Federal Information Security: Weaknesses Continue to Indicate Need for Effective Implementation of Policies and Practices
Released: 2017-09-28T00:00:00

Letter

Background

Threats to IT systems, both intentional and unintentional, are evolving and growing. Unintentional or nonadversarial threat sources include failures in equipment, environmental controls, or software due to aging, resource depletion, or other circumstances that exceed expected operating parameters. These threats also include natural disasters and failures of critical infrastructure on which the organization depends but are outside of the control of the organization. Intentional or adversarial threats include individuals, groups, entities, or nations that seek to leverage for illegal purposes the organization’s dependence on cyber resources (i.e., information in electronic form, information and communications technologies, and the communications and information-handling capabilities provided by those technologies).

Threats can come from a wide array of sources, including corrupt employees, criminal groups, and terrorists. These threat adversaries vary in terms of their capabilities, their willingness to act, and their motives, which can include seeking monetary gain, or seeking an economic, political, or military advantage.

Cyber threat adversaries make use of various techniques, tactics, and practices, or exploits, to adversely affect an organization’s computers, software, or networks, or to intercept or steal valuable or sensitive information. Further, adversaries can leverage common computer software programs, such as Adobe Acrobat and Microsoft Office, as a means by which to deliver a threat by embedding exploits within software files that can be activated when a user opens a file within its corresponding program. Appendix II contains tables of the sources of cyber-based threats, as well as descriptions of common cyber exploits, and the tactics, techniques, and practices used by cyber adversaries.

Despite a Decrease in Fiscal Year 2016, Federal Agencies Continue to Report Large Numbers of Incidents

Until fiscal year 2016, the number of information security incidents reported by federal agencies to DHS’s United States Computer Emergency Readiness Team (US-CERT) had steadily increased each year. From fiscal year 2006 through fiscal year 2015, reported incidents increased from 5,503 to 77,183, an increase of 1,303 percent. However, the number of reported incidents decreased by 60 percent in fiscal year 2016 to 30,899, as shown in figure 1.

Changes in federal incident reporting guidelines likely contributed to the decrease in reported incidents between fiscal years 2015 and 2016. Updated incident reporting guidelines that became effective in fiscal years 2016 and 2017 no longer required agencies to report noncyber incidents or incidents categorized as scans, probes, and attempted access. In addition, an official from DHS’s National Cybersecurity and Communications Integration Center cited the expanded use of the National Cybersecurity Protection System to detect or block potentially malicious network traffic entering networks at federal agencies as another possible reason for fewer reported incidents.

Different types of incidents merit different response strategies; however, if an agency cannot identify the threat vector, it could be difficult for that agency to define more specific handling procedures to respond to the incident. As shown in figure 2, incidents with a threat vector categorized as “other” make up 38 percent of the various incidents reported to US- CERT in fiscal year 2016.

These incidents and others like them can pose a serious challenge to economic, national, and personal privacy and security. The following examples highlight the impact of such incidents: In April 2017, the Commissioner of the Internal Revenue Service (IRS) testified that the IRS had disabled its data retrieval tool in early March after becoming concerned about the misuse of taxpayer data. Specifically, the agency suspected that personally identifiable information obtained outside the agency’s tax system was used to access the agency’s online federal student aid application in an attempt to secure tax information through the data retrieval tool. In April 2017, the agency began notifying taxpayers who could have been affected by the breach.

In October 2016, the Department of the Treasury’s Office of the Comptroller of the Currency notified us of a major incident it had identified in September 2016. Concurrent with a new policy that restricted employees’ use of removable media devices to prevent users from downloading information onto the devices without approval and review, the agency began reviewing employee downloads to removable media devices. During the review, it identified a significant change in download patterns for a former employee in the weeks before the employee’s separation from the agency. The former employee had downloaded approximately 28,000 files that may have contained controlled unclassified information onto two encrypted external thumb-drive devices. As of October 2016, the agency had been unable to recover the devices storing the files.

FISMA Establishes Responsibilities for Agencies to Address Federal Cybersecurity

Congress enacted FISMA to improve federal cybersecurity and clarify governmentwide responsibilities. As amended in 2014, the act is intended to address the increasing sophistication of cybersecurity attacks, promote the use of automated security tools with the ability to continuously monitor and diagnose the security posture of federal agencies, and provide for improved oversight of federal agencies’ information security programs. Specifically, the act clarifies and assigns additional responsibilities to OMB, DHS, and federal agencies in the executive branch, including:

Develop and oversee the implementation of policies, principles, standards, and guidelines on information security in federal agencies except with regard to national security systems.

Require agencies to identify and provide information security protections commensurate with assessments of risk to their information and information systems.

Ensure that DHS carries out its FISMA responsibilities.

Coordinate information security policies and procedures with related information resources management policies and procedures.

Report annually, in consultation with DHS, on the effectiveness of information security policies and practices, including a summary of major agency information security incidents, an assessment of agency compliance with NIST standards, and an assessment of agency compliance with breach notification requirements.

Ensure that data breach notification policies and guidelines are periodically updated and require notification to congressional committees and affected individuals.

Ensure development of guidance for evaluating the effectiveness of an information security program and practices, in consultation with DHS, the Chief Information Officers Council (CIO) Council, the Council of the Inspectors General on Integrity and Efficiency (CIGIE), and other interested parties, as appropriate.

Administer the implementation of agency information security policies and practices for non-national security information systems, in consultation with OMB, including.

Assist OMB in fulfilling its FISMA authorities, including the development of policies and oversight of agencies’ compliance with FISMA requirements;

Develop, issue, and oversee implementation of binding operational directives to agencies, such as those for incident reporting, contents of annual agency reports, and other operational requirements;

Monitor agency implementation of information security policies

Convene meetings with senior agency officials to help ensure their effective implementation of information security policies and practices; and

Operate the federal information security incident center, deploy technology to continuously diagnose and mitigate threats, compile and analyze data on agency information security, and develop and conduct targeted operational evaluations, including threat and vulnerability assessments of systems.

Establish standards for categorizing information and information systems according to ranges of risk-levels (See Federal Information Processing Standards 199 and 200);

Develop minimum security requirements for information and information systems in each of the risk categories;

Develop guidelines for detection and handling of information security

Develop guidelines, in conjunction with the Department of Defense, for identifying an information system as a national security system.

Executive branch agencies’ responsibilities

Develop, document, and implement an agencywide information security program that includes the following components: periodic risk assessments, which may include using automated tools consistent with NIST standards and guidelines; policies and procedures that (1) are based on risk assessment, (2) cost-effectively reduce information security risks to an acceptable level, (3) ensure that information security is addressed throughout the lifecycle of each system, and (4) ensure compliance with applicable requirements; plans for providing adequate information security for networks, facilities, and systems or groups of information systems, as appropriate; security awareness training to inform personnel of information security risks and of their responsibilities for complying with agency policies and procedures, as well as training personnel with significant security responsibilities for information security; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, to be performed with a frequency depending on risk (but no less than annually); such testing should include using automated tools consistent with NIST standards and guidelines; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices; procedures for detecting, reporting, and responding to security incidents, which may include using automated tools; and plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency.

Comply with DHS binding operational directives in addition to OMB policies and procedures and NIST standards.

Ensure that senior officials carry out assigned responsibilities and that all personnel are held accountable for complying with the agency’s information security program.

Report major security incidents to Congress within 7 days.

In addition, executive branch agencies are to report annually to OMB, certain congressional committees, and the comptroller general of the United States on the adequacy and effectiveness of their information security policies, procedures, and practices, and their compliance with the act. Further, FISMA requires agencies to include descriptions of major incidents in these annual reports. It also requires each agency inspector general, or independent auditor, to annually assess the effectiveness of the information security policies, procedures, and practices of the agency.

The 23 Civilian CFO Act Agencies Reported Information Security Spending

Each year, OMB requires agencies to report how much their agency spends on information security. In fiscal year 2016, each of the 23 civilian agencies covered by the CFO Act reported spending between $3 million and about $1.3 billion on IT security-related activities. Agency reported spending on IT security-related activities ranged between 1 percent and 22 percent of the agencies’ IT budget and between 1 percent and 21 percent of their reported IT spending, as seen in table 1.

Control Weaknesses Indicate Federal Agencies Did Not Adequately or Effectively Implement Information Security Policies and Practices

Weaknesses in security controls such as access controls, configuration management, and security management, indicate that agencies did not adequately or effectively implement information security policies and practices during fiscal year 2016. Further, our work and reviews by inspectors general highlighted information security control deficiencies at agencies that expose information and information systems supporting federal operations and assets to elevated risk of unauthorized use, disclosure, modification, and disruption. Accordingly, we and agency inspectors general have made hundreds of recommendations to agencies to address these security control deficiencies, many of which have not yet been implemented.

Most of the 24 CFO Act Agencies Exhibited Weaknesses in All Major Categories of Controls

Our reports, agency reports, and inspectors general assessments of information security controls during fiscal year 2016 revealed that most of the 24 agencies covered by the CFO Act had weaknesses in each of the five major categories of information system controls: access controls—the policies and practices that limit or detect access to computer resources (data, programs, equipment, and facilities), thereby protecting them against unauthorized modification, loss, and disclosure; configuration management controls—the policies and practices that are intended to prevent unauthorized changes to information system resources (e.g., software programs and hardware configurations) and to assure that software is current and known vulnerabilities are patched; segregation of duties—the policies, practices, and organizational structure that prevent an individual from controlling all critical stages of a process by splitting responsibilities between two or more organizational groups; contingency planning—the policies, plans, and practices that help avoid significant disruptions in computer-dependent operations; and agencywide security management—the policies, processes, and practices that provide a framework for ensuring that risks are understood and that effective controls are selected, implemented, and operating as intended.

The number of agencies with information security weaknesses in each of the five categories for fiscal year 2016 is shown in figure 3.

In the following subsections, specific information security weaknesses are discussed that we identified in our analysis of fiscal year 2016 reports reviewed.

All Agencies Had Weaknesses in Access Controls

Agencies design and implement access controls to provide assurance that access to computer resources (data, equipment, and facilities) is reasonable and restricted to authorized individuals. These controls protect computer resources from unauthorized use, modification, disclosure, and loss by limiting, preventing, or detecting inappropriate access to them. Access controls involve six critical elements: sensitive system resource protection; auditing and monitoring; and physical security.

For fiscal year 2016, our analysis identified 516 access control weaknesses at the 24 agencies. The agencies exhibited the most weaknesses in the identification and authentication, authorization, and audit and monitoring critical elements, as shown in table 2.

Most of the 24 agencies did not adequately protect information system boundaries. Boundary protection controls logical connectivity into and out of networks and controls connectivity to and from devices that are connected to a network. In fiscal year 2016, our analysis identified that 20 of the 24 agencies had weaknesses in boundary protection, including not blocking unsecure network traffic and not filtering sensitive data. In addition, our analysis identified other boundary protection weaknesses, such as not authorizing interconnection security agreements for all external systems with connections to internal systems and not requiring the Internet to be accessible only through a trusted Internet connection. Boundary protection-related deficiencies accounted for 56 of the total 516 access control deficiencies identified. Without appropriately controlling connectivity to system resources, agencies risk exploitation of network entry points and access paths by unauthorized users to gain access to sensitive data.

The implementation of effective identification and authentication controls is one of the most widely reported access control weaknesses. Identification and authentication controls allow a computer system to identify and authenticate different users so that activities on the system can be linked to specific individuals. Factors used for authentication include something you know (password or personal identification number), something you have (cryptographic identification device or token), or something you are (biometric). Multifactor authentication involves using two or more factors to achieve authentication. In addition, OMB directed agencies to implement the use of personal identity verification (PIV) cards, a form of multifactor authentication, for 85 percent of unprivileged users and 100 percent of privileged users by the end of fiscal year 2016.

Our analysis identified weaknesses in identification and authentication controls at all 24 agencies. Based on the reports analyzed, two agencies did not meet the PIV implementation requirement for unprivileged users, five agencies did not meet the requirement for privileged users, and two agencies did not meet the PIV implementation requirement for both unprivileged and privileged users. Identification and authentication related deficiencies accounted for 120 of the 516 total deficiencies found in our analysis. Without implementing adequate logical access controls to appropriately identify and authenticate users, agencies cannot prevent illegitimate users, such as hackers, from accessing systems or restrict legitimate users to only the systems that they need.

The implementation of effective authorization controls was a widely reported access control weakness. Authorization is the process of granting or denying access rights and permissions to a protected resource, such as a network, a system, an application, a function, or a file. Agencies should apply the principle of least privilege that requires users to be granted the most restrictive set of privileges needed to perform only the tasks that they are authorized to perform.

Our analysis identified that all 24 agencies had weaknesses in implementing effective authorization controls, which accounted for 108 of the 516 access control weaknesses. For example, three agencies did not periodically review user access to ensure that access was appropriate for the user’s job function. In addition, five agencies had active system accounts for separated employees. Without effective authorization controls, agencies cannot appropriately control user accounts, thereby preventing unauthorized actions by authenticated system users.

Controls over sensitive system resources are designed to ensure the confidentiality, integrity, and availability of system data, such as passwords and keys during transmission and storage. Cryptography underlies many of the mechanisms used to enforce the confidentiality and integrity of critical and sensitive information.

Our analysis showed that more than half of the 24 agencies had weaknesses in protecting sensitive system resources. Of the access control weaknesses reported, 37 of the 516 access control weaknesses were related to the protection of sensitive system resources for 13 of the 24 agencies. For example, three agencies did not effectively use encryption to protect sensitive data. If sensitive system resources are not adequately protected, an individual could gain access to capabilities that would allow the individual to bypass security features and, thereby, be able to read, modify, or destroy information or other computer resources.

To establish individual accountability, monitor compliance with security policies, and investigate security violations, it is necessary to determine what, when, and by whom specific actions have been taken on a system. Agencies do so by implementing software that provides an audit trail or logs of system activity, that they can use to determine the source of a transaction or attempted transaction and to monitor users’ activities.

In fiscal year 2016, our analysis identified 172 auditing and monitoring weaknesses at 23 of 24 agencies. For example, four agencies did not fully implement effective audit and monitoring controls. Two agencies had audit logs to monitor user activity, but did not review them on a consistent basis. In addition, one agency did not consistently identify, notify, or remediate security incidents to ensure incidents were resolved in a timely manner. Without auditing and monitoring system activity, agencies cannot identify indications of inappropriate or unusual activity, thereby hindering agencies’ capability to detect, report, and respond to security incidents.

Physical security controls help protect computer facilities and resources from espionage, sabotage, damage, and theft. Physical security controls include perimeter fencing, surveillance cameras, security guards, locks, and procedures for granting or denying individuals physical access to computing resources. Physical controls also include environmental controls such as smoke detectors, fire alarms, extinguishers, and uninterruptible power supplies. Considerations for perimeter security include controlling vehicular and pedestrian traffic. In addition, visitor’s access to sensitive areas is to be managed appropriately.

The fewest number of access control weaknesses were identified about physical security. In fiscal year 2016, our analysis identified 23 physical security weaknesses at 13 agencies, including storing switches associated with a data management system in a shared space accessible to people outside of the agency and not retrieving smart identification and PIV cards used to access federal facilities from separated employees. Without adequate physical security controls, agencies cannot restrict physical access to computer resources or protect them from intentional or unintentional loss or impairment.

Overall, our analysis identified access control weaknesses at all 24 agencies. If agencies do not implement security measures to improve access control weaknesses, agencies diminish the reliability of computerized data and increase the risk of destruction or inappropriate disclosure of data.

Agencies Did Not Fully Implement Controls for Configuration Management

Configuration management controls ensure that changes to information system resources are authorized and systems are configured and operated securely and as intended. Configuration management involves the identification and management of security features for all hardware, software, and firmware components of an information system at a given point. It also systematically controls changes to system configurations during the system’s life cycle. These controls, which limit and monitor access to powerful programs and sensitive files associated with computer operations, include: configuration management policies, plans, and procedures; patch management; and emergency configuration change management.

For fiscal year 2016, our analysis identified 223 configuration management weaknesses at 23 of the 24 CFO Act agencies. As shown in table 3, agencies exhibited the most weaknesses in the critical elements of configuration identification, configuration change management, and patch management.

Configuration Management Policies, Plans, and Procedures Configuration management procedures should cover employee roles and responsibilities, change control and system documentation requirements, establishment of a decision-making structure, and configuration management training. In addition, configuration management should be included in an entity’s systems development life cycle methodology, which details procedures that are to be followed when systems and applications are being designed, developed, and modified.

Many of the 24 agencies did not have processes for developing, documenting, and implementing configuration management policies, plans, and procedures. In fiscal year 2016, our analysis identified that 16 of the 24 agencies had weaknesses in developing, documenting, and implementing configuration management procedures. For example, one agency had not developed configuration management standard operating procedures. Another agency had not developed secure baseline configuration guides for its systems. Further, agencies did not implement secure system design, development, and modification procedures. For example, one agency had a web application design flaw that allowed unauthorized users to read and write to the local file system using a vulnerability identified in a software licensing toolkit. Another agency’s public-facing website was configured to display error messages that revealed the web server version number and the operating system. Deficiencies related to configuration management procedures accounted for 25 of the total 223 configuration management deficiencies identified during our analysis. Without good configuration management, agencies cannot provide strict control over the implementation of system changes and, thus, minimize corruption to information systems.

Configuration identification activities involve identifying, naming, and describing the physical and functional characteristics of a controlled item (for example, specifications, design, Internet protocol (IP) address, code, data element, architectural artifacts, and documents). Agencies should manage a current and comprehensive baseline inventory of hardware, software, and firmware, and it should be routinely validated for accuracy.

Federal agencies had weaknesses reported in maintaining current configuration identification information. In fiscal year 2016, based on our analysis, 19 of the 24 agencies had weaknesses in maintaining configuration identification information. For example, at least three agencies did not have a complete inventory of the hardware, deployed software version, or software license information for the systems used throughout the agencies. Of the 223 configuration management deficiencies that our analysis identified, 56 were related to configuration identification. If agencies do not maintain a current and comprehensive baseline of hardware, software, and firmware, agencies cannot validate configuration information for accuracy, thereby hindering them from controlling changes made to a system.

Configuration change management involves authorizing, testing, approving, tracking, and controlling all configuration changes. A formal change management process allows agencies to create an audit trail to clearly document and track configuration changes.

Based on the reports we reviewed, most of the 24 agencies were not properly managing configuration changes. In fiscal year 2016, 20 of the 24 agencies had weaknesses in configuration change management processes, including failing to consistently implement change management procedures for authorizing, testing, and approving system changes; improperly documenting system change requests; and not tracking approved configuration baseline deviations or changes made to the configuration for verification purposes. Configuration change management accounted for 47 of the 223 configuration management deficiencies identified in our analysis. Without a formal configuration change management process, agencies cannot ensure that systems hardware and related programs operate as intended or that no unauthorized changes are introduced.

Current configuration information should be routinely monitored for accuracy. Monitoring should address the current baseline and operational configuration of the hardware, software, and firmware that comprise the information system. In addition, security settings for network devices, operating systems, and infrastructure applications need to be monitored periodically to ensure that they have not been altered and that they are set in the most restrictive mode consistent with the information system operational requirements.

Our analysis identified weaknesses in monitoring system configuration. In fiscal year 2016, based on the reports we reviewed, 8 of the 24 agencies had weaknesses in configuration monitoring, including not auditing computer resources on a routine basis to ensure compliance with formally approved baseline standards and failing to review and verify the accuracy of system information. Of the 223 configuration management deficiencies identified in these reports, 13 were related to configuration monitoring. Without monitoring configuration information, agencies cannot adequately protect access paths between information systems. In addition, if agencies do not monitor system security settings, they cannot ensure that the systems have not been altered or that they are consistent with operational requirements.

Software should be scanned and updated frequently to guard against known vulnerabilities. In addition, security software should be kept current by establishing effective programs for patch management, virus protection, and other emerging threats. Lastly, software releases should be adequately controlled to prevent the use of noncurrent software.

Based on the reports we analyzed, patch management was the most prevalent configuration management weakness. In fiscal year 2016, our analysis identified that 22 of the 24 agencies had 82 patch management weaknesses. For example, 7 agencies failed to install patches in a timely manner and 6 agencies continued to use software even though it was no longer supported by the vendor.

Program changes may need to be performed on an emergency basis to keep a system operating. For example, some systems must be continuously available so that the operations they support are not interrupted. In these cases, the risk of missing a deadline or disrupting operations may pose a greater risk than that of temporarily suspending program change controls. However, due to the increased risk that errors or other unauthorized modifications could be introduced, emergency changes should be kept to a minimum. Based on the reports that we analyzed, none of the 24 agencies had weaknesses in appropriately documenting and approving emergency changes to the configuration, based on the reports we reviewed.

Without proper configuration controls, increased risk exists that security features on agency systems could be inadvertently or deliberately omitted or turned off, or that malicious code could be introduced.

More Than Half of the Agencies Did Not Segregate Incompatible Duties

Segregation of duties provides reasonable assurance that incompatible duties are effectively separated and ensures that one individual cannot independently control key aspects of a computer-related operation. Such control would allow that individual to take unauthorized actions or gain unauthorized access to assets or records. Critical elements to achieving adequate segregation include: (1) segregation of incompatible duties and establishment of related policies and (2) controlling employee activity.

In fiscal year 2016, our analysis identified 49 weaknesses in segregation of duties controls at 22 of the 24 agencies. As shown in table 4, agencies exhibited the most weaknesses in the segregation of incompatible duties critical element.

Segregation of Incompatible Duties and Establishment of Related Policies Federal internal control standards specify that key duties and responsibilities for authorizing, processing, recording, and reviewing transactions should be separated. Often, segregation of duties is achieved by splitting responsibilities between two or more organizational groups. Dividing responsibilities this way diminishes the likelihood that errors or wrongful acts will go undetected because the activities of one group or individual will serve as a check on the activities of the other.

Agencies had weaknesses in identifying and segregating incompatible duties and establishing related policies. At least seven agencies did not properly segregate personnel responsibilities. For example, one agency combined the roles of the Deputy Chief Information Officer and the Chief Information Security Officer and assigned both to one individual. This meant that one individual performed security control activities at the same time that the person reviewed that activity for compliance with FISMA. Other weaknesses were related to the development of policies and procedures for segregating duties. Deficiencies related to the identification and segregation of duties accounted for 33 of the 49 total segregation-of-duties control deficiencies that we identified in our analysis. If agencies do not effectively segregate incompatible duties and establish related policies, they risk having one individual in control of critical stages of a process, thereby allowing that person to take unauthorized actions or gain unauthorized access to assets or records, possibly without detection.

Supervision and review of employee activities on a computer system help make certain that users’ activities are performed in accordance with prescribed procedures, that mistakes are corrected, and that the computer is used only for authorized purposes.

In fiscal year 2016, our analysis identified 16 weaknesses in control over employee activity at 12 of the 24 agencies. Weaknesses reported include not preventing or detecting segregation of duties conflicts, failing to restrict access to system software, and not reviewing user activity for suspicious or malicious activity. If agencies inadequately control personnel activities, the agencies could allow mistakes to occur and go undetected and facilitate unauthorized use of a computer.

Without adequately segregated duties, agencies increase the risk that erroneous or fraudulent transactions could be processed, improper program changes could be implemented, or computer resources could be damaged or destroyed.

Agencies Had Weaknesses in Contingency Planning

System interruptions can result in the loss of the capability to process, retrieve, and protect electronically maintained information, which can cause financial losses, expensive recovery efforts, and inaccurate or incomplete information. Given the implications of system interruptions, agencies should have procedures for protecting information resources and minimizing the risk of unplanned interruptions. Agencies should also have a plan in place to recover critical operations should interruptions occur. The critical elements of contingency planning include: data and operations assessment; damage and interruption prevention; contingency plan testing.

For fiscal year 2016, as shown in table 5, our analysis identified 106 contingency planning weaknesses. These agencies exhibited the most weaknesses in contingency planning and contingency plan testing.

Agencies should assess the criticality and sensitivity of computerized operations and identify supporting resources. It is important that agencies analyze data and operations to determine which are the most critical and what resources are needed to recover and support them.

In fiscal year 2016, our analysis identified 17 data and operations assessment weaknesses at 12 of the 24 agencies. For example, four agencies’ inspectors general reported that their agencies did not consider supply chain threats in their contingency planning. In addition, inspectors general at seven agencies reported that their agency did not incorporate business impact or business process analysis into development of the agencies’ contingency planning. If agencies do not identify or prioritize critical data and operations or identify and analyze the resources supporting them, agencies cannot determine which resources merit the greatest protection and what contingency plans need to be made.

Agencies should take steps to prevent and minimize potential damage and interruption to operations. For examples, agencies can implement capabilities to restore data files, which may be impossible to recreate if lost. In addition, agencies can implement thorough backup procedures and install environmental controls.

In fiscal year 2016, our analysis identified that damage and interruption prevention weaknesses at 14 of the 24 agencies, including failing to retain incremental or full backups and not having an alternate-site redundancy for key mission support information systems. Other weaknesses included not accurately documenting the alternate processing site and backup procedures. Deficiencies related to preventing damage and interruption accounted for 20 of the total 106 contingency planning deficiencies. If agencies do not adequately implement controls to prevent and minimize interruption, agencies risk losing or incorrectly processing data.

According to NIST, contingency planning represents a broad scope of activities designed to sustain and recover critical IT services following an emergency. These plans should be clearly documented, communicated to affected staff, and updated to reflect current operations.

In fiscal year 2016, our analysis identified 34 contingency planning weaknesses at 16 of the 24 agencies. For example, at least three agencies had not updated their contingency plans to reflect the current operating environment. Other contingency planning weaknesses included failure to ensure that business continuity and disaster recovery plans were in place. Without a comprehensive contingency plan in place, agencies can lose the capability to process, retrieve, and protect electronically maintained information, which can affect an agency’s ability to accomplish its mission.

Testing contingency plans is essential to determining whether they function as intended in an emergency situation. Through this testing, contingency plans can be substantially improved.

Our analysis identified 16 of the 24 agencies had weaknesses in testing their contingency plans. At least five agencies failed to periodically test contingency plans for their systems and one did not provide evidence that it tested contingency plans for all its systems. Of the 106 contingency planning deficiencies that we identified in our analysis, 35 were related to contingency plan testing. If agencies do not test their contingency plans, agencies cannot identify weaknesses in the contingency plans or assess how well employees have been trained to carry out their roles and responsibilities in a disaster situation.

Overall, without effective contingency planning, agencies are unable to ensure that their systems can operate effectively without excessive interruption and can be recovered as quickly and effectively as possible following a service disruption.

Agencies Did Not Effectively Manage Security

An agencywide security program, as required by FISMA, provides a framework for assessing and managing risk, including developing and implementing security policies and procedures, conducting security awareness training, monitoring the adequacy of the entity’s computer related controls through security tests and evaluations, and implementing remedial actions as appropriate. The critical elements for security management include: security management program establishment; risk assessment and validation; security control documentation and implementation; information security weakness remediation; and contractor system review.

For fiscal year 2016, our analysis identified 623 security management weaknesses across the 24 CFO Act agencies. As table 6 shows, agencies exhibited the most weaknesses in the security management program establishment and security program monitoring critical elements.

An agencywide information security management program is the foundation of a security control structure and a reflection of senior management’s commitment to addressing security risks. The security management program should cover all major systems and facilities and outline the duties of those who are responsible for overseeing security and those who own, use, or rely on an agency’s computer resources. Agencies should have a security management structure in place and all policies, plans, and procedures should be kept up-to-date.

In fiscal year 2016, based on the reports we analyzed, 23 agencies had 161 weaknesses in establishing a security management program. These weaknesses included failing to implement an agencywide risk management framework for information security, not ensuring security management policies and procedures are updated, and not designating permanent security management roles and responsibilities. If agencies do not establish a security management program, they may lack a framework and continuous cycle of activity for assessing risk, developing and implementing effective security procedures, and monitoring the effectiveness of these procedures.

A comprehensive risk assessment should be the starting point for developing or modifying an agency’s security policies and plans. Risk assessments should consider threats and vulnerabilities at the agencywide, system, and application levels, and consider risks to data confidentiality, integrity, and availability. In addition, NIST guidance states that systems should be granted authorization to operate after an authorizing official reviews the system authorization package and determines the risk associated with the system acceptable.

Our analysis identified that 20 of the 24 agencies had weaknesses in assessing and validating risks. For example, at least five agencies allowed systems to continue to operate, even though the system authorizations to operate (ATOs) had expired. Also, risk assessment and validation deficiencies accounted for 70 of the total 623 security management deficiencies. Without a process for periodically assessing and validating risks, agencies cannot ensure that all threats and vulnerabilities are identified and considered, that the greatest risks are addressed, and that appropriate decisions are made regarding which risks to accept or mitigate through security controls.

Security Control Documentation and Implementation Security control policies and procedures should consider risk, address general and application controls, and ensure that users can be held accountable for their actions. They should also be documented and approved by management.

In fiscal year 2016, 22 of the 24 agencies had 81 security control implementation weaknesses based on the reports we analyzed. For example, at least two agencies failed to develop or document security control procedures and at least three agencies did not update security control procedures. In addition, at least one agency did not implement security control procedures. If agencies do not develop, document, update, or implement security control procedures, they cannot ensure that information security is addressed throughout the life cycle of each agency information system.

An ongoing security awareness program should be implemented that includes first-time awareness training for all new employees, contractors, and users; and periodic refresher training for all employees, contractors, and users. In addition, specialized training for those individuals with significant security responsibilities should be offered. Further, all affected personnel should receive and acknowledge understanding the organization’s security policies detailing rules and expected behaviors.

In fiscal year 2016, our analysis identified that 20 of the 24 agencies had weaknesses in implementing a security training program. For example, at least four agencies did not track the status of role-based security training for personnel with significant information security responsibilities. Of the total 623 security management deficiencies identified in our analysis, 84 were related to security awareness training. Without an effective security training program, agencies risk having employees or contractors inadvertently or intentionally compromising security.

An important element of risk management is ensuring that policies and controls intended to reduce risk are effective on an ongoing basis. Effective monitoring involves agencies performing tests of information security controls to evaluate or determine whether they are appropriately designed and operating effectively. It should also include periodically assessing the appropriateness of security policies and the agency’s compliance with them.

In fiscal year 2016, our analysis identified that 21 of the 24 agencies had weaknesses in monitoring their security program, including failing to implement continuous monitoring that requires the validation of compliance with security requirements and not conducting risk management that monitors the selection, implementation, and assessment of security controls. Deficiencies related to security program monitoring accounted for 113 of the total 623 security management deficiencies. Without effectively monitoring agency security programs, agencies cannot ensure that security policies and controls are reducing risk as intended.

Agencies should have processes for effectively remediating information security weaknesses. When weaknesses are identified, the related risks should be reassessed, appropriate corrective or remediation actions taken, and follow-up monitoring performed to make certain that the corrective actions are effective. In addition, agencies are to develop plans of actions and milestones (POA&Ms) that describe corrective and remediation actions needed to address identified information security weaknesses. These plans should be based on findings from security control assessments, security impact analyses, continuous monitoring of activities, audit reports, and other sources.

Twenty-three of the 24 agencies did not have effective processes for remediating information security weaknesses. For example, at least 10 agencies did not remediate identified information security weaknesses in a timely manner. Of those 10 agencies, at least 7 did not use or effectively manage POA&Ms to track, prioritize, and remediate information security weaknesses. Of the 623 security management weaknesses identified in our analysis, we determined that 58 were related to information security weakness remediation. If agencies do not remediate information security weaknesses in a timely manner or use POA&Ms to track the status of identified weaknesses, agencies are exposed to increased risks that nefarious actors will exploit the weaknesses to gain unauthorized access to information resources.

Appropriate policies and procedures should be developed, implemented, and monitored to ensure that the activities performed by third parties are documented, agreed to, implemented, and monitored for compliance. In addition, checks should be performed periodically to ensure that the procedures are correctly applied and consistently followed, including the security of relevant contractor systems and outsourced software development.

In fiscal year 2016, our analysis identified 56 weaknesses related to contractor system reviews at 20 of the 24 agencies, including not identifying and maintaining a current system inventory of contractor- operated systems, failing to document or consistently perform procedures for monitoring contractor-operated systems, and failing to perform a formal security assessment of external systems. Without ensuring that external systems are adequately secure, agencies risk having contractors introduce information security risks to their information and systems.

Overall, without a well-designed program, security controls may be inadequate; responsibilities may be unclear, misunderstood, or improperly implemented; and controls may be inconsistently applied. Such conditions may lead to insufficient protection of sensitive or critical resources and disproportionately high expenditures for controls over low-risk resources.

GAO Has Made Hundreds of Recommendations to Address Cybersecurity Deficiencies That Place Systems at Risk

Our work at federal agencies continues to highlight information security deficiencies in both financial and nonfinancial systems. We have made hundreds of recommendations to agencies to address these security control deficiencies, but many have not yet been fully implemented. The following examples describe the types of risks we found at federal agencies, our recommendations, and the agencies’ responses to our recommended actions.

In August 2016, we reported that the Food and Drug Administration (FDA), an agency of the Department of Health and Human Services, had a significant number of security control weaknesses that jeopardize the confidentiality, integrity, and availability of its information systems and industry and public health data. Specifically, FDA had not fully or consistently implemented access controls, which are intended to prevent, limit, and detect unauthorized access to computing resources. FDA also had weaknesses in other controls, such as those intended to manage the configurations of security features on and control changes to hardware and software; plan for contingencies, including system disruptions and their recovery; and protect media such as tapes, disks, and hard drives to ensure information on them was “sanitized” and could not be retrieved after the hardware was discarded.

We made 15 recommendations to FDA to fully implement its agencywide information security program. We also recommended that FDA take 166 specific actions to resolve weaknesses in information security controls. The department concurred with our recommendations, has implemented 68 of them, and stated that it is working to address all the recommendations as quickly as possible. The department also stated that FDA has acquired third-party expertise to assist in these efforts to immediately address the recommendations.

In May 2016, we reported that the National Aeronautical and Space Administration, Nuclear Regulatory Commission, Office of Personnel Management, and the Department of Veteran Affairs had not always effectively implemented access controls over selected high-impact systems. We reported that weaknesses at these agencies also existed in patching known software vulnerabilities and planning for contingencies. An underlying reason for these weaknesses is that the agencies had not fully implemented key elements of their information security programs.

We made recommendations to each of these agencies to fully implement key elements of their information security programs. The agencies generally concurred with the recommendations, with the exception of the Office of Personnel Management. It disagreed with our recommendation regarding the evaluation of security control assessments to ensure comprehensive testing of technical controls.

In March 2016, we reported that the Internal Revenue Service had weaknesses in information security controls that limited its effectiveness in protecting the confidentiality, integrity, and availability of financial and sensitive taxpayer data. Specifically, the agency had not always (1) implemented controls for identifying and authenticating users, such as applying proper password settings; (2) appropriately restricted access to servers; (3) ensured that sensitive user authentication data were encrypted; (4) audited and monitored systems to ensure compliance with agency policies; and (5) ensured access to restricted areas was appropriate. In addition, unpatched and outdated software exposed it to known vulnerabilities. An underlying reason for these weaknesses is that the Internal Revenue Service had not effectively implemented elements of its information security program.

We made two recommendations to more effectively implement security-related policies and plans. The Internal Revenue Service agreed with our recommendations and stated that it would review them to ensure that its actions include sustainable fixes that implement appropriate security controls balanced against information technology and human capital resource limitations.

Inspectors General Determined That Federal Agencies Generally Did Not Have Effective Information Security Program Functions

Inspectors general evaluations of agency information security programs, including their respective agencies’ policies and practices, determined that most agencies did not have effective information security program functions in fiscal year 2016. The inspectors general evaluated the information security programs for the 24 CFO Act agencies for fiscal year 2016 and determined that only 7 of the 24 agencies had information security programs with any functions considered to be effective. Further, inspectors general from 20 of the 23 civilian agencies cited information security as a “major management challenge” for their respective agency. The inspectors general made numerous recommendations to address these and other issues.

Appendix III provides an overview of the methodology for the inspector general evaluations of their agencies’ information security programs and the results of their reviews by agency for fiscal year 2016.

Agencies Acted to Fulfill Their FISMA- defined Roles, but Did Not Sufficiently Plan to Evaluate the Effectiveness of Their Efforts

As required in FISMA, OMB, DHS, NIST, and the agencies’ inspectors general have ongoing and planned initiatives to support the act’s implementation across the federal government. OMB, among other things, oversaw and reported to Congress on agencies’ implementation of information security policies, standards, and guidelines. DHS oversaw and assisted government efforts to provide adequate, risk-based, cost- effective cybersecurity, and NIST developed security standards and guidelines for agencies. Further, agencies’ inspectors general conducted annual independent assessments to determine the effectiveness of their respective agencies’ information security programs and practices in accordance with evaluation guidance developed by OMB. However, the oversight agencies do not have plans or a schedule to evaluate the effectiveness of the maturity model developed for inspectors general to evaluate their agencies’ information security programs.

OMB Continued to Provide Guidance for Annual FISMA Reporting and Assistance to Support Agencies’ Cybersecurity

FISMA requires that OMB submit a report to Congress no later than March 1 of each year on the effectiveness of agencies’ information security policies and practices during the preceding year. This report is to include: a summary of incidents described in the agencies’ annual reports; a description of the threshold for reporting major information security a summary of results the annual IG evaluations of each agency’s information security program and practices; an assessment of each agency’s compliance with NIST information an assessment of agency compliance with OMB data breach notification policies and procedures.

Although OMB did not meet the deadline of March 1, its annual report to Congress for fiscal year 2016 met the other requirements. Specifically, its report provided an overview of federal cybersecurity, the results of inspectors general evaluations, summaries of agencies’ cybersecurity performance, including security incidents reported to US-CERT, and the results of agencies’ privacy program performance.

FISMA also required that OMB develop and oversee the implementation of policies, principles, standards, and guidelines on information security. In addition, FISMA required that OMB amend or revise Circular A-130, its policy regarding managing federal information no later than December 18, 2015, a year after FISMA was enacted.

Since we reported in 2015 on FISMA implementation, OMB has developed or revised policies and overseen their implementation as follows:

OMB updated and released the revised OMB Circular A-130, Managing Information as a Strategic Resource, for comment in October 2015 and released the final version in July 2016, approximately 7 months after the statutory deadline. This circular, last revised in 2000, established general policy for the planning, budgeting, governance, acquisition, and management of federal information, personnel, equipment, funds, information technology resources and supporting infrastructure and services. According to OMB, the latest revised circular reflects changes in law and advances in technology, and represents a shift from viewing security and privacy requirements as compliance exercises to understanding them as crucial elements of a comprehensive, strategic, and continuous risk- based program at federal agencies.

In October 2015, OMB issued Memorandum M-16-04, Cybersecurity Strategy and Implementation Plan (CSIP), a guide for federal agencies instructing them to take actions identified as needed through the 2015 30-day Cybersecurity Sprint. The CSIP’s key actions included directing agencies to identify their high-value assets and critical system architecture in order to understand the potential impact to those assets and architecture from an adverse cyber incident. The CSIP indicated that progress on the identified actions will be tracked through mechanisms such as comprehensive reviews of agency- specific cybersecurity posture (CyberStats).

In November 2016, OMB issued Memorandum M-17-05, which included an updated definition of a major information security incident for cyber incident reporting to significantly raise the threshold for an incident to be reported as major. It also updated breach notification policies and requirements for notification to congressional committees and affected individuals. In the updated policy, a breach of personally identifiable information considered to be a major incident, including unauthorized access to 100,000 or more individuals’ PII (an increase from the 10,000 threshold in prior guidance), must be reported to Congress within seven days. In addition, OMB’s guidance included an incident reporting validation process intended to improve the overall quality of incident data reported.

Further, FISMA directs OMB to oversee agency compliance with requirements to provide information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification or destruction of information or information systems. To fulfill this responsibility, OMB, in coordination with DHS, conducted 24 CyberStat reviews in fiscal year 2016 to help agencies develop action items that address information security risks, identify areas for targeted assistance, and track performance throughout the year. DHS reported that CyberStat reviews were conducted at 16 CFO Act agencies and 7 non-CFO Act agencies during fiscal year 2016 and resulted in 186 cybersecurity-related recommendations that agencies implemented or were in the process of implementing. In addition, OMB conducted a CyberStat review of the continuous diagnostics and mitigation (CDM) program. These reviews revealed cybersecurity issues across the agencies such as high turnover in information technology leadership positions and other workforce challenges, funding mechanisms adversely impacting agencies’ cybersecurity posture, immature continuous monitoring programs, and challenges meeting goals for implementing strong authentication methods (e.g., PIV cards).

DHS Issued Cybersecurity-related Directives and Continued to Monitor Cybersecurity Incidents

Under FISMA, DHS, in consultation with OMB, is responsible for carrying out seven activities, including developing information security policies and practices, such as binding operational directives; and overseeing their implementation. In addition, DHS is required to monitor agency implementation of information security policies and practices, meet with senior agency officials to assist with their implementation, and provide operational and technical assistance to agencies.

As required by FISMA, DHS had developed four binding operational directives as of July 2017. These directives instruct agencies to: mitigate critical vulnerabilities discovered by DHS’s National Cybersecurity & Communications Integration Center (NCCIC) through its scanning of agencies’ Internet-accessible systems; participate in risk and vulnerability assessments as well as security architecture assessments conducted by DHS on agencies’ high-value assets; address several urgent vulnerabilities in network infrastructure devices identified in a NCCIC analysis report within 45 days of the directive’s issuance; and report cyber incidents and comply with annual FISMA reporting requirements.

DHS also provided common security capabilities for agencies in accordance with the FISMA requirement that the department deploy technology, as requested by agencies, to help agencies continuously diagnose and mitigate against cyber threats and vulnerabilities. For example, the National Cybersecurity Protection System (NCPS) (which includes EINSTEIN) and the CDM program are ongoing DHS initiatives to help secure agency information systems. DHS is accelerating the deployment of CDM and EINSTEIN capabilities to all participating federal agencies to enhance detection of cyber vulnerabilities and protection from cyber threats.

NCPS was developed to be one of the tools to aid federal agencies in mitigating information security threats. The system is intended to provide DHS with the capability to provide four cyber-related services to federal agencies: intrusion detection, intrusion prevention, analytics, and information sharing. In January 2016, we reported that NCPS supported a variety of data analytical tools but had limited intrusion prevention and detection capabilities. In addition, while DHS had developed metrics for measuring the performance of NCPS, the department did not gauge the quality, accuracy, or effectiveness of the system’s intrusion detection and prevention capabilities.

CDM is to provide federal departments and agencies with commercial off-the-shelf capabilities and tools that identify cybersecurity risks on an ongoing basis, prioritize these risks based upon potential impacts, and enable cybersecurity personnel to mitigate the most significant problems first. DHS and the General Services Administration have partnered to implement a blanket purchase agreement available to government entities to acquire and implement CDM tools. In November 2016, DHS awarded a contract for phase 2 of CDM designed to strengthen policies and practices for the authentication of users.

NIST Continues to Provide Information Security Guidance to Agencies

According to FISMA, NIST is to develop information security standards and guidelines, in coordination with OMB and DHS. Specifically, NIST’s Computer Security Division is responsible for developing cybersecurity standards, guidelines, tests, and metrics for the protection of federal information systems.

NIST has developed information security guidelines for federal agencies. Specifically, NIST issued a draft of the revised Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework) in January 2017 in response to feedback and questions received after the original framework’s release. The revised framework includes a new section on cybersecurity measurement, an expanded explanation of using the framework for cyber supply chain risk management, and refinements to authentication, authorization, and identity proofing policies within access controls.

In addition, in May 2017, NIST released draft Cybersecurity Framework implementation guidance. The guidance provides federal agencies with approaches to leveraging the framework to address common cybersecurity-related responsibilities. The implementation guidance is intended to assist federal agencies as they develop, implement, and continuously improve their cybersecurity risk management programs.

Further, in August 2017, NIST released the initial draft of Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations. According to NIST, the update provides a comprehensive set of safeguarding measures for all types of computing platforms and includes security and privacy controls to protect the critical and essential operations and assets of organizations and the personal privacy of individuals. Among the changes in the updated version are the integration of different risk management and cybersecurity approaches including the Cybersecurity Framework and the clarification of the relationship between security and privacy to improve the selection of the appropriate risk mitigating controls.

Inspectors General Evaluated Agency Information Security Programs Using a Maturity Model, but Oversight Agencies Do Not Have a Plan or Schedule for Evaluating the Model’s Usefulness

FISMA requires that federal agencies’ inspectors general conduct annual independent evaluations to determine the effectiveness of the information security program and practices of their respective agencies based on annually issued OMB guidance. These evaluations are to: test the effectiveness of information security policies, procedures, and practices of a subset of agency information systems, and assess the effectiveness of an agency’s information security policies, procedures, and practices.

We previously reported OMB’s FISMA reporting guidance for the inspectors general was not complete and resulted in inconsistent responses to questions in their evaluations. The reporting guidance lacked defined criteria for inspectors general to answer questions about their agencies’ information security program components and arrive at an evaluation of the program’s effectiveness. We recommended that OMB, DHS, the CIO Council, and the Council of the Inspectors General on Integrity and Efficiency (CIGIE) enhance reporting guidance to the inspectors general to achieve more consistent and comparable evaluations.

In fiscal year 2015, CIGIE, in coordination with DHS, OMB, NIST, and other key stakeholders, began developing a security capability maturity model as a methodology to provide an in-depth assessment of agency information security programs. The purpose of the maturity model is to: summarize the status of agencies’ information security programs; provide status about what has been accomplished and what still needs to be implemented to improve the information security program to the next maturity level, and help ensure consistency across the IG annual FISMA reviews.

The maturity model provides metrics to be used as criteria to evaluate an agency’s information security performance areas or domains defined in the annual OMB guidance to the inspectors general for FISMA evaluations.

The inspectors general have implemented the model in phases during their assessments of agency information security programs. In fiscal year 2015, OMB’s guidance with reporting metrics directed the inspectors general to use the security capability maturity model to evaluate only one information security function, their agencies’ information security continuous monitoring process. In fiscal year 2016, the reporting metrics expanded the use of the security capability maturity model for inspectors general to evaluate their agencies’ incident response, as well as information security continuous monitoring programs.

OMB, in consultation with DHS, the CIO Council, and CIGIE, issued fiscal year 2017 FISMA reporting metrics and guidance for the inspectors general that encompasses the full implementation of the security capability maturity model for all security functions. The guidance provides reporting requirements across key areas to be addressed in the independent assessment of agencies’ information security programs. Further, the guidance instructs the inspectors general to evaluate their agencies’ information security programs and assess the effectiveness of the programs using the security capability maturity model. It also states that October 31, 2017, is the deadline for agencies to submit their inspectors general metrics to DHS. Applying the maturity model across all the security functions is to help promote consistent and comparable outcomes from the inspectors general independent annual evaluations.

Federal guidance and other management practices call for the evaluation of management tools to ensure they are effective. Evaluations of effectiveness should entail assessing whether the tool produces accurate results, can be consistently applied, and is useful in achieving agency objectives. OMB reported that the inspectors general and OMB plan to continue to work together to refine the assessment process and provide methodologies for comparing performance across the government. An official from CIGIE stated that after the full implementation of the security capability maturity model, OMB intends for future guidance to the inspectors general to incorporate measures to address the effectiveness of the model and its use in evaluating agency information security programs. However, the fiscal year 2017 guidance does not include a plan or schedule to determine whether using the security capability maturity model will provide useful results that are consistent and comparable. Until an evaluative component is incorporated into the implementation of the maturity model, OMB will not have reasonable assurance that the inspectors general evaluations of agency information security programs will have consistent and comparable results across all federal agencies as intended.

Conclusions

While federal agencies are working to carry out their FISMA-assigned responsibilities, they continue to experience information security program deficiencies and security control weaknesses in all areas including access, configuration management, and segregation of duties. In addition, the inspectors general evaluations of the information security program and practices at their agencies determined that most agencies did not have effective information security program functions. We are not making new recommendations to address these weaknesses because we and the inspectors general have previously made hundreds of recommendations. Until agencies correct longstanding control deficiencies and address our and agency inspectors general’s recommendations, federal IT systems will remain at increased and unnecessary risk of attack or compromise. We continue to monitor the agencies’ progress on those recommendations.

Although the inspectors general have continued to implement the security capability maturity model to help ensure more consistency in their program evaluations, OMB, DHS, the CIO Council, and CIGIE have not developed a plan and schedule to evaluate whether the model has achieved useful results that are consistent and comparable as intended. Further, if OMB, DHS, the CIO Council, and CIGIE, are unable to determine whether using the capability maturity model yields consistent and comparable results, they will not have reasonable assurance that agency information security programs have been consistently evaluated.

Recommendation for Executive Action

We recommend that the Director of the Office of Management and Budget, in consultation with the Secretary of Homeland Security, and the Chief Information Officers Council, evaluate whether the full implementation of the capability maturity model developed by the Council of the Inspectors General on Integrity and Efficiency ensures that consistent and comparable results are achieved across all federal agencies. (Recommendation 1)

Agency Comments and Our Evaluation

We provided a draft of this report to OMB; the Departments of Agriculture, Commerce, Defense, Homeland Security, Housing and Urban Development, and Labor; the National Aeronautics and Space Administration; and the Nuclear Regulatory Commission. Of these agencies, OMB’s Program Analyst from the Office of the Federal Chief Information Officer provided comments via e-mail stating that the agency generally concurred with our recommendation. The official added that OMB will continue to work with the Department of Homeland Security, the Chief Information Officers Council, and the Council of the Inspectors General on Integrity and Efficiency to enhance the capability maturity model, and develop a standard methodology that allows for consistent and comparable results across all federal agencies.

In addition, we received written comments from one agency—the Department of Housing and Urban Development—in which it stated that the department had no comment on the draft report. The department added, however, that it is committed to following the established federal laws and guidance and ensuring that its information security program requirements are properly implemented and documented. The department’s comments are reprinted in appendix IV.

Further, via e-mail, officials of four agencies—the Department of Agriculture’s Senior Advisor for Oversight and Compliance in the Office of the Chief Information Officer; the Department of Labor’s representative from the Office of the Assistant Secretary for Policy; the National Aeronautics and Space Administration’s audit liaison program manager from the Mission Support Directorate; and the Nuclear Regulatory Commission’s executive technical assistant in the Office of the Executive Director for Operations—responded that their agencies did not have any comments on the draft report.

Finally, in addition to OMB, the Department of Defense; the Department of Homeland Security; and the Department of Commerce’s National Institute of Standards and Technology provided technical comments on the draft report, which we incorporated as appropriate.

We are sending copies of this report to the Director of the Office of Management and Budget, the Secretary of Homeland Security, and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov.

If you have any questions regarding this report, please contact me at (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to evaluate (1) the adequacy and effectiveness of federal agencies’ information security policies and practices and (2) the extent to which agencies with governmentwide responsibilities have implemented their requirements under the Federal Information Security Management Act of 2002 as amended by the Federal Information Security Modernization Act of 2014 (FISMA).

To assess the adequacy and effectiveness of agencies’ information security policies and practices, we analyzed our, agency, and inspectors general (IG) information security-related reports that were issued from October 2015 through January 2017 and covered agencies’ fiscal year 2016 security efforts. We analyzed, categorized, and summarized weaknesses identified in these reports using the five major categories of information security general controls identified in our Federal Information System Controls Audit Manual: (1) access controls, (2) configuration management controls, (3) segregation of duties, (4) contingency planning, and (5) security management controls. We also analyzed, categorized, and summarized the annual FISMA data submissions for fiscal year 2016 by each agency’s inspector general. In addition, we analyzed financial reports for fiscal year 2016 for the 23 civilian federal agencies covered by the Chief Financial Officers Act and Office of Management and Budget’s (OMB) 2017 annual report to Congress on FISMA implementation. Using cybersecurity spending data provided in OMB’s annual FISMA report to Congress and information technology (IT) spending data available on the IT Dashboard, we determined the percentage of IT spending that agencies allotted to IT security in fiscal year 2016.

For the first objective, we also determined the reliability of agency- submitted data at six agencies. To select these agencies for each of our prior three FISMA evaluation reports, we sorted the 24 major agencies from highest to lowest using the total number of systems each agency had reported each year; separated them into even categories of large, medium, and small agencies; then selected the median two agencies from each category. For fiscal year 2016, the Departments of Agriculture, Defense, Housing and Urban Development, and Labor; the National Aeronautics and Space Administration; and the Nuclear Regulatory Commission were the remaining agencies not selected in prior reporting cycles. To assess the reliability of the agency-submitted data, we collected and analyzed documentation of agencies’ FISMA reporting processes to determine if they were effective in ensuring the quality of the information reported for FISMA. We also conducted interviews with agency officials to get an understanding of the quality control processes in place to produce the annual FISMA reports. As appropriate, we also interviewed officials from OMB, the Department of Homeland Security (DHS), and the National Institute of Standards and Technology (NIST). While not generalizable to all agencies, the information we collected and analyzed provided insights into various processes in place to produce FISMA reports. Based on this assessment, we determined that the data were sufficiently reliable for the purposes of our objective.

To evaluate the extent to which agencies with governmentwide responsibilities have implemented their FISMA’s requirements, we analyzed the provisions of the 2002 and 2014 acts to identify the responsibilities for overseeing and providing guidance for agency information security. We collected documentation of coordination between DHS, OMB, and the IGs to update and refine the FISMA reporting metrics. We also identified DHS-issued binding operational directives, newly issued NIST publications, and other government-wide initiatives to improve federal information security. In addition, we interviewed agency officials to collect information and documentation of their interaction with OMB and DHS for FISMA activities.

We conducted this performance audit from October 2016 to September 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Cyber Threats and Exploits

Appendix II: Cyber Threats and ExploitsFailures in displays, sensors, controllers, and information technology hardware responsible for data storage, processing, and communications.

Failures in temperature/humidity controllers or power supplies.

Failures in operating systems, networking, and general-purpose and mission-specific applications.

Events beyond an entity’s control such as fires, floods, tsunamis, tornados, hurricanes, and earthquakes.

Natural events beyond the entity’s control that are not considered disasters (e.g., sunspots).

Failure or outage of telecommunications or electrical power.

Failures resulting from erroneous accidental actions taken by individuals (both system users and administrators) in the course of executing their everyday responsibilities.

Hackers break into networks for the challenge, revenge, stalking, or monetary gain, among other reasons. Hacktivists are ideologically motivated actors who use cyber exploits to further political goals.

Insiders (e.g., disgruntled organization employees, including contractors) may not need a great deal of knowledge about computer intrusions because their position within the organization often allows them to gain unrestricted access and cause damage to the targeted system or to steal system data. These individuals engage in purely malicious activities and should not be confused with nonmalicious insider accidents.

Nations, including nation-state, state-sponsored, and state-sanctioned programs use cyber tools as part of their information-gathering and espionage activities. In addition, several nations are aggressively working to develop information warfare doctrine, programs, and capabilities.

Criminal groups seek to attack systems for monetary gain. Specifically, organized criminal groups use cyber exploits to commit identity theft, online fraud, and computer extortion.

Terrorists seek to destroy, incapacitate, or exploit critical infrastructures in order to threaten national security, cause mass casualties, weaken the economy, and damage public morale and confidence.

Unknown malicious outsiders are threat sources/agents that, due to a lack of information, remain anonymous and are unable to be classified as one of the five types of threat sources/agents listed above.

Descriptions A method by which threat actors exploit the vulnerabilities of websites frequented by users of the targeted system. Malware is then injected to the targeted system via the compromised websites.

A digital form of social engineering that uses authentic-looking e-mails, websites, or instant messages to get users to download malware, open malicious attachments, or open links that direct them to a website that requests information or executes malicious code.

An exploit that takes advantage of a system’s insufficient user authentication and/or any elements of cyber-security supporting it, to include not limiting the number of failed login attempts, the use of hard-coded credentials, and the use of a broken or risky cryptographic algorithm.

An exploit that takes advantage of the security vulnerabilities of trusted third parties to gain access to an otherwise secure system.

An exploit that involves the intentional transmission of more data than a program’s input buffer can hold, leading to the deletion of critical data and subsequent execution of malicious code.

An exploit that takes advantage of a network employing insufficient encryption when either storing or transmitting data, enabling adversaries to read and/or modify the data stream.

Structured query language (SQL) injection An exploit that involves the alteration of a database search in a web-based application, which can be used to obtain unauthorized access to sensitive information in a database resulting in data loss or corruption, denial of service, or complete host takeover.

An exploit that takes advantage of a system’s inability to properly neutralize special elements used in operating system commands, allowing adversaries to execute unexpected commands on the system by either modifying already evoked commands or evoking their own.

An exploit that uses third-party web resources to run lines of programming instructions (referred to as scripts) within the victim’s web browser or scriptable application. This occurs when a user, using a browser, visits a malicious website or clicks a malicious link. The most dangerous consequences can occur when this method is used to exploit additional vulnerabilities that may permit an adversary to steal cookies (data exchanged between a web server and a browser), log key strokes, capture screen shots, discover and collect network information, or remotely access and control the victim’s machine.

An exploit that takes advantage of an application that cannot, or does not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request, tricking the victim into executing a falsified request that results in the system or data being compromised.

An exploit that seeks to gain access to files outside of a restricted directory by modifying the directory pathname in an application that does not properly neutralize special elements (e.g., ‘…’, ‘/’, ‘…/’) within the pathname.

An exploit where malicious code is inserted that leads to unexpected integer overflow, or wraparound, which can be used by adversaries to control looping or make security decisions in order to cause program crashes, memory corruption, or the execution of arbitrary code via buffer overflow.

Adversaries manipulate externally controlled format strings in print-style functions to gain access to information and execute unauthorized code or commands.

An exploit where the victim is tricked into selecting a URL (website location) that has been modified to direct them to an external, malicious site that may contain malware that can compromise the victim’s machine.

Similar to classic buffer overflow, but the buffer that is overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a memory allocation routine, such as “malloc ()”.

An exploit that takes advantage of insufficient upload restrictions, enabling adversaries to upload malware (e.g., .php) in place of the intended file type (e.g., .jpg).

An exploit that uses trusted, third-party executable functionality (e.g., web widget or library) as a means of executing malicious code in software whose protection mechanisms are unable to determine whether functionality is from a trusted source, modified in transit, or being spoofed.

Exploits facilitated via the issuance of fraudulent digital certificates (e.g., transport layer security and Secure Socket Layer). Adversaries use these certificates to establish secure connections with the target organization or individual by mimicking a trusted third party.

An exploit that combines elements of two or more of the aforementioned techniques.

Description An adversary may gather information on a target by, for example, scanning its network perimeters or using publicly available information.

An adversary prepares its means of attack by, for example, crafting a phishing attack or creating a counterfeit (“spoof”) website.

An adversary can use common delivery mechanisms, such as e-mail or downloadable software, to insert or install malware into its target’s systems.

An adversary may exploit poorly configured, unauthorized, or otherwise vulnerable information systems to gain access.

Attacks can include efforts to intercept information or disrupt operations (e.g., denial of service or physical attacks).

Desired malicious results include obtaining sensitive information via network “sniffing” or exfiltration, causing degradation or destruction of the target’s capabilities; damaging the integrity of information through creating, deleting, or modifying data; or causing unauthorized disclosure of sensitive information.

Maintain a presence or set of capabilities An adversary may try to maintain an undetected presence on its target’s systems by inhibiting the effectiveness of intrusion-detection capabilities or adapting behavior in response to the organization’s surveillance and security measures.

The Federal Information Security Modernization Act (FISMA) of 2014 requires inspectors general (IG) to independently evaluate the effectiveness of their respective agencies’ information security programs and practices. In September 2015, we reported that Office of Management and Budget (OMB) and Department of Homeland Security (DHS) guidance to the inspectors general on conducting and reporting agency evaluations was not always complete and led to inconsistent application. We recommended that DHS and OBM enhance the reporting guidance to facilitate more consistent and comparable inspectors general evaluations.

In fiscal year 2015, the Information Technology Committee of the Council of Inspectors General on Integrity and Efficiency (CIGIE), in coordination with DHS, OMB, the National Institute of Standards and Technology (NIST), and other key stakeholders, began the development of a security capability maturity model to provide an in-depth assessment of agency programs in specific areas. The purpose of the CIGIE maturity model is to: summarize the status of agencies’ information security programs based on a five-level capability maturity scale; provide status about what has been accomplished and what still needs to be implemented to improve the information security program to the next maturity level; and help ensure consistency across the OIGs’ annual FISMA reviews.

The five maturity levels used in the IG assessment of agencies’ information security programs are defined as follows:

Level 1 Ad-hoc – Policies, procedures, and strategy are not formalized; activities are performed in an ad-hoc, reactive manner.

Level 2 Defined – Policies, procedures, and strategy are formalized and documented but not consistently implemented.

Level 3 Consistently Implemented – Policies, procedures, and strategy are consistently implemented, but quantitative and qualitative effectiveness measures are lacking.

Level 4 Managed and Measurable – Quantitative and qualitative measures on the effectiveness of policies, procedures, and strategy are collected across the organizations and used to assess them and make necessary changes.

Level 5 Optimized – Policies, procedures, and strategy are fully institutionalized, repeatable, self-generating, consistently implemented and regularly updated based on a changing threat and technology landscape and business/mission needs.

OMB’s FISMA evaluation guidance identified 11 information security program domains to be addressed in the evaluations: continuous monitoring management, configuration management, identity and access management, incident response and reporting, risk management, security training, plan of action and milestones, remote access management, contingency planning, contractor systems, and security capital planning.

However, in fiscal year 2015, the maturity model addressed only the information security continuous monitoring domain while the other IG FISMA metric domains were evaluated using sets of independent questions. For fiscal year 2016, the capability maturity model’s development continued and expanded to include the incident response domain. Also, CIGIE, OMB and DHS collaborated to align the IG metrics domains with the five function areas in the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework): identify, protect, detect, respond, and recover.

Table 10 shows the IGs’ FISMA reporting metrics results for the 24 CFO Act agencies by Cybersecurity Framework security function. The IGs’ evaluations and scoring were based on work performed in fiscal year 2016.

Based on the IG evaluations, only 10 information security functions at 7 agencies were determined to be effective (i.e., assessed at, Level 4, managed and measureable, or Level 5, optimized) for fiscal year 2016.

Appendix IV: Comments from the U.S. Department of Housing and Urban Development

Appendix V: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contacts named above, Michael W. Gilmore and Karl W. Seifert (assistant directors), Kenneth A. Johnson (analyst-in-charge), Kiana Beshir, Christopher Businsky, David Plocher, Di’Mond Spencer, and Priscilla Smith made key contributions to this report.