Information Security: DHS Needs to Continue to Advance Initiatives to Protect Federal Systems
Released: 2017-03-28T00:00:00

Letter

Background

Federal agencies are dependent on computerized (cyber) information systems and electronic data to carry out operations and to process, maintain, and report essential information. The security of these systems and data is vital to public confidence and the nation’s safety, prosperity, and well-being. Virtually all federal operations are supported by computer systems and electronic data, and agencies would find it difficult, if not impossible, to carry out their missions and account for their resources without these information assets. Hence, ineffective security controls to protect these systems and data could have a significant impact on a broad array of government operations and assets.

Computer networks and systems used by federal agencies are often riddled with security vulnerabilities—both known and unknown. These systems are often interconnected with other internal and external systems and networks, including the Internet, thereby increasing the number of avenues of attack and expanding their attack surface.

In addition, cyber threats to systems supporting the federal government are evolving and becoming more sophisticated. These threats come from a variety of sources and vary in terms of the types and capabilities of the actors, their willingness to act, and their motives. For example, foreign nations—where adversaries possess sophisticated levels of expertise and significant resources to pursue their objectives—pose increasing risks.

Safeguarding federal computer systems has been a long-standing concern. This year marks the 20th anniversary of when GAO first designated information security as a government-wide high-risk area in 1997. We expanded this high-risk area to include safeguarding the systems supporting our nation’s critical infrastructure in 2003 and protecting the privacy of personally identifiable information in 2015.

Over the last several years, GAO has made about 2,500 recommendations to agencies aimed at improving the security of federal systems and information. These recommendations identified actions for agencies to take to strengthen their information security programs and technical controls over their computer networks and systems. Many agencies continue to be challenged in safeguarding their information systems and information, in part because many of these recommendations have not been implemented. As of February 2017, about 1,000 of our information security-related recommendations had not been implemented.

Our audits of the effectiveness of information security programs and controls at federal agencies have consistently shown that agencies are challenged in securing their information systems and information. In particular, agencies have been challenged in the following activities:

Enhancing capabilities to effectively identify cyber threats to agency systems and information. A key activity for assessing cybersecurity risk and selecting appropriate mitigating controls is the identification of cyber threats to computer networks, systems, and information. In 2016, we reported on several factors that agencies identified as impairing their ability to identify these threats to a great or moderate extent. The impairments included an inability to recruit and retain personnel with the appropriate skills, rapidly changing threats, continuous changes in technology, and a lack of government-wide information sharing mechanisms. We believe that addressing these impairments will enhance the ability of agencies to identify the threats to their systems and information and be in a better position to select and implement appropriate countermeasures.

Implementing sustainable processes for securely configuring operating systems, applications, workstations, servers, and network devices. In our reports, we routinely determine that agencies do not enable key information security capabilities of their operating systems, applications, workstations, servers, and network devices. Agencies were not always aware of the insecure settings that introduced risk to the computing environment. We believe that establishing strong configuration standards and implementing sustainable processes for monitoring and enabling configuration settings will strengthen the security posture of federal agencies.

Patching vulnerable systems and replacing unsupported software.

Federal agencies we have reviewed consistently fail to apply critical security patches on their systems in a timely manner, sometimes doing so years after the patch becomes available. We have consistently identified instances where agencies use software that is no longer supported by their vendors. These shortcomings place agency systems and information at significant risk of compromise, since many successful cyberattacks exploit known vulnerabilities associated with software products. We believe that using vendor- supported and patched software will help to reduce this risk.

Developing comprehensive security test and evaluation procedures and conducting examinations on a regular and recurring basis. Federal agencies we have reviewed often do not test or evaluate their information security controls in a comprehensive manner. The agency evaluations we reviewed were sometimes based on interviews and document reviews (rather than in depth security evaluations), were limited in scope, and did not identify many of the security vulnerabilities that our examinations identified. We believe that conducting in-depth security evaluations that examine the effectiveness of security processes and technical controls is essential for effectively identifying system vulnerabilities that place agency systems and information at risk.

Federal Laws Provide a Framework for Securing Agencies’ Information and Systems

The Federal Information Security Modernization Act of 2014 (FISMA) provides a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets and for ensuring the effective oversight of information security risks, including those throughout civilian, national security, and law enforcement agencies. The law requires each agency to develop, document, and implement an agency-wide information security program to provide risk-based protections for the information and information systems that support the operations and assets of the agency.

FISMA also establishes key government-wide roles for DHS. Specifically, with certain exceptions, DHS is to administer the implementation of agency information security policies and practices for information systems including: monitoring agency implementation of information security policies and providing operational and technical guidance to agencies; operating a central federal information security incident center; and deploying technology upon request to assist the agency to continuously diagnose and mitigate cyber threats and vulnerabilities.

In addition, the Cybersecurity Act of 2015 requires DHS to deploy, operate, and maintain for use by any federal agency, a capability to (1) detect cybersecurity risks in network traffic transiting to or from agency information systems and (2) prevent network traffic with such risks from traveling to or from an agency information system or modify the traffic to remove the cybersecurity risk.

Advancing DHS Initiatives Could Improve the Cybersecurity Posture of the Federal Government

In implementing federal law for securing agencies’ information and systems, DHS is spearheading several initiatives to assist federal agencies in protecting their computer networks and electronic information. These include NCPS, CDM, and other services. However, our work has highlighted the need for advances within these initiatives.

NCPS Capabilities and Adoption Could Be Improved

Operated by DHS’s United States Computer Emergency Readiness Team (US-CERT), NCPS is intended to detect and prevent cyber intrusions into agency networks, analyze network data for trends and anomalous data, and share information with agencies on cyber threats and incidents. Deployed in stages, NCPS, operationally known as EINSTEIN, has provided increasing capabilities to detect and prevent potential cyber-attacks involving the network traffic entering or exiting the networks of participating federal agencies. Table 1 provides an overview of the EINSTEIN deployment stages to date.

The overarching objectives of NCPS are to provide functionality that supports intrusion detection, intrusion prevention, analytics, and information sharing. However, in January 2016, we reported that NCPS had partially, but not fully, met these objectives: Intrusion detection: NCPS provided DHS with a limited ability to detect potentially malicious activity entering and exiting computer networks at federal agencies. Specifically, NCPS compared network traffic to known patterns of malicious data, or “signatures,” but did not detect deviations from predefined baselines of normal network behavior. In addition, NCPS did not monitor several types of network traffic and therefore would not have detected malicious traffic embedded in such traffic. NCPS also did not examine traffic for certain common vulnerabilities and exposures that cyber threat adversaries could have attempted to exploit during intrusion attempts.

Intrusion prevention: The capability of NCPS to prevent intrusions was limited to the types of network traffic it monitored. For example, the intrusion prevention function monitored and blocked e-mail determined to be malicious. However, it did not monitor malicious content within web traffic, although DHS planned to deliver this capability in 2016.

Analytics: NCPS supported a variety of data analytical tools, including a centralized platform for aggregating data and a capability for analyzing the characteristics of malicious code. However, DHS had not developed planned capabilities to facilitate near real-time analysis of various data streams, perform advanced malware behavioral analysis, and conduct forensic analysis in a more collaborative way. DHS planned to develop and implement these enhancements through 2018.

Information sharing: DHS had yet to develop most of the planned functionality for NCPS’s information-sharing capability, and requirements had only recently been approved at the time of our review. Agencies and DHS also did not always agree about whether notifications of potentially malicious activity had been sent or received, and agencies had mixed views about the usefulness of these notifications. Further, DHS did not always solicit—and agencies did not always provide—feedback on them.

In addition, while DHS had developed metrics for measuring the performance of NCPS, the metrics did not gauge the quality, accuracy, or effectiveness of the system’s intrusion detection and prevention capabilities. As a result, DHS was unable to describe the value provided by NCPS.

To enhance the functionality of NCPS, we made six recommendations to DHS, which if implemented, could help the agency to expand the capability of NCPS to detect cyber intrusions, notify customers of potential incidents, and track the quality, efficiency, and accuracy of supporting actions related to detecting and preventing intrusions, providing analytic services, and sharing cyber-related information. DHS concurred with the recommendations. In February 2017 when we followed up on the status of the recommendations, DHS officials stated that they have implemented 2 of the recommendations and initiated actions to address the other 4 recommendations. We are in the process of evaluating DHS’s actions for the two implemented recommendations.

In January 2016, we also reported that federal agencies had adopted NCPS to varying degrees. Specifically, the 23 civilian agencies covered by the Chief Financial Officers (CFO) Act that were required to implement the intrusion detection capabilities had routed some traffic to NCPS intrusion detection sensors. However, as of January 2016, only 5 of the 23 agencies were receiving intrusion prevention services, due to certain policy and implementation challenges. For example, officials stated that the ability to meet DHS security requirements to use the intrusion prevention capabilities varied from agency to agency. Further, agencies had not taken all the technical steps needed to implement the system, such as ensuring that all network traffic was being routed through NCPS sensors. This occurred in part because DHS had not provided network routing guidance to agencies. As a result, it had limited assurance regarding the effectiveness of the system.

We recommended that DHS work with federal agencies and the Internet service providers to document secure routing requirements in order to better ensure the complete, safe, and effective routing of information to NCPS sensors. DHS concurred with the recommendation. When we followed up with DHS on the status of the recommendations, DHS officials said that nearly all of the agencies covered by the CFO Act are receiving at least one of the intrusion prevention services, as of March 2017. Further, the officials stated that DHS has collaborated with the Office of Management and Budget (OMB) to develop new guidance for agencies on perimeter security capabilities as well as alternative routing strategies. We will evaluate the network routing guidance when DHS finalizes and implements it.

Effective Implementation of the CDM Program Could Improve Information Security at Agencies

The CDM program provides federal agencies with tools and services that are intended to provide them with the capability to automate network monitoring, correlate and analyze security-related information, and enhance risk-based decision making at agency and government-wide levels. These tools include sensors that perform automated scans or searches for known cyber vulnerabilities, the results of which can feed into a dashboard that alerts network managers and enables the agency to allocate resources based on the risk.

DHS, in partnership with and through the General Services Administration, established a government-wide acquisition vehicle for acquiring continuous diagnostics and mitigation capabilities and tools. The CDM blanket purchase agreement is available to federal, state, local, and tribal government entities for acquiring these capabilities.

There are three phases of CDM implementation: Phase 1: This phase involves deploying products to automate hardware and software asset management, configuration settings, and common vulnerability management capabilities. According to the Cybersecurity Strategy and Implementation Plan, DHS purchased Phase 1 tools and integration services for all participating agencies in fiscal year 2015.

Phase 2: This phase intends to address privilege management and infrastructure integrity by allowing agencies to monitor users on their networks and to detect whether users are engaging in unauthorized activity. According to the Cybersecurity Strategy and Implementation Plan, DHS was to provide agencies with additional Phase 2 capabilities throughout fiscal year 2016, with the full suite of CDM phase 2 capabilities delivered by the end of that fiscal year.

Phase 3: According to DHS, this phase is intended to address boundary protection and event management for managing the security life cycle. It focuses on detecting unusual activity inside agency networks and alerting security personnel. The agency planned to provide 97 percent of federal agencies the services they need for CDM Phase 3 in fiscal year 2017.

As we reported in May 2016, most of the 18 agencies covered by the CFO Act that had high-impact systems were in the early stages of CDM implementation. All 17 of the civilian agencies that we surveyed indicated they had developed their own strategy for information security continuous monitoring. Additionally, according to survey responses, 14 of the 17 had deployed products to automate hardware and software asset configuration settings and common vulnerability management. Further, more than half of the agencies noted that they had leveraged products/tools provided through the General Services Administration’s acquisition vehicle. However, only 2 of the 17 agencies reported that they had completed installation of agency and bureau/component-level dashboards and monitored attributes of authorized users operating in their agency’s computing environment. Agencies also noted that expediting the implementation of CDM phases could be of benefit to them in further protecting their high-impact systems.

The effective implementation of the CDM tools and capabilities can assist agencies in overcoming the challenges we have identified that they face when securing their information systems and information. As noted earlier, our audits often identify insecure configurations, unpatched or unsupported software, and other vulnerabilities in agency systems. We believe that the tools and capabilities available under the CDM program, when effectively used by agencies, can help them to diagnose and mitigate vulnerabilities to their systems. By continuing to make these tools and capabilities available to federal agencies, DHS can also have additional assurance that agencies are better positioned to protect their information systems and information.

Other DHS Services Are Available to Help Protect Systems, but Are Not Always Used by Agencies

DHS provides other services that could help agencies protect their information systems. Such services include, but are not limited to:

US-CERT monthly operational bulletins are intended to provide senior federal government information security officials and staff with actionable information to improve their organization’s cybersecurity posture based on incidents observed, reported, or acted on by DHS and US-CERT.

CyberStat reviews are in-depth sessions with National Security Staff, OMB, DHS, and an agency to discuss that agency’s cybersecurity posture and opportunities for collaboration. According to OMB, these interviews are face-to-face, evidence-based meetings intended to ensure agencies are accountable for their cybersecurity posture. The sessions are to assist the agencies in developing focused strategies for improving their information security posture in areas where there are challenges.

DHS Red and Blue Team exercises are intended to provide services to agencies for testing their systems with regard to potential attacks. A Red Team emulates a potential adversary’s attack or exploitation capabilities against an agency’s cybersecurity posture. The Blue Team defends an agency’s information systems when the Red Team attacks, typically as part of an operational exercise conducted according to rules established and monitored by a neutral group.

In May 2016, we reported that although participation varied among the 18 agencies we surveyed, most of those that chose to participate generally found these services to be useful in aiding the cybersecurity protection of their high-impact systems. Specifically,

15 of 18 agencies participated in US-CERT monthly operational bulletins, and most found the service very or somewhat useful.

All 18 agencies participated in the CyberStat reviews, and most found the service very or somewhat useful.

9 of 18 agencies participated in DHS’ Red/Blue team exercises, and most found the exercises to be very or somewhat useful.

Half of the agencies in our survey reported that they wanted an expansion of federal initiatives and services to help protect their high-impact systems. For example, agencies noted that expediting the implementation of CDM phases, sharing threat intelligence information, and sharing attack vectors, could be of benefit to them in further protecting their high- impact systems. We believe that by continuing to make these services available to agencies, DHS will be better able to assist agencies in strengthening the security of their information systems.

In conclusion, DHS is leading several programs that can benefit federal efforts to secure agency information systems and information. Two such programs, NCPS and CDM, offer the prospect of important advances in the security over federal systems. Enhancing NCPS’s capabilities and greater adoption by agencies will help DHS achieve the full benefit of the system. Effective implementation of CDM functionality by federal agencies could better position them to protect their information technology resources from evolving and pernicious threats.

Chairman Ratcliffe, Ranking Member Richmond, and Members of the Subcommittee, this concludes my statement. I would be happy to respond to your questions.

GAO Contact and Staff Acknowledgments

If you or your staff have any questions about this testimony, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony are Christopher Businsky, Michael W. Gilmore, Nancy Glover, Jeff Knott, Kush K. Malhotra, Scott Pettis, David Plocher, and Angela D. Watson.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.