Information Security: Weaknesses Continue Amid New Federal Efforts to Implement Requirements
Released: 2011-10-03T00:00:00

Letter

Background

To help protect against threats to federal systems, FISMA sets forth a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. Its framework creates a cycle of risk management activities necessary for an effective security program. It is also intended to provide a mechanism for improved oversight of federal agency information security programs.

In order to ensure the implementation of this framework, FISMA assigns specific responsibilities to (1) OMB, to develop and oversee the implementation of policies, principles, standards, and guidelines on information security; to report, at least annually, on agency compliance with the act; and to approve or disapprove, agency information security programs; (2) agency heads, to provide information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of the agency; (3) agency heads and chief information officers, to develop, document, and implement an agencywide information security program, among others; (4) inspectors general, to conduct annual independent evaluations of agency efforts to effectively implement information security; and (5) NIST to provide standards and guidance to agencies on information security.

FISMA also assigns responsibility to OMB for ensuring the operation of a federal information security incident center. The required functions of this center are performed by the Department of Homeland Security’s (DHS) United States Computer Emergency Readiness Team (US-CERT), which was established to aggregate and disseminate cybersecurity information to improve warning and response to incidents, increase coordination of response information, reduce vulnerabilities, and enhance prevention and protection. In addition, the act requires each agency to report annually to OMB, selected congressional committees, and the Comptroller General on the adequacy of its information security policies, procedures, practices, and compliance with requirements. FISMA also requires OMB to report annually to Congress by March 1. See appendix II for additional information on the responsibilities of each entity.

Weaknesses in Information Security Place Sensitive Information and Information Systems at Risk

Federal agencies’ information and information systems remain at risk. This risk is illustrated in part by the rising numbers of incidents reported by federal agencies in fiscal year 2010. At the same time, weaknesses in their information security policies and practices compromised their efforts to protect against threats. Furthermore, our work and reviews by inspectors general highlight information security control deficiencies at agencies that expose information and information systems supporting federal operations and assets to elevated risk of unauthorized use, disclosure, modification, and disruption. Accordingly, we and agency inspectors general have made hundreds of recommendations to agencies in fiscal years 2010 and 2011 to address these security control deficiencies.

The Number of Incidents Reported by Federal Agencies Continues to Rise

Federal agencies have reported increasing numbers of security incidents that placed sensitive information at risk. When incidents occur, agencies are to notify the federal information security incident center—US-CERT. Over the past 5 years, the number of incidents reported by federal agencies to US-CERT has increased from 5,503 incidents in fiscal year 2006 to 41,776 incidents in fiscal year 2010, an increase of over 650 percent (see fig.1).

Agencies also reported the following types of incidents and events based on US-CERT-defined categories:  Unauthorized access: Gaining logical or physical access to a federal agency’s network, system, application, data, or other resource without permission.  Denial of service: Preventing or impairing the normal authorized functionality of networks, systems, or applications by exhausting resources. This activity includes being the victim of or participating in a denial of service attack.  Malicious code: Installing malicious software (e.g., virus, worm, Trojan horse, or other code-based malicious entity) that infects an operating system or application. Agencies are not required to report malicious logic that has been successfully quarantined by antivirus software.

Improper usage: Violating acceptable computing use policies.  Scans/probes/attempted access: Accessing or identifying a federal agency computer, open ports, protocols, service, or any combination of these for later exploit. This activity does not directly result in a compromise or denial of service.  Unconfirmed incidents under investigation: Investigating unconfirmed incidents that are potentially malicious or anomalous activity deemed by the reporting entity to warrant further review. According to DHS officials, these incidents include those that US- CERT detects through its intrusion detection system, supplemented by agency reports for investigation.

As indicated in figure 2, the four most prevalent types of incidents and events reported to US-CERT during fiscal year 2010 were: (1) malicious code; (2) unconfirmed incidents under investigation; (3) improper usage; and (4) unauthorized access.

Reported attacks and unintentional incidents involving federal systems and critical infrastructure systems demonstrate that a serious attack could be devastating. Agencies have experienced a wide range of incidents involving data loss or theft, computer intrusions, and privacy breaches, underscoring the need for improved security practices. The following examples, included to reflect incidents reported in 2010 and 2011, illustrate that a broad array of information and assets remain at risk.  An employee at federal financial institution downloaded unauthorized accounting source code to a bank hard drive which he had previously reported as stolen. The institution’s internal security personnel are investigating and believe the bank employee may have shared the code with a student in another country.  A well-known hacker group, according to an online news journal, was planning a cyber protest attack on a federal agency, using mobile phones and massive crowds of supporters as well as online supporters. This attack was intended to slow or stop traffic in and out of the agency and delay operations.  A user on a department’s network was tricked by a carefully crafted e- mail to go to a website on the pretense that he had won a new car in a lottery he supposedly entered by answering some simple questions about his pets. Later, he found that several credit cards had been opened in his name and large amounts of pet supplies had been ordered without his knowledge.  A contractor working for a federal agency sent an unencrypted e-mail from his workstation to his personal e-mail account. This was detected by a monitoring tool at the agency and an immediate investigation was initiated. Several agency personnel had their personal information sent in an unencrypted e-mail to an unauthorized account.  Network security personnel at a federal institution noted that a large number of network probes on their system originated from an underground hacking group. The institution contacted US-CERT and asked that it contact the service provider to request that the IP address be blocked so that it could no longer probe the institution.  A federal agency’s website was reportedly attacked by a hacker group. Initial analysis determined the hack took place via a web implementation of Java. The attackers have not completely taken down the web server; however, considerable peaks of traffic have been detected.

Information Security Control Deficiencies Place Federal Operations and Assets at Risk

Our audits have identified information security deficiencies in both financial and nonfinancial systems, including vulnerabilities in federal systems. We have made hundreds of recommendations to agencies in fiscal years 2010 and 2011 to address these security control deficiencies. However, most of these recommendations have not yet been fully implemented. The following examples, reported in 2010 and 2011, describe the risks we found at federal agencies, our recommendations, and the actions the agencies plan to take.

In March 2011, we reported that the Internal Revenue Service had made progress in correcting previously reported information security weaknesses, but a significant number of them remained unresolved or unmitigated. For example, the agency did not sufficiently (1) restrict users’ access to databases to only the access needed to perform their jobs; (2) secure the system it uses to support and manage its computer access request, approval, and review processes; (3) update database software residing on servers that support its general ledger system; and (4) enable certain auditing features on databases supporting financial and tax processing systems. An underlying reason for these weaknesses was that the Internal Revenue Service had not yet fully implemented required components of its comprehensive information security program. As a result, financial and taxpayer information remain unnecessarily vulnerable to insider threats and at increased risk of unauthorized disclosure, modification, or destruction; financial data are at increased risk of errors that result in misstatement; and the agency’s management decisions may be based on unreliable or inaccurate financial information. We recommended that the Internal Revenue Service take 32 specific actions for correcting newly identified control weaknesses, and it agreed to develop a detailed corrective action plan that addresses them.

In November 2010, we reported that the Federal Deposit Insurance Corporation did not sufficiently implement access and other controls intended to protect the confidentiality, integrity, and availability of its financial systems and information. For example, it did not always (1) sufficiently restrict user access to systems; (2) ensure strong system boundaries; (3) consistently enforce strong controls for identifying and authenticating users; (4) encrypt sensitive information; or (5) audit and monitor security-relevant events. In addition, the Federal Deposit Insurance Corporation did not have policies, procedures, and controls in place to ensure the appropriate segregation of incompatible duties, adequately manage the configuration of its financial information systems, and update contingency plans. An underlying reason for these weaknesses was that the corporation did not always fully implement several information security program activities, such as effectively developing, documenting, and implementing security policies. As a result, it faced an elevated risk of the misuse of federal assets, unauthorized modification or destruction of financial information, inappropriate disclosure of other sensitive information, and disruption of computer operations. Accordingly, we recommended that the corporation fully implement several key activities to enhance its information security program. The Federal Deposit Insurance Corporation generally agreed with our recommendations and stated that it planned to address the identified weaknesses.

In October 2010, we reported that the National Archives and Records Administration had not effectively implemented information security controls to sufficiently protect the confidentiality, integrity, and availability of the information and systems that support its mission. For example, the agency did not always (1) protect the boundaries of its networks by ensuring that all incoming traffic was inspected by a firewall; (2) enforce strong policies for identifying and authenticating users by requiring the use of complex passwords; and (3) limit users’ access to systems to what was required for them to perform their official duties. The identified weaknesses existed, in part, because the National Archives and Records Administration had not fully implemented key elements of its information security program. As a result, sensitive information, such as records containing personally identifiable information, was at increased and unnecessary risk of unauthorized access, disclosure, modification, or loss. We recommended that it take 224 specific actions to implement elements of its security program and enhance access and other information security controls over its systems. The Archivist of the United States generally concurred with our recommendations, and agreed to provide semiannual updates on the agency’s progress to enhance access controls and address the identified weaknesses.

In addition, reviews at the 24 major federal agencies continue to highlight deficiencies in their implementation of information security policies and procedures. In fiscal year 2010, in their performance and accountability reports and annual financial reports, 19 of 24 agencies indicated that inadequate information security controls were either material weaknesses or significant deficiencies (see fig. 3) for financial reporting purposes. Specifically, 8 agencies identified material weaknesses, increasing from 6 agencies in fiscal year 2009, while 11 reported significant deficiencies, decreasing from 15 agencies in fiscal year 2009.

In fiscal year 2010 annual reports required under 31 U.S.C. § 3512 (commonly referred to as the Federal Managers’ Financial Integrity Act of 1982), 7 of the 24 agencies identified weaknesses in information security. In addition, 23 of 24 inspectors general cited information security as a “major management challenge” for their agency, reflecting an increase from fiscal year 2009, when 20 of 24 inspectors general cited information security as a challenge.

Weaknesses Noted in All Major Categories of Controls

Our, agency, and inspectors general assessments of information security controls during fiscal year 2010 revealed that most major federal agencies had weaknesses in each of the five major categories of information system controls: (1) access controls, which ensure that only authorized individuals can read, alter, or delete data; (2) configuration management controls, which provide assurance that only authorized software programs are implemented; (3) segregation of duties, which reduces the risk that one individual can independently perform inappropriate actions without detection; (4) continuity of operations planning, which helps avoid significant disruptions in computer-dependent operations; and (5) agencywide information security programs, which provide a framework for ensuring that risks are understood and that effective controls are selected and implemented. All 24 agencies had vulnerabilities in access control, configuration management, and security management. Deficiencies in segregation of duties and contingency planning, while not reported for all of these agencies, were prevalent, as figure 4 demonstrates.

Agencies use electronic and physical controls to limit, prevent, or detect inappropriate access to computer resources (data, equipment, and facilities), thereby protecting them from unauthorized use, modification, disclosure, and loss. Access controls involve the six critical elements described in table 1.

All 24 major federal agencies had access control weaknesses during fiscal year 2010. For example, 18 agencies experienced problems with identifying and authenticating information system users, with at least 7 of these agencies allowing weak authentication practices that could increase vulnerability to unauthorized use of their information systems. Nineteen agencies had weaknesses in controls for authorizing access in such areas as management of inactive accounts and ensuring that only those with a legitimate need had access to sensitive accounts. In addition, 16 agencies did not adequately monitor networks for suspicious activities or report security incidents that had been detected. Without adequate access controls in place, agencies cannot ensure that their information resources are protected from intentional or unintentional harm.

Inconsistent Configuration Management Controls Could Expose Sensitive Information to Unauthorized Use

Configuration management controls ensure that only authorized and fully tested software is placed in operation, software and hardware are updated, information systems are monitored, patches are applied to these systems to protect against known vulnerabilities, and emergency changes are documented and approved. These controls, which limit and monitor access to powerful programs and sensitive files associated with computer operations, are important in providing reasonable assurance that access controls and the operations of systems and networks are not compromised. To protect against known vulnerabilities, effective procedures must be in place, appropriate software installed, and patches updated promptly. Up-to-date patch installation helps mitigate flaws in software code that could be exploited to cause significant damage and enable malicious individuals to read, modify, or delete sensitive information or disrupt operations.

While the 24 major agencies experienced problems with implementing configuration management, no weaknesses were reported in one area: handling emergency changes to system and network configurations. Our and inspectors general assessments revealed weaknesses in other areas, however. Twenty-one agencies had problems with maintaining and adhering to configuration management policies, plans, and procedures, which could jeopardize their ability to manage their systems and networks effectively. Another area where many agencies experienced difficulty was the practice of maintaining current configuration information in a formal baseline. Nineteen agencies had only partially complied with their internal or with federal requirements for maintaining these baselines. In addition, 18 agencies had deficiencies in keeping software updated, such as not adequately managing patch installations. Without a consistent approach to testing, updating, and patching software, agencies increase their risk of exposing sensitive data to unauthorized and possibly undetected access.

Agencies Did Not Always Adequately Segregate Duties and Responsibilities

Segregation of duties refers to the policies, procedures, and organizational structure that help ensure that one individual cannot independently control all key aspects of a computer-related operation and thereby take unauthorized actions or gain unauthorized access to assets or records. Key steps to achieving proper segregation are ensuring that incompatible duties are separated and employees understand their responsibilities, and controlling personnel activities through formal operating procedures, supervision, and review.

We and agency inspectors general identified 17 agencies that did not adequately segregate duties. Of these agencies, 14 had difficulty ensuring that key duties and responsibilities for authorizing, processing, recording, or reviewing transactions were appropriately separated. For example, 1 agency granted conflicting access to critical resources in its mainframe environment, and another improperly allowed contractors access to security functions. At least 6 of the agencies that did not adequately segregate duties failed to maintain sufficient control over personnel procedures, supervision, and review. At 1 agency, there was no effective way to identify how many contractors had access to and privileges within the network, and at least 3 agencies allowed individuals to inappropriately use accounts with elevated privileges or assume conflicting roles. Without adequate segregation of duties, agencies increase the risk that erroneous or fraudulent actions will occur, improper program changes will be implemented, and computer resources will be damaged or destroyed.

Continuity of Operations Plans Lacked Important Details

In the event of an act of nature, fire, accident, sabotage, or other disruption, an essential element in preparing for the loss of operational capabilities is having an up-to-date, detailed, and fully tested continuity of operations plan. This plan should cover all key functions, including assessing an agency’s information technology and identifying resources, minimizing potential damage and interruption, developing and documenting the plan, and testing it and making necessary adjustments. If continuity of operations controls are faulty, even relatively minor interruptions can result in lost or incorrectly processed data, which can lead to financial losses, expensive recovery efforts, and inaccurate or incomplete mission-critical information.

Our and agency inspectors general fiscal year 2010 reports show that 22 federal agencies had shortcomings in their plans for continuity of operations. Developing and implementing a comprehensive plan presented difficulties for at least 13 agencies for varying reasons. For example, 1 agency did not include key elements in some contingency plans or testing reports, such as identification of alternate processing facilities, restoration procedures, and data-sensitivity handling procedures, and officials at another agency were confused about their responsibilities for contingency and disaster recovery planning for certain classified systems. Additionally, tests of existing plans proved to be inadequate for at least 11 agencies. Until agencies address identified weaknesses in their continuity of operations plans and tests of these plans, they may not be able to recover systems in a successful and timely manner when service disruptions occur.

Agencywide Security Programs Were Not Fully Implemented

An underlying cause for information security weaknesses identified at federal agencies is that they have not yet fully or effectively implemented an agencywide information security program. An agencywide security program, as required by FISMA, provides a framework for assessing and managing risk, including developing and implementing security policies and procedures, conducting security awareness training, monitoring the adequacy of the entity’s computer-related controls through security tests and evaluations, and implementing remedial actions as appropriate. Without a well-designed program, security controls may be inadequate; responsibilities may be unclear, misunderstood, and improperly implemented; and controls may be inconsistently applied. Such conditions may lead to insufficient protection of sensitive or critical resources.

Of the 24 major agencies, none had fully or effectively implemented an agencywide information security program. To illustrate, 18 had shortcomings in the documentation of their security management programs, which establishes the framework and activities for assessing risk, developing and implementing effective security procedures, and monitoring the effectiveness of these procedures. In another example, 18 agencies did not adequately implement remedial actions to correct known vulnerabilities.

Until agencies fully resolve identified deficiencies in their agencywide information security programs, the federal government will continue to face significant challenges in protecting its information systems and networks. We continue to identify information security as a governmentwide high-risk issue in our biennial reports to Congress, most recently in February 2011. Full and effective implementation of agencywide information security programs is necessary to ensure that federal data and systems will be adequately safeguarded to prevent disruption, unauthorized use, disclosure, and modification.

Actions Under Way, but More Work Necessary for Implementing FISMA Requirements

OMB, executive branch agencies, and NIST have taken actions intended to improve the implementation of their FISMA-related security requirements, but much work remains. Beginning in fiscal year 2009, OMB instituted the use of a new online tool for agencies to report their information security posture on a recurring basis and, in fiscal year 2010, provided them with new and revised metrics for reporting such information. However, not all the metrics used to measure performance included performance targets. While agencies reported performance using these new and revised metrics, inspectors general continued to identify weaknesses in the processes agencies used to implement the requirements.

OMB Has Taken Several Actions Aimed at Improving Federal Information Security but Continued Progress Needed

As previously discussed, FISMA requires OMB to develop and oversee the implementation of policies, standards, and guidelines on information security at executive branch agencies and to annually report on agency compliance with FISMA to Congress no later than March 1 of each year. In fulfilling these and other requirements, OMB has taken a number of actions intended to meet its FISMA responsibilities and improve federal information security. These include:  Launching a new security reporting tool—Cyberscope. In fiscal year 2010, OMB mandated that agencies use Cyberscope for submitting their information security data to OMB. Cyberscope is an interactive data collection tool that has the capability to receive data feeds on a recurring basis to assess the security posture of a federal agency’s information infrastructure. According to OMB, this tool will allow agencies to report security data on a more frequent basis. Beginning in 2011, agencies are required to report data on a monthly basis, rather than the previous quarterly basis.  Developing new security metrics. In fiscal year 2010, OMB convened a joint task force that developed new security performance metrics that are intended to encourage agencies to focus on risk and improve information security. We previously recommended that OMB develop additional measures of effectiveness. According to OMB, the new security metrics are intended to provide “outcome-focused” metrics for federal agencies to assess the implementation of security capabilities, measure their effectiveness, and ascertain their impact on risk levels. The revised metrics included reporting on:  Boundary protection—to report information on the status of agencies’ implementation of the Trusted Internet Connections initiative, such as the percentage of external connections or network capacity passing through a trusted Internet connection; or to report on agencies’ deployment of operational Einstein 2 sensors, such as the percentage of trusted Internet connections with operational Einstein 2 deployments.  Remote access and telework—to report information on the methods allowed to remotely connect to agency network resources.

Identity and access management—to report on the extent to which agencies have issued and implemented personal identity verification cards in accordance with Homeland Security Presidential Directive 12.  Data protection—to report agencies’ use of encryption on portable computers, such as laptops.

OMB has also acted to assign the operational aspects of several of its FISMA-related responsibilities to DHS. In July 2010, the Director of OMB and the Cybersecurity Coordinator issued a joint memorandum stating that DHS will exercise primary responsibility within the executive branch for the operational aspects of federal agency cybersecurity with respect to federal information systems that fall within the scope of FISMA. In carrying out this responsibility and the accompanying activities, DHS is to be subject to general OMB oversight in accordance with the provisions of FISMA. According to the memorandum, DHS responsibilities include but are not limited to  overseeing the governmentwide and agency-specific implementation of and reporting on cybersecurity policies and guidance;  overseeing and assisting governmentwide and agency-specific efforts to provide adequate, risk-based, and cost-effective cybersecurity;  overseeing the agencies’ compliance with FISMA and developing analyses for OMB to assist in the development of the FISMA annual report;  overseeing the agencies’ cybersecurity operations and incident response and providing appropriate assistance; and reviewing the agencies’ cybersecurity programs annually.

In fiscal year 2011, DHS, as part of implementing its new operational information security responsibilities, held meetings with chief information officers and chief information security officers from the 24 major federal agencies. According to DHS officials, the meetings were aimed at allowing agency officials to discuss specific challenges they faced in addressing threats and vulnerabilities and assisting DHS with determining the capabilities needed to address persistent issues. Additionally, DHS launched “CyberStat” review sessions in January 2011 with the purpose of ensuring accountability and assisting the agencies in driving progress with key strategic enterprise cybersecurity capabilities. Data used in CyberStat sessions are based on information provided by agencies through CyberScope. According to both OMB and DHS officials, as of July 2011, DHS has held CyberStat sessions with seven agencies discussing various topics including continuous monitoring.

In addition, OMB satisfied its FISMA requirement to report to the Congress no later than March 1, 2011, on agency compliance with FISMA. OMB transmitted its fiscal year 2010 report and highlighted achievements across the federal government that included, among others, a shift from periodic security reviews to automated mechanisms for continuously monitoring agency security controls, the use of NIST’s Risk Management Framework concepts, and the approval of the National Initiative for Cyber Education, which is intended to improve cybersecurity education through the establishment of education and training programs. The report also references efforts taken by the Office of Personnel Management to develop a cybersecurity competency model and review human resource strategies to help hire and retain cybersecurity experts to meet existing and future federal workforce needs. We have ongoing work in the area of cybersecurity human capital workforce planning activities.

OMB Improved Reporting, but Did Not Always Include Targets to Measure Performance

For fiscal year 2010, OMB enhanced the FISMA reporting process. FISMA requires that OMB report on agencies’ compliance with the act’s requirements. Each year, OMB provides instructions to federal agencies and their inspectors general for preparing their FISMA reports and then summarizes the information provided by the agencies and their inspectors general in its report to Congress. In its annual information security reporting instructions to agencies and their inspectors general, OMB expanded the number and type of security control areas covered under the reporting process. For the first time, OMB required agencies to provide information on their use of automated tools to manage, for example, information technology configurations and vulnerabilities. In addition, agencies were to provide information with regard to, among other things, security awareness training, configuration management, and incident management.

We had previously recommended that OMB expand inspectors general reporting to address additional security program areas. Accordingly, for fiscal year 2010, OMB’s reporting instructions also identified additional areas for which inspectors general were to assess and report on agency performance; such areas included identity management and continuous monitoring.

Even with these changes, continued improvements are needed. Specifically, as we previously reported, one attribute of a metric is that it should be meaningful. A meaningful metric should be clear, address organizational priorities, and have performance targets. OMB’s fiscal year 2010 reporting instructions included 31 metrics for chief information officers. While most chief information officer metrics were clearly defined and reflected agency priorities, all but one of the metrics did not include performance targets that would allow agencies to track progress over time. For example, one of the measures asks agencies to provide the mean time for incident detection, remediation, and recovery. While this defined metric addresses an organizational priority, it does not provide a target or threshold to monitor progress over time.

Inspectors general were also asked to comment on various program areas, but the measures provided do not distinguish performance targets to determine levels of effective implementation. To illustrate, inspectors general are asked to report whether their agency’s security authorization program includes “categorizes information systems” as an “attribute” of the program. However, there is no specific target or measure to determine whether this would mean that a specific portion of systems had been properly categorized (e.g., all or half), or just systems in the inspectors general review.

According to OMB officials, targets were not included since targets are set based on the Administration’s top cyber security priorities or by NIST standards and guidance. For example, in February 2011, OMB and DHS set several targets for implementing various Homeland Security Presidential Directive 12 requirements in their memorandum to federal agencies. While targets may be provided in various memorandums and guidance, agencies may still be unaware of the thresholds that are to be met as part of their annual report requirements. Further, without specific targets listed in annual reporting instructions and identified in annual FISMA reports, federal agencies and the Congress may not be able to properly gauge performance.

Weaknesses in Agencies’ Security Practices Continue as Agencies Report Performance Using New Measures

While agencies reported on their information security programs using new and revised measures, they continued to have weaknesses in implementing security practices. In addition to categories used in fiscal year 2009 such as security awareness and specialized training, agencies also reported on their capability to automate the management of information system asset configurations and vulnerabilities. Inspectors general also reported agencies’ program performance using new measures for categories such as continuous monitoring, among others, and identified weaknesses in agencies programs’ both in new categories and those used in prior years.

FISMA requires agencies to provide security awareness training to personnel, including contractors and other users of information systems that support agency operations and assets. This training should explain information security risks associated with their activities and their responsibilities in complying with agency policies and procedures designed to reduce these risks. In addition, agencies are required to provide appropriate information security training to personnel who have significant security responsibilities. For fiscal year 2010, OMB required agencies to report, among other things, (1) the number of agency users with log-in privileges who had been given security awareness training annually and (2) the number of agency users with significant security responsibilities who had been given specialized, role-based, security training annually.

In fiscal year 2010, the 24 major agencies reported that 92 percent of users with log-in privileges had been given annual security awareness training, and that 88 percent of users with significant security responsibilities had received specialized training. However, while most of the major agencies reported a high percentage of users receiving awareness training, the number of agencies reporting a high percentage of users receiving specialized training was about half that number (see fig. 5).

Even with the high overall percentages reported for users receiving training, inspectors general continued to identify weaknesses in their agency’s training program. Specifically, inspectors general for 17 of 24 major agencies cited weaknesses in their agency’s training programs example, 5 inspectors general reported that less than 90 percent of employees with log-in privileges had attended security awareness training in the last year. In addition, 11 inspectors general reported that less than 90 percent of employees, contractors, and other users with significant security responsibilities had attended specialized training in the past yea Inspectors general for 11 agencies also reported that identification and tracking of those with significant security responsibilities were not adequate. As a result, these agencies have less assurance that users are aware of the information security risks and their responsibilities for reducing such risks. r.

FISMA requires each agency to have policies and procedures that ensure compliance with minimally acceptable system configuration requirement s, as determined by the agency. In fiscal year 2010 reporting, for the fir time, OMB required agencies to provide an estimated number of IT assets where an automated capability provides visibility into system configuration information and vulnerabilities. In addition, inspectors general were also requested to report on their agency’s configuration management program.

Agencies varied in automated capabilities for monitoring their IT configurations and vulnerabilities. Specifically, 2 agencies reported ha an automated management system that allowed them to monitor the configurations for 90 to 100 percent of their assets; 8 reported being a to monitor configurations for 60 to 89 percent of their assets; and 14 reported being able to monitor less than 60 percent of their assets. Similarly, automated monitoring for vulnerabilities varied among agencies Four agencies were able to monitor 90 to 100 percent of their assets for vulnerabilities; 10 reported being able to monitor 60 to 89 percent of their onitor less than assets for vulnerabilities; and 10 reported being able to m 60 percent of their assets for vulnerabilities (see fig. 6). .

Conclusions

Persistent governmentwide weaknesses in information security controls threaten the confidentiality, integrity, and availability of the information and information systems supporting the operations and assets of federal agencies. Inadequacies exist in access controls, which include identification and authentication, authorization, cryptography, audit and monitoring, boundary protection, and physical security. Weaknesses also exist in other controls such as configuration management, segregation of duties, and continuity of operations. These shortcomings leave federal agencies vulnerable to external as well as internal threats. As long as agencies have not fully and effectively implemented their information security programs, including addressing the hundreds of recommendations that we and inspectors general have made, federal systems will remain at increased risk of attack or compromise.

The new reporting tool and metrics issued by OMB might improve the visibility of agencies’ future implementation of the act. The FISMA reporting process and new performance measures are intended to improve agencies’ information security programs, but the measures did not usually include performance targets. NIST, the inspectors general, and OMB have all taken actions toward fulfilling their FISMA requirements. However, deficiencies continued to be identified in agencies’ programs, such as training for personnel with significant responsibilities, remediation of security weaknesses, and resolving incidents in a timely manner. Weaknesses were also identified in new OMB-defined program categories, such as identity management and continuous monitoring. As such, information that agencies reported may not accurately reflect their implementation of required information security policies and procedures. Until hundreds of recommendations made by us and inspectors general are implemented and program weaknesses are corrected, agencies will continue to face challenges in securing their information and information systems.

Recommendation for Executive Action

We recommend that the Director of the Office of Management and Budget take the following action: Incorporate performance targets for metrics in annual FISMA reporting guidance to agencies and inspectors general.

Agency Comments and Our Evaluation

We provided a draft of this report to OMB and DHS for their review. We received e-mail comments from an OMB representative. In response to our recommendation, OMB stated that since, unlike in previous years, OMB and DHS now issue separate memoranda regarding FISMA reporting guidance, it is more appropriate for the performance targets to be included in DHS’s memorandum since that is where the metrics are listed. We agree that including the performance targets in the metrics issued by DHS would meet the intent of our recommendation.

In written comments, reproduced in appendix III, DHS's Director of the Departmental GAO/OIG Liaison Office, noted that he was pleased with GAO’s acknowledgement of efforts made by DHS to improve the cybersecurity posture of federal agencies. DHS also provided technical comments, which we have incorporated into this report as appropriate. We also provided a draft of this report to the seven other agencies included in our review (the Departments of Health and Human Services, the Interior, Justice, and Veterans Affairs; the National Institute of Standards and Technology; the Office of Personnel Management; and the U.S. Agency for International Development). All seven responded that they did not have any comments.

We are sending copies of this report to the Director of the Office of Management and Budget and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov.

If you have any questions regarding this report, please contact me at (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

In accordance with the Federal Information Security Management Act of 2002 (FISMA) requirement that the Comptroller General report periodically to the Congress, our objectives were to evaluate (1) the adequacy and effectiveness of agencies’ information security policies and practices and (2) federal agencies’ implementation of FISMA requirements.

To assess the adequacy and effectiveness of agencies’ information security policies and practices, we analyzed our related reports issued from July 2009 through March 2011. We also reviewed and analyzed the information security work and products of the Offices of Inspector General at the 24 major federal agencies covered by the Chief Financial Officers Act for fiscal years 2009 and 2010. Further, we reviewed and summarized weaknesses identified in our reports and those of inspectors general using the five major categories of information security general controls identified in our Federal Information System Controls Audit Manual: (1) access controls, (2) configuration management controls, (3) segregation of duties, (4) continuity of operations planning, and (5) agencywide information security programs. Further, we reviewed and analyzed data on information security in federal agencies’ performance and accountability and financial reports for fiscal year 2010.

To assess the implementation of FISMA requirements, we reviewed and analyzed the provisions of the act and the FISMA data submissions for 24 major federal agencies for fiscal years 2009 and 2010. In addition, we reviewed the mandated annual FISMA reports from the Office of Management and Budget and the National Institute of Standards and Technology, as well as the Department of Homeland Security’s U.S. Computer Emergency Readiness Team report of security incidents for fiscal year 2010. We also examined the Office of Management and Budget’s reporting instructions and other guidance related to FISMA.

To assess the reliability of the FISMA data, we selected 6 agencies to gain an understanding of the quality of processes in place to produce both chief information officer and inspectors general FISMA reports. To select these agencies, we sorted the 24 major agencies from highest to lowest using the total number of systems the agencies reported in fiscal year 2009; separated them into even categories of large, medium, and small agencies; then selected the median 2 agencies from each category. These agencies were: the United States Agency for International Development, the Department of the Interior, the Office of Personnel Management, the Department of Justice, the Department of Veterans Affairs, and the Department of Health and Human Services.

We conducted interviews and performed limited testing with the inspectors general and agency officials from the selected agencies to determine the reliability of FISMA data submissions for 24 major federal agencies for fiscal years 2009 and 2010. We also accessed the CyberScope system to gain an understanding of the data, related internal controls, missing data, outliers, and obvious errors and reviewed supporting documentation that agencies provided to corroborate information provided in their responses. As appropriate, we interviewed officials from the Office of Management and Budget, the Department of Commerce’s National Institute for Standards and Technology, and the Department of Homeland Security. We did not evaluate the implementation of the Department of Homeland Security’s FISMA-related responsibilities assigned to it by the Office of Management and Budget. Based on this assessment, we determined that the data were sufficiently reliable for our work.

We conducted this performance audit from September 2010 to October 2011 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: FISMA Responsibilities

FISMA states that the Director of the Office of Management and Budget (OMB) shall oversee agency information security policies and practices, including:  developing and overseeing the implementation of policies, principles, standards, and guidelines on information security; requiring agencies to identify and provide information security protections commensurate with risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information collected or maintained by or on behalf of an agency, or information systems used or operated by an agency, or by a contractor of an agency, or other organization on behalf of an agency;  overseeing agency compliance with FISMA; and reviewing at least annually and approving or disapproving, agency information security programs.

FISMA also requires OMB to report to Congress no later than March 1 of each year on agency compliance with the requirements of the act.

FISMA requires each agency, including agencies with national security systems, to develop, document, and implement an agencywide information security program to provide security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source.

Specifically, FISMA requires information security programs to include, among other things:  periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems; risk-based policies and procedures that cost-effectively reduce information security risks to an acceptable level and ensure that information security is addressed throughout the life cycle of each information system; subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems, as appropriate; security awareness training for agency personnel, including contractors and other users of information systems that support the operations and assets of the agency;  periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems;  a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in the information security policies, procedures, and practices of the agency;  procedures for detecting, reporting, and responding to security  plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency.

In addition, agencies must produce an annually updated inventory of major information systems (including major national security systems) operated by the agency or under its control, which includes an identification of the interfaces between each system and all other systems or networks, including those not operated by or under the control of the agency.

FISMA also requires each agency to report annually to OMB, selected congressional committees, and the Comptroller General on the adequacy of its information security policies, procedures, practices, and compliance with requirements. In addition, agency heads are required to report annually the results of their independent evaluations to OMB, except to the extent that an evaluation pertains to a national security system; then only a summary and assessment of that portion of the evaluation needs to be reported to OMB.

Under FISMA, the inspector general for each agency shall perform an independent annual evaluation of the agency’s information security program and practices. The evaluation should include testing of the effectiveness of information security policies, procedures, and practices of a representative subset of agency systems. In addition, the evaluation must include an assessment of the compliance with the act and any related information security policies, procedures, standards, and guidelines. For agencies without an inspector general, evaluations of non- national security systems must be performed by an independent external auditor. Evaluations related to national security systems are to be performed by an entity designated by the agency head.

Under FISMA, the National Institute of Standards and Technology (NIST) is tasked with developing, for systems other than for national security, standards and guidelines that must include, at a minimum: (1) standards to be used by all agencies to categorize all their information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels; (2) guidelines recommending the types of information and information systems to be included in each category; and (3) minimum information security requirements for information and information systems in each category. NIST must also develop a definition of and guidelines for detection and handling of information security incidents.

The law also assigns other information security functions to NIST including:  providing technical assistance to agencies on elements such as compliance with the standards and guidelines, and the detection and handling of information security incidents;  evaluating private-sector information security policies and practices and commercially available information technologies to assess potential application by agencies;  evaluating security policies and practices developed for national security systems to assess their potential application by agencies; and conducting research, as needed, to determine the nature and extent of information security vulnerabilities and techniques for providing cost-effective information security.

In addition, FISMA requires NIST to prepare an annual report on activities undertaken during the previous year, and planned for the coming year, to carry out responsibilities under the act.

Appendix III: Comments from the Department of Homeland Security

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the individual named above, Anjalique Lawrence (Assistant Director), Larry Crosland, Season Dietrich, Jennifer Franks, Nancy Glover, Min Hyun, Alina J. Johnson, Mary Marshall, Lee McCracken, Minette Richardson, and Jayne Wilson made key contributions to this report.