency compliance with FISMA’s requirements, including a summary of findings of agencies’ independent evaluations. FISMA also requires the Comptroller General to periodically evaluate and report to Congress on (1) the adequacy and effectiveness of agency information security policies and practices and (2) implementation of FISMA requirements.

Other major FISMA provisions require NIST to develop, for systems other than national security systems, (1) standards to be used by all agencies to categorize all their information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels; (2) guidelines recommending the types of information and information systems to be included in each category; and (3) minimum information security requirements for information and information systems in each category. NIST must also develop a definition of and guidelines concerning detection and handling of information security incidents; and guidelines, developed in conjunction with the Department of Defense and the National Security Agency, for identifying an information system as a national security system.

The law also assigned other information security functions to NIST, including providing technical assistance to agencies on such elements as compliance with the standards and guidelines and the detection and handling of information security incidents; conducting research, as needed, to determine the nature and extent of information security vulnerabilities and techniques for providing cost- effective information security; developing and periodically revising performance indicators and measures for agency information security policies and practices; evaluating private-sector information security policies and practices and commercially available information technologies to assess potential application by agencies; evaluating security policies and practices developed for national security systems to assess their potential application by agencies; and periodically assessing the effectiveness of and revising, as appropriate, the NIST standards and guidelines developed under FISMA.

NIST is required to prepare an annual public report on activities undertaken in the previous year, and planned for the coming year, to carry out its responsibilities under FISMA.

OMB Reporting Instructions and Guidance Emphasize Performance Measures

On August 6, 2003, OMB issued its fiscal year 2003 FISMA reporting instructions and guidance on quarterly IT security reporting. These instructions, which required agencies to submit their reports to OMB by September 22, 2003, essentially continued many of the reporting requirements established for GISRA, including performance measures introduced for fiscal year 2002 reporting under that law. The instructions also highlighted the more substantive changes introduced by FISMA. For example, OMB emphasized that FISMA applies to both information and information systems used by an agency and by its contractors or other organizations and sources that possess or use federal information or that operate, use, or have access to federal information systems. OMB also underscored that FISMA requires each agency to test and evaluate the effectiveness of the information security policies, procedures, and practices for each system at least annually.

OMB’s fiscal year 2003 reporting instructions also emphasized the strong focus on performance measures and formatted these instructions to emphasize a quantitative rather than a narrative response. OMB also required agencies to provide quarterly updates for a key subset of these performance measures, with the first update due December 15, 2003. Measures within this key subset are the numbers of systems that have risk assessments and assigned levels of risk, up-to-date IT security plans, security control costs integrated into their life cycles, security controls tested and evaluated in the last year, contingency plans tested.

Further, OMB provided instructions for continued agency reporting on the status of remediation efforts through plans of action and milestones (POA&M). Required for all programs and systems where an IT security weakness has been found, a POA&M lists the weaknesses and shows estimated resource needs or other challenges to resolving them, key milestones and completion dates, and the status of corrective actions. POA&Ms are to be submitted twice a year. In addition, agencies are to submit quarterly updates that show the number of weaknesses for which corrective action was completed on time (including testing), is ongoing and on track to be completed as originally scheduled, or has been delayed; as well as the number new weaknesses discovered since that last update.

Consistent with last year, OMB’s fiscal year 2003 guidance continued to authorize agencies to release certain information from their POA&Ms to assist the Congress in its oversight responsibilities. Agencies could release this information, as requested, excluding certain elements, such as estimated funding resources and the scheduled completion dates for resolving a weakness.

Lastly, as part of IG FISMA reporting, OMB instructed the IGs to respond to essentially the same questions that the agencies were to respond to in their reports. The IG responses were to be based on the results of their independent evaluations, including agency progress in implementing and maintaining their POA&Ms, and any other work performed throughout the reporting period (such as financial statement or other audits). This year, OMB also asked the IGs to assess against specific criteria whether the agency had developed, implemented, and was managing an agencywide POA&M process. OMB noted that this assessment was critical because effective remediation of IT security weaknesses is essential to achieving a mature and sound IT security program and securing information and systems. Further, OMB identified this IG assessment as one of the criteria used in evaluating agencies under the Expanding E-Government Scorecard of the President’s Management Agenda.

OMB also instructed the IGs to use the performance measures to assist in evaluating agency officials’ performance. However, it did not request them to validate agency responses to the performance measures. Instead, as part of their independent evaluations of a subset of agency systems, IGs were to assess the reliability of the data for those systems that they evaluated.

OMB’s Report to Congress Notes Progress and Challenges

In its FY 2003 Report to Congress on Federal Government Information Security Management, published this month, OMB concludes that the federal government has made significant strides in identifying and addressing long-standing problems, but that challenging weaknesses remain. Overall, the report discusses the steps taken by OMB and federal agencies to implement FISMA, details progress made in fiscal year 2003, and identifies IT security gaps and weaknesses. The report also presents a plan of action that OMB is pursuing with agencies to close these gaps and improve the security of federal information and systems. This plan is intended to resolve information and security challenges through both management and budgetary processes.

OMB’s report discussed four governmentwide findings: 1. Agencies’ Progress Against Governmentwide IT Security Milestones.

The President’s fiscal year 2004 budget established three governmentwide goals to be met by the end of calendar year 2003. These goals and the progress reported against them were: Goal 1 — As required by FISMA, all federal agencies are to have created a central remediation process to ensure that program and system-level IT security weaknesses, once identified, are tracked and corrected. In addition, each agency IG is to verify whether the agency has a process in place that meets criteria specified in OMB guidance. Based on IG responses to these criteria, OMB reported that each agency has an IT security remediation process, but that the maturity of these processes varies greatly. In particular, the report noted that for the 24 large agencies, only half have a remediation process verified by their IGs as meeting the necessary criteria.

Goal 2 — Eighty percent of federal IT systems are to be certified and accredited. OMB reported that many agencies are not adequately prioritizing their IT investments to ensure that significant IT security weaknesses are appropriately addressed. As a result, at the end of 2003, the reported percentage of systems certified and accredited had increased to 62 percent, but was still short of the goal. Related to this goal, the report noted that most security weaknesses can be found in operational systems that either have never been certified and accredited or whose certification and accreditation are out of date.

Goal 3 — Eighty percent of the federal government’s fiscal year 2004 major IT investments shall appropriately integrate security into the lifecycle of the investment. OMB reported that agencies have made improvements in integrating security into new IT investments, but that significant problems remain, particularly in ensuring security of existing systems. As an example, the report provided results for the performance measure related to this goal, which showed that at the end of 2003, the percentage of systems that had integrated security into the lifecycle of the investment increased to 78 percent. 2. Agency Progress Against Key IT Security Measures. As the report highlights, because of GISRA and the OMB-developed performance measures, the federal government is now able to measure progress in IT security; and the Congress, OMB, the agencies, and GAO are able to track and monitor agency efforts against those measures. Noting agency progress, the report provides a table comparing results of 24 large federal agencies for key performance measures for fiscal years 2001, 2002, and 2003. However, it also notes that further work is needed, and uses the area of contingency planning as an example, where only 48 percent of the systems had tested contingency plans. A comparison of reported overall results for fiscal year 2002 and 2003 is provided below in table 1. 3. IGs’ Assessment of Agency Plan of Action and Milestones Process. As mentioned in the discussion of goal 1, OMB requested that IGs assess against a set of criteria whether the agency had a robust agencywide plan of action process. OMB reported the overall results of this assessment for the 24 agencies, which showed that 8 had such a process; 4 did, but with improvements needed; 11 did not; and one did not submit a report (DOD). 4. Lack of Clear Accountability for Ensuring Security of Information and Systems. The report emphasizes that even with the strong focus of both GISRA and FISMA on the responsibilities of agency officials regarding security, there continues to be a lack of understanding, and therefore, accountability within the federal government. Issues that continue to be a concern include the following: Agency and IG reports continue to identify the same IT security weaknesses year after year, some of which are seen as repeating material weaknesses.

Too many legacy systems continue to operate with serious weaknesses.

As a result, there continues to be a failure to adequately prioritize IT funding decisions to ensure that remediation of significant security weaknesses are funded prior to proceeding with new development.

In further discussing this finding, the report concludes that these concerns must be addressed through improved accountability, that is, holding agency program officials accountable for ensuring that the systems that support their programs and operations are secure. Further, it emphasizes that ensuring the security of an agency’s information and systems is not the responsibility of a single agency official or the agency’s IT security office, but rather a responsibility to be shared among agency officials that support their operations and assets.

The report also outlines a plan of action to improve performance that identifies specific steps it will pursue to assist agencies in their IT security activities, promote implementation of law and policy, and track status and progress. These steps are: Prioritizing IT Spending to Resolve IT Security Weaknesses. OMB reports that it used information from agencies’ annual FISMA reports and quarterly POA&M updates in making funding decisions for fiscal year 2004, as well as for fiscal year 2005 to address longer term security weaknesses. For example, agencies with significant information and system security weaknesses were directed to remediate operational systems with weaknesses prior to spending fiscal year 2004 IT development or modernization funds. Further, if additional resources are needed to resolve those weaknesses, agencies are to use those fiscal year 2004 funds originally sought for new development.

President’s Management Agenda Scorecard. To “get to green” under the Expanding E-Government Scorecard for IT security, agencies are required to meet the following three criteria: (1) demonstrate consistent progress in remediating IT security weaknesses; (2) attain certification and accreditations for 90 percent of their operational IT systems; and (3) have an IG-assessed and IG-verified agency POA&M process.

Fiscal Year 2004 OMB FISMA Guidance. OMB plans to further emphasize performance measurement in next year’s guidance. In particular, its focus will center on three areas: (1) evolving the IT security performance measures to move beyond status reporting to also identify the quality of the work done, such as determining both the number of systems certified and accredited and the quality of certification and accreditation conducted; (2) further targeting of IG efforts to assess the development, implementation, and performance of key IT security processes, such as remediation and intrusion detection and reporting; and (3) providing additional clarity to certain definitions to eliminate interpretation differences within agencies and among agencies and IGs.

Threat and Vulnerability Response Process. In response to the increasing number and potential impact of threats and vulnerabilities, OMB will continue to focus on improving the federal government’s incident prevention and management capabilities. Such improvements include an increased emphasis on reducing the impact of worms and viruses through more timely installation of patches for known vulnerabilities, and improved information sharing to rapidly identify and respond to cyber threats and critical vulnerabilities. OMB also notes the critical importance of agency business continuity plans to mitigating the impact of threats and vulnerabilities.

Finally, OMB’s March 2004 report to the Congress identifies several other issues, and provides additional summary and agency-specific information. These include the following: As one of the changes or additions introduced by FISMA, a stronger emphasis is placed on configuration management. Specifically, FISMA requires each agency to develop specific system configuration requirements that meet its own needs and ensure compliance with them. According to the report, this provision encompasses traditional system configuration management, employing clearly defined system security settings, and maintaining up-to-date patches. Further, adequate ongoing monitoring and maintenance must accompany the establishment of such configuration requirements.

Federal funding for IT security increased from $2.7 billion in fiscal year 2002 to $4.2 billion in fiscal year 2003. The report also continues to emphasize that, historically, a review of IT security spending and security results has demonstrated that spending is not a statistically significant factor in determining agency security performance. Rather, the key is effectively incorporating IT security in agency management actions and implementing IT security throughout the lifecycle of a system.

The report appendixes provide an overview of the federal government’s IT security program, a summary of performance by 55 small and independent agencies, and individual summaries for each of the 24 large agencies.

FISMA Reports Highlight Overall Increases in Performance Measures, But Individual Agency Results Vary Widely

Overall, fiscal year 2003 data reported by the agencies for a subset of OMB’s performance measures show increasing numbers of systems meeting the requirements represented by these measures. For example, as shown in table 1, the reported percentage of systems authorized for processing following certification and accreditation increased from 47 percent for fiscal year 2002 to 62 percent for fiscal year 2003—an increase of 15 percentage points. In addition, the reported number of systems assessed for risk and assigned a level of risk increased by 13 percentage points from 65 percent for fiscal year 2002 to 78 percent for fiscal year 2003. Reported increases for other measures ranged from 4 to 15 percentage points. Figure 1 illustrates the reported overall status of the 24 agencies in meeting these requirements and the increases between fiscal years 2002 and 2003.

This subset of performance measures highlights important information security requirements. However, agencies’ FISMA reports also address other specific statutory requirements, regarding such elements as incident response capabilities, information security training, review of agency contractor operations and facilities, and remediation processes. The agency reports, as well as the IGs independent evaluations are intended to address all the FISMA requirements, and it is these reports and evaluations that your subcommittee reviewed in assigning agency grades for your December 2003 computer security report card.

The data and other information submitted for fiscal year 2003 FISMA reporting did show overall increases by many agencies for certain measures, but also that wide variances existed among the agencies. As discussed earlier, we did not validate the accuracy of the data reported by the agencies, but did analyze the IGs’ fiscal year 2003 FISMA reports to identify issues related to the accuracy of this information. Also as discussed later, we noted opportunities to improve the usefulness of agency-reported data. Further, in considering FISMA data, it is important to note that as more systems are subject to the certification and accreditation process and periodically tested, it is probable that additional significant weaknesses will be identified; and until all systems have contingency plans that are periodically tested, agencies have limited assurance that they will be able to recover from unexpected events. Summaries of results reported for specific requirements follow.

Risk Assessment

As part of the agencywide information security program required for each agency, FISMA mandates that agencies assess the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of their information and information systems. OMB, through information security policy set forth in its Circular A-130, also requires an assessment of risk as part of a risk- based approach to determining adequate, cost-effective security for a system.

As defined in NIST’s current draft revision of its Risk Management Guide for Information Technology Systems, risk management is the process of identifying risk, assessing risk, and taking steps to reduce risk to an acceptable level where risk is defined as the net negative impact of the exercise of vulnerability, considering both the probability and the impact of occurrence. Risk assessment is the first process in the risk management process, and organizations use risk assessment to determine the extent of the potential threat and the risk associated with an IT system throughout its systems development life cycle. Our best practices work has also shown that risk assessments are an essential element of risk management and overall security program management, and are an integral part of the management processes of leading organizations. Risk assessments help ensure that the greatest risks have been identified and addressed, increase the understanding of risk, and provide support for needed controls.

To measure agencies’ performance in implementing this requirement, OMB mandates that agencies’ FISMA reports provide the number and percentage of systems that have been assessed for risk.

Reporting for this measure continued to show overall increases. Specifically, 14 of the 24 agencies reported an increase in the percentage of systems assessed for risk for fiscal year 2003 as compared with fiscal year 2002. Further, as illustrated in figure 2, 12 agencies reported that they had assessed risk for 90 to 100 percent of their systems for fiscal year 2003, and only 4 of the remaining 13 agencies reported that less than half of their systems had been assessed for risk (compared with 8 agencies for fiscal year 2002).

Security Plans

FISMA requires that agencywide information security programs include subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems, as appropriate. According to NIST security plan guidance, the purpose of these plans is to (1) provide an overview of the security requirements of the system and describe the controls in place or planned for meeting those requirements, and (2) delineate the responsibilities and expected behavior of all individuals who access the system. OMB Circular A-130 requires that agencies prepare IT system security plans consistent with NIST guidance, and that these plans contain specific elements, including rules of behavior for system use, required training in security responsibilities, personnel controls, technical security techniques and controls, continuity of operations, incident response, and system interconnection. Agencies are also to update security plans as part of the cycle for reaccrediting system processing.

As a performance measure for this requirement, OMB requires that agencies report number and percentage of systems with up-to-date security plans. Agency data reported for this measure showed overall increases for fiscal year 2003, with a total of 9 agencies reporting up-to- date security plans for 90 percent or more of their systems compared with 7 agencies for fiscal year 2002. Further, of the remaining 15 agencies, only 5 reported that less than 50 percent of their systems had up-to-date security plans, compared with 9 agencies in 2002. Figure 3 summarizes overall fiscal year 2003 results.

Certification and Accreditation

As part of its responsibilities under FISMA, OMB is required to develop and oversee the implementation of policies, principles, standards, and guidelines on information security. Included in OMB’s policy for federal information security is a requirement that agency management officials formally authorize their information systems to process information and, thereby, accept the risk associated with their operation. This management authorization (accreditation) is to be supported by a formal technical evaluation (certification) of the management, operational, and technical controls established in an information system’s security plan. NIST is currently in the process of updating its guidance for the certification and accreditation of federal systems (except for national security systems). This guidance is to be used in conjunction with other standards and guidance that FISMA requires NIST to issue—documents that, when completed, are intended to provide a structured yet flexible framework for identifying, employing, and evaluating the security controls in federal information systems.

Because OMB considers system certification and accreditation to be such an important information security quality control, for FISMA reporting, it requires agencies to report the number of systems authorized for processing after certification and accreditation.

Data reported for this measure showed overall increases for most agencies. For example, 17 agencies reported increases in the percentage of systems authorized compared with their percentages last year. In addition, 7 agencies reported that they had authorized 90 to 100 percent of their systems compared with only 3 agencies last year. However, 11 agencies reported they had authorized less than 50 percent of their systems, but this also indicated some improvement compared with the 13 agencies that reported less than 50 percent last year (which included 3 that reported none). Figure 4 summarizes overall results for the 24 agencies for fiscal year 2003.

The results of the IGs’ independent evaluations showed deficiencies in agencies’ system certifications and accreditations, including instances in which certifications and accreditations were not were not current and controls were not tested. In addition, at the request of the House Committee on Government Reform and your subcommittee, we are currently reviewing federal agencies’ certification and accreditation processes. Preliminary results of our work indicate that the majority of the 24 large agencies reported that they are using NIST or other prescribed guidance for their system certifications and accreditations. However, our reviews of the certification and accreditation of selected systems at selected agencies identified instances where documentation did not show that specific criteria were always met. For example, we noted instances in which systems were accredited even though risk assessments were outdated, contingency plans were incomplete or untested, and control testing was not performed. Further, in some cases, documentation did not clearly indicate what residual risk the accrediting official was actually accepting in making the authorization decision. Unless agencies ensure that their certifications and accreditations meet appropriate criteria, the value of this process as a management control for ensuring information system security is limited, and agency reported performance data may not accurately reflect the status of an agency’s efforts to implement this requirement.

Integration of Security Costs into the System Life Cycle

OMB requires that agencies’ budget submissions specifically identify security costs as part of life-cycle costs for their IT investments and has provided criteria to be considered in determining such costs. OMB also provided these security cost criteria in its FISMA guidance and required agencies to report their IT security spending, including those critical infrastructure protection costs that apply to the protection of government operations and assets. Among other questions related to including security costs in IT investments, OMB requires that the agencies report the number of systems that have security control costs integrated into their system life cycles.

Fiscal year 2003 reporting for this measure showed that agencies are increasingly integrating security control costs into the life cycle of their systems. Specifically, 15 agencies reported increases in the number of systems integrating security costs, compared with the number reported last year. Also, as shown in figure 5, 9 agencies reported meeting this measure for 90 to 100 percent of their systems.

Security Control Testing and Evaluation

FISMA requires that agency information security programs include periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency that depends on risk, but no less than annually. This is to include testing of management, operational, and technical controls of every information system identified in the FISMA-required inventory of major systems. Periodically evaluating the effectiveness of security policies and controls and acting to address any identified weaknesses are fundamental activities that allow an organization to manage its information security risks cost- effectively, rather than reacting to individual problems ad hoc only after a violation has been detected or an audit finding has been reported. Further, management control testing and evaluation as part of program reviews is an additional source of information that can be considered along with control testing and evaluation in IG and our audits to help provide a more complete picture of the agencies’ security postures.

As a performance measure for this requirement, OMB mandates that agencies report the number of systems for which security controls have been tested and evaluated. Fiscal year 2003 data reported for this measure showed that a total of 15 agencies reported an increase in the overall percentage of systems being tested and evaluated. However, 8 agencies still reported that they had tested the controls of less than 50 percent of their systems (compared with 10 agencies last year) and only 6 of the remaining 16 agencies reported testing and evaluating the controls for 90 percent or more of their systems (compared with 4 agencies last year). Figure 6 shows the overall results for fiscal year 2003.

Contingency Plans

FISMA requires that agencies’ information security programs include plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. Contingency plans provide specific instructions for restoring critical systems, including such elements as arrangements for alternative processing facilities, in case usual facilities are significantly damaged or cannot be accessed due to unexpected events such as temporary power failure, accidental loss of files, or major disaster. It is important that these plans be clearly documented, communicated to affected staff, and updated to reflect current operations.

The testing of contingency plans is essential to determine whether they will function as intended in an emergency situation, and the frequency of plan testing will vary depending on the criticality of the entity’s operations. The most useful tests involve simulating a disaster situation to test overall service continuity. Such a test would include testing whether the alternative data processing site will function as intended and whether critical computer data and programs recovered from off-site storage are accessible and current. In executing the plan, managers will be able to identify weaknesses and make changes accordingly. Moreover, tests will assess how well employees have been trained to carry out their roles and responsibilities in a disaster situation.

To show the status of implementing this requirement, OMB mandates that agencies report the number of systems that have a contingency plan and the number with contingency plans that have been tested. Agencies’ reported fiscal year 2003 data for these measures showed that contingency planning remains a problem area for many agencies. Specifically, a total of 11 agencies report that less than half of their systems have contingency plans and of the remaining 13 agencies, only 6 have contingency plans for 90 to 100 percent of their systems. In addition, a total of 14 agencies reported that they had tested contingency plans for less than half of their systems, including 2 agencies that reported testing none. Figure 7 provides overall results for fiscal year 2003 contingency plan testing.

Security Training

FISMA requires agencies to provide security awareness training to inform personnel, including contractors and other users of information systems that support the operations and assets of the agency, of information security risks associated with their activities, and their responsibilities in complying with agency policies and procedures designed to reduce these risks. In addition, agencies are required to provide training on information security to personnel with significant security responsibilities. Our studies of best practices at leading organizations have shown that such organizations took steps to ensure that personnel involved in various aspects of their information security programs had the skills and knowledge they needed. They also recognized that staff expertise had to be frequently updated to keep abreast of ongoing changes in threats, vulnerabilities, software, security techniques, and security monitoring tools.

As performance measures for FISMA training requirements, OMB has the agencies report the number of employees who received IT security training during fiscal year 2003 and the number of employees with significant security responsibilities who received specialized training.

Reported fiscal year 2003 data showed that 13 agencies reported that they provided security training to 90 to 100 percent of their employees and contractors compared with 9 agencies for fiscal year 2002. Of the remaining 11 agencies, only 3 reported that such training was provided for less than half of their employees/contractors, and 1 provided insufficient data for this measure.

For specialized training for employees with significant security responsibilities, reported data showed increases since fiscal year 2002. For example, a total of 7 agencies reported training for 90 to 100 percent of their employees with significant security responsibilities (compared with 5 agencies last year), and of the remaining 17 agencies, only 2 reported providing training to less than half of such employees (compared with 10 for fiscal year 2002). Figure 8 provides overall results for fiscal year 2003.

Incident Handling

Although even strong controls may not block all intrusions and misuse, organizations can reduce the risks associated with such events if they promptly take steps to detect them before significant damage can be done. Accounting for and analyzing security problems and incidents are also effective ways for an organization to gain a better understanding of threats to its information and of the cost of its security-related problems. Such analyses can also pinpoint vulnerabilities that need to be addressed to help ensure that they will not be exploited again. Problem and incident reports can, therefore, provide valuable input for risk assessments, help in prioritizing security improvement, and be used to illustrate risks and related trends in reports to senior management.

FISMA requires that agencies’ information security programs include procedures for detecting, reporting, and responding to security incidents; mitigating risks associated with such incidents before substantial damage is done; and notifying and consulting with the FISMA-required federal information security incident center and other entities, as appropriate, including law enforcement agencies and relevant IGs. OMB information security policy has also required that system security plans ensure a capability to provide help to users when a security incident occurs in the system and to share information concerning common vulnerabilities and threats. In addition, NIST has provided guidance to assist organizations in establishing computer security incident-response capabilities and in handling incidents efficiently and effectively.

OMB requires agencies to report several performance measures and other information for FISMA related to detecting, reporting, and responding to security incidents. These include the number of agency components with an incident handling and response capability, whether the agency and its major components share incident information with the Federal Computer Incident Response Center (FedCIRC) in a timely manner, and the numbers of incidents reported. OMB also requires that agencies report on how they confirm that patches have been tested and installed in a timely manner and whether they are a member of FedCIRC’s Patch Authentication and Distribution Capability, which provides agencies with information on trusted, authenticated patches for their specific technologies without charge.

Agency-reported data showed that many agencies have established and implemented incident-response capabilities for their components. For example, 17 agencies reported that for fiscal year 2003, 90 percent or more of their components had incident handling and response capabilities (compared to 12 agencies for fiscal year 2002). Also, a total of 18 agencies reported that their components report incidents to FedCIRC either themselves or centrally through one group.

A total of 22 agencies reported that they confirm patches have been tested and installed in a timely manner. In contrast, of the 23 IGs that reported, 11 responded that the agency confirmed that patches have been tested and installed in a timely manner; 5 that the agency did but not consistently; and 6 that the agency did not (1 other IG did not provide sufficient data). A total of 19 agencies also reported that they were a member of FedCIRC’s Patch Authentication and Distribution Capability.

In our September 2003 testimony, we discussed the criticality of the patch management process in helping to alleviate many of the challenges involved in securing computing systems from attack. We also identified common practices for effective patch management found in security- related literature from several groups, including NIST, Microsoft, patch management software vendors, and other computer-security experts. These practices included senior executive support of the process; standardized patch management policies, procedures, and tools; dedicated resources and clearly assigned responsibilities for ensuring that the patch management process is effective; current inventory of all hardware equipment, software packages, services, and other technologies installed and used by the organization; proactive identification of relevant vulnerabilities and patches; assessment of the risk of applying the patch considering the importance of the system to operations, the criticality of the vulnerability, and the likelihood that the patch will disrupt the system; testing each individual patch against various systems configurations in a test environment before installing it enterprisewide to determine any impact on the network; effective patch distribution to all users; and regular monitoring through network and host vulnerability scanning to assess whether patches have been effectively applied.

In addition to these practices, we identified several steps to be considered when addressing software vulnerabilities, including: deploying other technologies, such as antivirus software, firewalls, and other network security tools, to provide additional defenses against attacks; employing more rigorous engineering practices in designing, implementing, and testing software products to reduce the number of potential vulnerabilities; improving tools to more effectively and efficiently manage patching; researching and developing technologies to prevent, detect, and recover from attacks as well as to identify their perpetrators, such as more sophisticated firewalls to keep serious attackers out, better intrusion- detection systems that can distinguish serious attacks from nuisance probes and scans, systems that can isolate compromised areas and reconfigure while continuing to operate, and techniques to identify individuals responsible for specific incidents; and ensuring effective, tested contingency planning processes and procedures.

Security of Contractor- Provided Services

Under FISMA, agency heads are responsible for providing information security protections for information collected or maintained by or on behalf of the agency and information systems used or operated by an agency or by a contractor. Thus, as OMB emphasized in its fiscal year 2003 FISMA reporting guidance, agency IT security programs apply to all organizations that possess or use federal information or that operate, use, or have access to federal information systems on behalf of a federal agency. Such other organizations may include contractors, grantees, state and local governments, and industry partners. This underscores longstanding OMB policy concerning sharing government information and interconnecting systems: federal security requirements continue to apply and the agency is responsible for ensuring appropriate security controls.

As a performance measure for the security of contractor-provided security, OMB had the agencies report the number of contractor facilities or operations reviewed and to respond as to whether or not they used appropriate methods (such as audits or inspections and agreed-upon IT security requirements) to ensure that contractor-provided services for their programs and systems are adequately secure and meet the requirements of FISMA, OMB policy and NIST guidelines, national security policy, and agency policy.

Fiscal year 2003 data reported for these measures showed that 10 of the 24 agencies reported that they had reviewed 90 to 100 percent of their contractor operations or facilities. Only 2 agencies reported having reviewed less than half of their contractor operations or facilities, and two others provided insufficient data for this measure. In addition, 22 agencies reported that they used appropriate methods to ensure that contractor- provided services are adequately secure and meet the requirements of FISMA. Of the remaining two agencies, one reported that it did not use appropriate methods and one reported partial compliance. Although these reported results indicate overall increases from fiscal year 2002, the IGs’ evaluations provided different results. For example, although the IG evaluations did not always address these measures, 9 of the 15 IGs that did report showed that less than half of contractor operations or facilities were reviewed. Further, only 12 IGs reported that the agency used appropriate methods to ensure that contractor-provided services are adequately secure and meet the requirements of FISMA, while 7 reported that their agencies did not.

Plan of Action and Milestones

FISMA requires that agencies’ information security programs include a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency. Developing effective corrective action plans is key to ensuring that remedial action is taken to address significant deficiencies. Further, a centralized process for monitoring and managing remedial actions enables the agency to identify trends, root causes, and entitywide solutions.

As discussed previously, as part of GISRA implementation, OMB began requiring that agencies report on the status of their remediation efforts through POA&Ms and quarterly updates. In addition, for fiscal year 2003 FISMA reporting, OMB had agency IGs assess whether the agency had developed, implemented, and was managing an agencywide plan of action and milestone process according to specific criteria, such as whether agency program officials and the CIO develop, implement, and manage POA&Ms for every system that they own and operate (systems that support their programs) that has an IT security weakness; and whether the agency CIO centrally tracks and maintains all POA&M activities on at least a quarterly basis.

Overall, the IGs’ responses to these criteria showed that many agencies still do not use the POA&M process to manage the correction of their information security weaknesses. For example, as part of monitoring the status corrective actions, 20 of the 23 IGs that reported responded that the agency CIO tracked POA&M data centrally on at least a quarterly basis, but only 12 reported that the CIO maintained POA&Ms for every system that has an IT weakness. Further, 14 IGs reported that their agency POA&M process did not prioritize IT security weaknesses to ensure that significant weaknesses are addressed in a timely manner and receive appropriate resources. Reported IG responses to these and other criteria are summarized in table 2.

Opportunities Exist to Improve the Usefulness of Performance Measurement Data

Periodic reporting of performance measures tied to FISMA requirements and related analysis can provide valuable information on the status and progress of agency efforts to implement effective security management programs, thereby assisting agency management, OMB and the Congress in their management and oversight roles. However, several opportunities exist to improve the usefulness of such information as indicators of both governmentwide and agency-specific performance in implementing information security requirements. As discussed earlier, OMB plans to further emphasize performance measurement in next year’s FISMA reporting guidance, including evolving measures to identify the quality of work performed, targeting IG efforts to assess key security processes, and clarifying certain definitions. In developing its guidance, OMB can consider how their efforts can help to address the following factors that lessen the usefulness of current performance measurement data: Limited assurance of data reliability and quality. The performance measures reported by the agencies are primarily based on self- assessments and are not independently validated. OMB did not require the IGs to validate agency responses to the performance measures, but did instruct them to assess the reliability of the data for the subset of systems they evaluate as part of their independent evaluations. Although not consistently addressed by all the IGs, some IG evaluations did identify problems with data reliability and quality that could affect agency performance data. For example, for the performance measure on the number of agency systems authorized for processing after certification and accreditation, 6 IGs indicated different results than those reported by their agencies for reasons such as out-of-date certifications and accreditations (systems are to be reaccredited at least every 3 years). Further, other IGs identified problems with the quality of the certifications and accreditations, such as security control reviews not being performed.

Accuracy of agency system inventories. The total number of agency systems is a key element in OMB’s performance measures, in that agency progress is indicated by the percentage of total systems that meet specific information security requirements. Thus, inaccurate or incomplete data on the total number of agency systems affects the percentage of systems shown as meeting the requirements. Further, a complete inventory of major information systems is a key element of managing the agency’s IT resources, including the security of those resources. As mentioned, FISMA requires that each agency develop, maintain, and annually update an inventory of major information systems operated by the agency or under its control. However, according to their fiscal year 2003 FISMA reports, only 13 of the 24 agencies reported that they had completed their system inventories. Further, independent evaluations by IGs for 3 of these 13 agencies did not agree that system inventories were complete. In addition, although there was little change in the reported total number of systems shown for the 24 agencies (an increase of only 41 systems from 7,957 systems for fiscal year 2002 to 7,998 systems for fiscal year 2003, large changes in individual agencies’ total systems from year to year could make it more difficult to interpret changes in their performance measure results. For example, the total number of systems reported by the Department of Agriculture decreased by 55 percent from 605 for fiscal year 2002 to 271 for fiscal year 2003, which the department attributed, in large part, to its efforts to develop the FISMA-required inventory of major information systems. At the same time, all of the department’s key performance measures increased, with some, such as systems assessed for risk, showing a large increase (from 18 percent for fiscal year 2002 to 72 percent for fiscal year 2003).

Limited Department of Defense data. In interpreting overall results for the federal government, it is important to note that reported numbers include only a small sample of the thousands of systems identified by DOD. Attributing its size and complexity and the considerable lead time necessary to allow for the collection of specific metrics and the approval process by each service and agency, DOD determined that the collection of a sample of system and network performance metrics would effectively support its emphasis on network-centric operations and complement its overall information assurance security reporting. Obtaining OMB concurrence with this approach, DOD provided performance measurement data on a sample of 378 systems in its fiscal year 2003 FISMA report. As OMB reported in its fiscal year 2003 report to the Congress, DOD reported a total of 3,557 systems for the department— almost half of the combined total systems for the other 23 agencies. OMB also reported that DOD plans to report on all systems for the fiscal year 2004 reporting cycle. As a result, including performance data on all DOD systems for fiscal year 2004 could significantly affect the overall performance measurement results both for DOD and governmentwide.

Data reported in aggregate, not according to system risk. Performance measurement data are reported on the total number of agency systems and do not indicate the relative importance or risk of the systems for which FISMA requirements have been met. Reporting information by system risk would provide better information about whether agencies are prioritizing their information security efforts according to risk. For example, the performance measures for fiscal year 2003 show that 48 percent of the total number of systems have tested contingency plans, but do not indicate to what extent these 48 percent include the agencies’ most important systems. Therefore, agencies, the administration, and the Congress cannot be sure that critical federal operations can be restored if an unexpected event disrupts service. As required by FISMA, NIST recently issued its Standards for Security Categorization of Federal Information and Information Systems to provide a common framework and understanding for expressing security that promotes effective management and oversight of information security programs and consistent reporting to OMB and the Congress on the adequacy and effectiveness of information security policies, procedures, and practices. These standards, which are discussed later in greater detail, would require agencies to categorize their information systems according to three levels of potential impact on organizations or individuals—high, moderate, and low—should there be a breach of security.

Refinement of performance measures to improve quality of analysis.

Refinement of performance measures can provide more useful information about the quality of agency processes. For example, as discussed earlier, GAO and the IGs have noted issues concerning the quality of the certification and accreditation process. Additional information reported on key aspects of certification and accreditation would provide better information to assess whether they were performed consistently. As also discussed earlier, OMB’s fiscal year 2003 FISMA report to the Congress also identified the need to evolve performance measures to provide better quality information.

Status of NIST Efforts

Since FISMA was enacted in December 2002, NIST has taken a number of actions to develop required security-related standards and guidance. These actions include the following: In December 2003 it issued the final version of its Standards for Security Categorization of Federal Information and Information Systems (FIPS Publication 199). NIST was required to submit these categorization standards to the Secretary of Commerce for promulgation no later than 12 months after FISMA was enacted. The standards establish three levels of potential impact on organizational operations, assets, or individuals should a breach of security occur—high (severe or catastrophic), moderate (serious), and low (limited). These standards are intended to provide a common framework and understanding for expressing security that promotes effective management and oversight of information security programs, and consistent reporting to OMB and the Congress on the adequacy and effectiveness of information security policies, procedures, and practices.

Also in December 2003, it issued the initial public draft of its Guide for Mapping Types of Information and Information Systems to Security Categories (Special Publication 800-60). Required to be issued 18 months after FISMA enactment, this guidance is to assist agencies in categorizing information and information systems according to impact levels for confidentiality, integrity, and availability as provided in NIST’s security categorization standards (FIPS Publication 199).

In October 2003 it issued an initial public draft of Recommended Security Controls for Federal Information Systems (Special Publication 800-53) to provide guidelines for selecting and specifying security controls for information systems categorized in accordance with FIPS Publication 199. This draft includes baseline security controls for low and moderate impact information systems, with controls for high impact systems to be provided in subsequent drafts. This publication, when completed, will serve as interim guidance until 2005 (36 months after FISMA enactment), which is the statutory deadline to publish minimum standards for all non-national- security systems. In addition, testing and evaluation procedures used to verify the effectiveness of security controls are to be provided this spring in NIST’s Guide for Verifying the Effectiveness of Security Controls in Federal Information Systems (Special Publication 800-53A).

In August 2003 it issued Guideline for Identifying an Information System as a National Security System (Special Publication 800-59). This document provides guidelines developed in conjunction with DOD, including the National Security Agency, to ensure that agencies receive consistent guidance on the identification of systems that should be governed by national security system requirements. Except for national security systems identified by FISMA, the Secretary of Commerce is responsible for prescribing standards and guidelines developed by NIST. DOD and the Director of Central Intelligence have authority to develop policies, guidelines, and standards for national security systems. The Director is also responsible for policies relating to systems processing intelligence information.

According to a NIST official, the agency has also made progress in implementing other FISMA requirements. For example, it is continuing to provide consultative services to agencies on FISMA related information security issues and has established a federal agencies security practices Web site to identify, evaluate, and disseminate best practices for critical infrastructure protection and security. In addition, it has established a Web site for the private sector to share nonfederal information security practices. NIST has continued an ongoing dialogue with the National Security Agency and the Committee on National Security Systems to coordinate and take advantage of the security work underway within the federal government.

FISMA also requires NIST to prepare an annual public report on activities undertaken in the previous year and planned for the coming year, to carry out its responsibilities. According to a NIST official, this report should be issued this month.

In addition to its responsibilities under FISMA, NIST has issued or is developing other information security guidance that supports this law. Along with its guidance on incident handling, building an information security awareness program, and draft guidance on both certification and accreditation and risk management, NIST has also issued Security Metrics Guide for Information Technology Systems and Security Considerations in the Information System Development Life Cycle: Recommendations of the National Institute of Standards and Technology.

Current budget constraints may, however, affect NIST’s future work. FISMA established new responsibilities for this agency and authorized an appropriation of $20 million for each fiscal year, 2003 through 2007. However, according to NIST, funding for the Computer Security Division, the organization responsible for FISMA activities, was reduced from last year, and this will affect this division’s information security and critical infrastructure protection work.

In addition to the specific responsibilities to develop standards and guidance under FISMA, other information security activities undertaken by NIST include operating a computer security expert assist team (CSEAT) to assist federal agencies in identifying and resolving IT security problems; conducting security research in areas such as access control, wireless, mobile agents, smart-cards, and quantum computing; improving the security of control systems that manage key elements of the country’s critical infrastructure; and performing cyber security product certifications required for government procurements.

The Cyber Security Research and Development Act also assigned information security responsibilities to NIST and authorized funding. These responsibilities include providing research grants to institutions of higher education or other research institutions to support short-term research aimed at improving the security of computer systems; growth of emerging technologies associated with the security of networked systems; strategies to improve the security of real-time computing and communications systems for use in process control; and multidisciplinary, long-term, high-risk research on ways to improve the security of computer systems. developing cyber security checklists (and establishing priorities for their development) that set forth settings and option selections that minimize the security risks associated with each computer hardware or software system that is, or is likely to become, widely used within the federal government.

In summary, through the continued emphasis of information security by the Congress, the administration, agency management, and the audit community, the federal government has seen improvements in its information security. However, despite the apparent progress shown by increases in key performance measures, most agencies still have not reached the level of performance that demonstrates that they have implemented the agencywide information security program mandated by FISMA. If information security is to continue to improve, agency management must remain committed to these efforts and establish management processes that ensure that requirements are implemented for all their major systems, including new requirements to categorize their systems and incorporate mandatory minimum security controls. Performance measures will continue to be a key tool to both hold agencies accountable and provide a barometer of the overall status of federal information security. For this reason, it is increasingly important that agencies’ monitoring, review, and evaluation processes provide the Congress, the administration, and agency management with assurance that these measures accurately reflect agency progress. Opportunities to provide this assurance and improve the usefulness of agencies’ performance measurement data include IG validation of reported data, categorization of the data according to system risk levels, and refinement of the measures to provide more information about the quality of agency processes.

Achieving significant and sustainable results will likely require agencies to develop programs and processes that prioritize and routinely monitor and manage their information security efforts. Further, agencies will need to ensure that systems and processes are in place to provide information and facilitate the day-to-day management of information security throughout the agency, as well as to verify the reliability of reported performance information.

Mr. Chairman, this concludes my statement. I would be happy to answer any questions that you or members of the subcommittee may have at this time.

If you should have any questions about this testimony, please contact me at (202) 512-3317 or Ben Ritt, Assistant Director, at (202) 512-6443. We can also be reached by e-mail at daceyr@gao.gov and rittw@gao.gov, respectively.

Other individuals making key contributions to this testimony included Larry Crosland, Mark Fostek, Danielle Hollomon, and Barbarol James.

This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.