Information Security: Concerted Response Needed to Resolve Persistent Weaknesses
Released: 2010-03-24T00:00:00

Letter

Background

To help protect against threats to federal systems, the Federal Information Security Management Act (FISMA) is intended to set forth a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. Its framework creates a cycle of risk management activities necessary for an effective security program; these activities are similar to the principles noted in our study of the risk management activities of leading private sector organizations—assessing risk, establishing a central management focal point, implementing appropriate policies and procedures, promoting awareness, and monitoring and evaluating policy and control effectiveness.

In order to ensure the implementation of this framework, FISMA assigns specific responsibilities to (1) agency heads and chief information officers, to develop, document, and implement an agencywide information security program, among other things; (2) inspectors general, to conduct annual independent evaluations of agency efforts to effectively implement information security; (3) the National Institute for Science and Technology (NIST), to provide standards and guidance to agencies on information security; and (4) OMB, which include developing and overseeing the implementation of policies, principles, standards, and guidelines on information security and reviewing, at least annually, and approving or disapproving, agency information security programs. In addition, the act requires each agency to report annually to OMB, selected congressional committees, and the Comptroller General on the adequacy of its information security policies, procedures, practices, and compliance with requirements. FISMA also requires OMB to report annually to Congress by March 1.

Although Agencies Report Mixed Progress, Deficiencies in Information Security Controls Remain

FISMA requires each agency, including agencies with national security systems, to develop, document, and implement an agencywide information security program to provide security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. As part of its oversight responsibilities OMB requires agencies to report on specific performance measures, including: Percentage of employees and contractors receiving IT security awareness Percentage of employees with significant security responsibilities who received specialized security training, Percentage of systems whose controls were tested and evaluated, Percentage of systems with tested contingency plans, and Percentage of systems certified and accredited.

Since the enactment of FISMA in 2002, federal agencies have generally reported increasing rates of implementation for key information security activities. However, in fiscal year 2009, agencies reported mixed progress in implementing these activities compared to fiscal year 2008. For example, governmentwide, agencies collectively reported that 91 percent of employees and contractors had received security awareness training in fiscal year 2009, up from 89 percent in fiscal year 2008. Agencies also reported that 90 percent of employees with significant information security responsibilities had received specialized training, up from 76 percent in fiscal year 2008.

In other key areas, agencies reported slight decreases from fiscal years 2008 to 2009. Specifically, the percentage of systems for which security controls have been tested and reviewed decreased from 93 percent to 89 percent, the percentage of systems with tested contingency plans decreased from 91 percent to 86 percent, and the percentage of systems certified and accredited decreased from 96 percent to 94 percent. A summary of these percentages is shown in figure 1.

In these and other areas, inspectors general at the 24 major agencies have also reported weaknesses in their fiscal year 2009 audits and evaluations. Weaknesses in requirements such as periodic testing and evaluation, certification and accreditation, configuration management, and remedial actions were most commonly reported. For example, at least 13 inspectors general reported that their agencies had insecure configuration settings, or had not applied needed patches in a timely manner, or both; at least 15 inspectors general reported that their agency did not adequately assess security controls such as those recommended by NIST; at least 11 inspectors general reported that their agencies failed to create a remediation plan for all identified weaknesses. at least 13 inspectors general reported that documents required to make an informed decision regarding certification and accreditation of systems were either missing or incomplete, or that the accreditation was allowed to expire on at least one system without recertification; Weaknesses such as these continue to impair the government’s ability to ensure the confidentiality, integrity, and availability of critical information and information systems used to support the operations and assets of federal agencies. Until these agencies fully implement information security requirements, they may be at increased risk of unauthorized disclosure, modification, and destruction of information or disruption of mission critical operations.

Despite Reported Progress, Federal Systems Remain Vulnerable

GAO and agency inspectors general reviews continue to highlight deficiencies in the implementation of security policies and procedures at federal agencies. In their fiscal year 2009 performance and accountability reports, 21 of 24 major agencies noted that inadequate information system controls over their financial systems and information were either a material weakness or a significant deficiency (see fig. 2).

Our audits and those of the inspectors general continue to identify similar conditions in both financial and non-financial systems. Most of the 24 major federal agencies had reported deficiencies in the following major categories of information security controls, as defined by our Federal Information System Controls Audit Manual: access controls, which ensure that only authorized individuals can read, alter, or delete data; configuration management controls, which provide assurance that only authorized software programs are implemented; segregation of duties, which reduces the risk that one individual can independently perform inappropriate actions without detection; continuity of operations planning, which provides for the prevention of significant disruptions of computer-dependent operations; and an agencywide information security program, which provides the framework for ensuring that risks are understood and that effective controls are selected and properly implemented.

As shown in figure 3, agencies reported deficiencies in all five of the information security control areas. For example, agencies did not consistently configure network devices and services to prevent unauthorized access and ensure system integrity; assign incompatible duties to different individuals or groups so that one individual does not control all aspects of a process or transaction; and maintain or test continuity of operations plans for key information systems. Such information security control weaknesses unnecessarily increase the risk that the reliability and availability of data that are recorded in or transmitted by federal systems could be compromised.

An underlying cause for information security weaknesses identified at federal agencies is that they have not yet fully or effectively implemented key elements of an agencywide information security program, as required by FISMA. An agencywide security program provides a framework and continuing cycle of activity that includes assessing and managing risk, developing and implementing security policies and procedures, promoting security awareness and training, monitoring the adequacy of the entity’s computer-related controls through security tests and evaluations, and implementing remedial actions as appropriate. According to inspector general, agency, and our previous reports, 23 of the 24 major federal agencies had weaknesses in their agencywide information security programs.

The following examples, reported in 2009, illustrate that a broad array of federal information and systems remain at risk.

At the Financial Crimes Enforcement Network (FinCEN), a bureau within the Department of the Treasury, key information security program activities were not implemented. For example, FinCEN did not always include detailed implementation guidance in its policies and procedures or adequately test and evaluate information security controls.

The information security program for the classified computer network at the Los Alamos National Laboratory (LANL) had not been fully implemented. Specifically, (1) risk assessments were not comprehensive, (2) specific guidance was missing from policies and procedures, (3) the training and awareness program did not adequately address specialized training needs for individuals with significant network security responsibilities, (4) system security plans were incomplete, (5) the system security testing and evaluation process had shortcomings, (6) corrective action plans were not comprehensive, and (7) contingency plans were incomplete and not tested. In addition, the laboratory’s decentralized management approach has led to weaknesses in the effectiveness of its classified cybersecurity program. Although the laboratory has taken steps to address these weaknesses, its efforts may be limited because LANL has not demonstrated a consistent capacity to sustain security improvements over the long term.

We identified a number of shortcomings in key program activities at the National Aeronautics and Space Administration (NASA). For example, NASA had not always (1) fully assessed information security risks; (2) fully developed and documented security policies and procedures; (3) included key information in security plans; (4) conducted comprehensive tests and evaluation of its information system controls; (5) tracked the status of plans to remedy known weaknesses; (6) planned for contingencies and disruptions in service; (7) maintained capabilities to detect, report, and respond to security incidents; and (8) incorporated important security requirements in its agreement with its contractor.

In addition, the inspectors general at 13 of the 24 major agencies reported information security as major management challenge. Due to the persistent nature of information security vulnerabilities and the associated risks, we continue to designate information security as a governmentwide high-risk issue in our most recent biennial report to Congress; a designation we have made in each report since 1997.

Reported Security Incidents Are on the Rise

Consistent with the evolving and growing nature of the threats and persistent vulnerabilities to federal systems, agencies are reporting an increasing number of security incidents and events. These incidents put sensitive information at risk. Personally identifiable information about Americans has been lost, stolen, or improperly disclosed, thereby potentially exposing those individuals to loss of privacy, identity theft, and financial crimes. Reported attacks and unintentional incidents involving critical infrastructure systems demonstrate that a serious attack could be devastating. Agencies have experienced a wide range of incidents involving data loss or theft, computer intrusions, and privacy breaches, underscoring the need for improved security practices.

When incidents occur, agencies are to notify the federal information security incident center—the United States Computer Emergency Readiness Team (US-CERT). US-CERT serves as a focal point for the government’s interaction with federal and nonfederal entities on a 24-hour- a-day, 7-day-a-week basis regarding cyber-related analysis, warning, information sharing, major incident response, and national-level recovery efforts. As shown in figure 4, the number of incidents reported by federal agencies to US-CERT has increased dramatically over the past 4 years, increasing from 5,503 incidents reported in fiscal year 2006 to about 30,000 incidents in fiscal year 2009 (over a 400 percent increase).

Agencies report the following types of incidents and events based on US- CERT-defined categories: Unauthorized access: Gaining logical or physical access without permission to a federal agency’s network, system, application, data, or other resource.

Denial of service: Preventing or impairing the normal authorized functionality of networks, systems, or applications by exhausting resources. This activity includes being the victim of or participating in a denial of service attack.

Malicious code: Installing malicious software (e.g., virus, worm, Trojan horse, or other code-based malicious entity) that infects an operating system or application. Agencies are not required to report malicious logic that has been successfully quarantined by antivirus software.

Improper usage: Violating acceptable computing use policies.

Scans/probes/attempted access: Accessing or identifying a federal agency computer, open ports, protocols, service, or any combination of these for later exploit. This activity does not directly result in a compromise or denial of service.

Unconfirmed incidents under investigation: Investigating unconfirmed incidents that are potentially malicious, or anomalous activity deemed by the reporting entity to warrant further review.

The four most prevalent types of incidents and events reported to US- CERT during fiscal year 2009 were: (1) malicious code comprising 23 percent; (2) improper usage, 20 percent; (3) unauthorized access, 16 percent; and (4) unconfirmed incidents under investigation, 36 percent. Incidents reported to US-CERT in fiscal year 2009 are shown by type in figure 5.

Opportunities Exist for Enhancing Federal Cybersecurity

A concerted response to safeguarding federal systems includes several components. Agencies can take action to resolve specific security weaknesses, federal law and guidance can be strengthened, and continued effort can be made on governmentwide security initiatives.

Over the past several years, we and agency inspectors general have made hundreds of recommendations to resolve significant control deficiencies and information security program shortfalls. Effective implementation of our recommendations will help agencies to prevent, limit, and detect unauthorized access to computerized networks and systems and help ensure that only authorized individuals can read, alter, or delete data. In addition, implementation of these recommendations will help agencies to better manage the configuration of security features for hardware and software and assure that changes to the configuration are systematically controlled.

We have also recommended that agencies fully implement comprehensive, agencywide information security programs, including by correcting weaknesses in specific areas of their programs such as: (1) assessments of the risk to information systems; (2) information security policies and procedures; (3) planning for interruptions to information system processing; (4) training personnel in awareness of security policies and procedures; (5) periodic tests and evaluations of the effectiveness of information system controls; and (6) the implementation of plans of action to remediate information security weaknesses. The effective implementation of these recommendations will strengthen the security posture at these agencies. Agencies have implemented or are in the process of implementing many of our recommendations.

In addition, agencies can also increase their efficiency in securing and monitoring networks by expanding their use of automated tools as part of their monitoring programs for performing certain security-related functions. Because federal computing environments are very large, complex, and geographically dispersed, often consisting of tens or hundreds of thousands of devices, increasing automation of key security processes can assist in the efficient and effective implementation of key controls across the entire enterprise. For example, agencies can better use centrally administered automated diagnostic and analytical tools to continuously scan network traffic and devices across the enterprise to identify vulnerabilities or anomalies from typical usage and monitor compliance with agency configuration requirements. In addition, improving the use of automated tools for patch management can increase efficiency in mitigating known vulnerabilities on many systems within an agency.

Strengthen FISMA and Its Implementing Guidance

FISMA was intended to provide (1) a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets and (2) a mechanism for improved oversight of federal agency information security programs. In June 2009, we proposed several suggested actions that could improve FISMA and its associated implementing guidance, including (1) clarifying requirements for testing and evaluating security controls; (2) requiring agency heads to provide an assurance statement on the overall adequacy and effectiveness of the agency’s information security program; (3) enhancing independent annual evaluations; (4) strengthening annual reporting mechanisms; and (5) strengthening OMB oversight of agency information security programs. Implementing these suggestions can improve the implementation and oversight of federal agency information security programs.

Continue Efforts to Improve Reporting and Oversight

FISMA specifies that OMB is to develop policies, principles, standards, and guidelines on information security. Each year, OMB provides instructions to federal agencies and their inspectors general for preparing the annual FISMA reports. OMB developed an online reporting tool during fiscal year 2009 to improve the efficiency of the annual reporting process. Agencies are required to use the online tool to submit their annual reports and OMB is to use the data submitted in its online reporting tool to summarize the information provided by the agencies and the inspectors general in its report to Congress.

We have previously made several recommendations to OMB for improving its annual reporting instructions and oversight. For example, we have recommended that OMB update its annual reporting instructions to request inspectors general report on the effectiveness of agencies’ processes for developing inventories, monitoring contractor operations, and providing specialized security training. OMB has acted to enhance its reporting instructions; however, further actions need to be taken to fully address these recommendations.

We have also recommended that OMB develop metrics that (1) focus on the effectiveness of information security controls and (2) the overall impact of an agency’s information security program. In September 2009, OMB convened a Security Metrics Taskforce to develop new FISMA performance measures. According to OMB’s website the taskforce is comprised of officials from the both the federal community and private sector and was tasked with developing metrics that focus on outcomes rather than compliance that agencies will be required to report as part of the FISMA reporting process. In December 2009, OMB relea sed draft metrics for comment but has not yet released the final metrics.

Continue to Enhance Federal Information Security through Governmentwide Initiatives

The White House, OMB, and certain federal agencies have undertaken several governmentwide initiatives that are intended to enhance information security at federal agencies.

Address challenges in implementing CNCI. In January 2008, President Bush established the Comprehensive National Cybersecurity Initiative (CNCI). The initiative, which consists of 12 projects, is intended to reduce vulnerabilities, protect against intrusions, and anticipate future threats against federal executive branch information systems. As we recently reported, the White House and federal agencies have established interagency groups to plan and coordinate CNCI activities. However, CNCI faces challenges in achieving its objectives related to securing federal information, including better defining agency roles and responsibilities, establishing measures of effectiveness, and establishing an appropriate level of transparency. Until these challenges are adequately addressed, there is a risk that CNCI will not fully achieve its goals. Among other recommendations, we recommended that the Director of OMB take action to: (1) better define roles and responsibilities of all key CNCI participants; (2) establish measures to determine the effectiveness of CNCI projects in making federal information systems more secure and track progress against those measures; (3) establish an appropriate level of transparency about CNCI; and (4) reach agreement on the scope of CNCI’s education projects to ensure that an adequate cadre of skilled personnel is developed to protect federal information systems. OMB agreed with 3 of the 4 recommendations, disagreeing with the recommendation regarding defining roles and responsibilities. However, such definitions are key to achieving CNCI’s objective of securing federal systems.

Continue efforts to implement TIC and Einstein initiatives. Two specific initiatives of CNCI are Trusted Internet Connections (TIC) and Einstein. TIC is an effort to consolidate the federal government’s external access points (including those to the Internet). TIC is also intended to establish baseline security capabilities and validate agency adherence to those security capabilities. The Einstein initiative is a computer network intrusion detection system that analyzes network flow information from participating federal agencies. The system is to provide a high-level perspective from which to observe potential malicious activity in computer network traffic of participating agencies’ computer networks. Einstein is intended to alert US-CERT in real time of this activity and provides correlation and visualization of the derived data. We have ongoing work that addresses status and implementation of these initiatives.

Continue efforts to implement FDCC. Under the Federal Desktop Core Configuration Initiative, OMB directed agencies that have Windows XP and/or Windows Vista operating systems deployed to adopt the security configurations developed by the National Institute of Standards and Technology, the Department of Defense, and DHS. The goal of this initiative is to improve information security and reduce overall information technology operating costs. We have ongoing work that addresses status and implementation of this initiative.

Improve the national strategy for cybersecurity. In March 2009, we testified on needed improvements to the nation’s cybersecurity strategy.

In preparation for that testimony, we obtained the views of experts (by means of panel discussions) on critical aspects of the strategy, including areas for improvement. The experts, who included former federal officials, academics, and private sector executives, highlighted 12 key improvements that are, in their view, essential to improving the strategy and our national cybersecurity posture. The key strategy improvements identified by cybersecurity experts are listed in table 1.

These recommended improvements to the national strategy are in large part consistent with our previous reports and extensive research and experience in this area. Until they are addressed, our nation’s most critical federal and private sector cyber infrastructure remain at unnecessary risk to attack from our adversaries.

Since our March testimony, the Obama Administration has performed a review of the strategy and issued a list of short and long term actions, which are largely consistent with our past reports and recommendations, to strengthen the strategy. In response to one of these actions, the president appointed a cybersecurity coordinator in December 2009. We recently initiated a review to assess the progress made by the executive branch in implementing the report’s recommendations.

In summary, while federal agencies continue to report increased compliance in implementing security training requirements, most federal agencies reported weaknesses in most types of information security controls. Additionally, agencies reported mixed progress in implementing key security measures while inspectors general identified persistent weaknesses in those areas of agencies’ information security programs. There are multiple opportunities for the federal government to enhance federal cybersecurity and address these continuing weaknesses. These opportunities include addressing the hundreds of recommendations we and inspectors general have made to agencies, making enhancements to FISMA and its implementing guidance, and continuing efforts on White House, OMB, and federal agencies’ initiatives. A concerted response by the federal government to current information security challenges will include acting on these opportunities; without such a response, federal information and systems will remain vulnerable.

Chairwoman Watson, this concludes my statement. I would be happy to answer any questions you or other members of the subcommittee may have.

Contact and Acknowledgments

If you have any questions regarding this statement, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Other key contributors to this statement include Anjalique Lawrence (Assistant Director), Larry Crosland, Sharhonda Deloach, Kristi Dorsey, Rebecca Eyler, Nicole Jarvis, Linda Kochersberger, Mary Marshall, Minette Richardson, and Jayne Wilson.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.