Information Security: VA and Other Federal Agencies Need to Address Significant Challenges
Released: 2019-11-14T00:00:00

Letter

Background

VA’s mission is to promote the health, welfare, and dignity of all veterans by ensuring that they receive medical care, benefits, social support, and lasting memorials. In providing health care and other benefits to veterans and their dependents, VA relies extensively on IT systems and networks to receive, process, and maintain sensitive data, including veterans’ medical records and other personally identifiable information. Accordingly, effective information security controls based on federal guidance and requirements are essential to ensure that the department’s systems and information are adequately protected from loss, unauthorized disclosure, inadvertent or deliberate misuse, or improper modification, and are available when needed.

Implementing an effective information security program and controls is particularly important for VA since it uses IT systems and electronic information to perform essential activities for veterans, such as providing primary and specialized health care services, medical research, disability compensation, educational opportunities, assistance with home ownership, and burial and memorial benefits. The corruption, denial, or delay of these services due to compromised IT systems and electronic information can create undue hardship for veterans and their dependents.

Federal Law and Policy Set Requirements for Securing Federal Systems and Information

The Federal Information Security Modernization Act of 2014 (FISMA) requires the head of each agency to provide information security protections commensurate with the risk and magnitude of harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of the information and information systems used by or on behalf of the agency. The act also requires federal agencies to develop, document, and implement an agency-wide information security program to provide security for the information and information systems supporting their operations and assets by implementing policies and procedures intended to cost-effectively reduce risks to an acceptable level.

In May 2017, the president signed Executive Order 13800 on strengthening the cybersecurity of federal networks and critical infrastructure. The order sets policy for managing cybersecurity risk and directs each executive branch agency to use the National Institute of Standards and Technology’s (NIST) cybersecurity framework to manage those risks.

The NIST cybersecurity framework identifies specific activities and controls for achieving five core security functions: Identify: Develop an understanding of the organization’s ability to manage cybersecurity risk to systems, people, assets, data, and capabilities.

Protect: Develop and implement appropriate safeguards to ensure delivery of critical services.

Detect: Develop and implement appropriate activities to identify the occurrence of a cybersecurity event.

Respond: Develop and implement appropriate activities to take action regarding a detected cybersecurity incident.

Recover: Develop and implement appropriate activities to maintain plans for resilience and to restore capabilities or services that were impaired due to a cybersecurity incident.

According to NIST, these five functions provide a high-level, strategic view of the life cycle of an organization’s management of cybersecurity risk.

The 23 Civilian CFO Act Agencies Have Spent Billions on Cybersecurity Activities

In fiscal year 2018, the 23 civilian agencies covered by the Chief Financial Officers Act of 1990 (CFO Act), including VA, reported spending over $6.5 billion on IT security- or cybersecurity-related activities. The 23 civilian agencies individually reported spending between $9 million and almost $1.9 billion on these activities. Collectively, these 23 agencies spent on average about 14 percent of their total IT expenditures on cybersecurity-related activities. VA reported spending about $386 million on cybersecurity, which represented about 8 percent of its total IT expenditures.

Federal Agencies Continue to Report Large Numbers of Security Incidents, Although VA Has Reported Fewer Incidents In Recent Years

In fiscal year 2018, federal agencies continued to report large numbers of information security incidents. As we previously noted, federal agencies reported over 30,000 security incidents during each of the last three fiscal years. Specifically, agencies reported a total of 30,899, 35,277, and 31,107 information security incidents in fiscal years 2016, 2017, and 2018, respectively. During those same periods of time, VA reported an average of 2,415 incidents annually, although the number of reported incidents steadily decreased from 2,808 to 1,776, as shown in figure 1.

In fiscal year 2018, VA reported 1,776 incidents involving several threat vectors. These threat vectors included web-based attacks, phishing attacks, and the loss or theft of computer equipment, among others. Figure 2 provides a breakdown of information security incidents, by threat vector, reported by VA in fiscal year 2018.

Perhaps most concerning of the incidents reported by VA is the relatively large percentage of incidents (41 percent) for which VA identified “Other” as the threat vector. Government-wide, agencies identified approximately 27 percent of their incidents in the “Other” category in fiscal year 2018. A large percentage of these incidents may indicate a lack of agency awareness and ability to investigate and catalog incidents.

Federal Agencies, Including VA, Continue to Have Deficient Information Security Programs

FISMA requires IGs to determine the effectiveness of their respective agency’s information security programs. To do so, OMB instructed IGs to provide a maturity rating for agency information security policies, procedures, and practices related to the five core security functions— identify, protect, detect, respond, and recover—established in the NIST cybersecurity framework, as well as for the agency-wide information security program.

The ratings used to evaluate the effectiveness of agency information security programs are based on a five-level maturity model, as described in table 1.

According to this maturity model, Level 4 (managed and measurable) represents an effective level of security. Therefore, if an IG rates the agency’s information security program at Level 4 or Level 5, then that agency is considered to have an effective information security program.

VA was one of 18 CFO Act agencies where the IG determined that the agency-wide information security program was not effectively implemented during fiscal year 2018. The VA IG also determined the department’s maturity level for each of the five core security functions:

Level 2 (defined) for the Detect function;

Level 3 (consistently implemented) for the Identify, Protect, and

Level 4 (managed and measurable) for the Respond function.

As shown in figure 3, VA’s ratings were generally consistent with the maturity level ratings of other CFO Act agencies.

Most CFO Act Agencies, Including VA, Had Significant Security Control Deficiencies over Their Financial Reporting

Agency IGs or independent auditors assess the effectiveness of information security controls as part of the annual audits of the agencies’ financial statements. The reports resulting from these audits include a description of information security control deficiencies related to the five major general control categories defined by the Federal Information System Controls Audit Manual (FISCAM): security management controls that provide a framework for ensuring that risks are understood and that effective controls are selected, implemented, and operating as intended; access controls that limit or detect access to computer resources, thereby protecting them against unauthorized modification, loss, and disclosure; configuration management controls that prevent unauthorized changes to information system resources and assure that software is current and known vulnerabilities are patched; segregation of duties controls that prevent an individual from controlling all critical stages of a process by splitting responsibilities between two or more organizational groups; and contingency planning controls that help avoid significant disruptions in computer-dependent operations.

For fiscal year 2018, most of the 24 CFO Act agencies had deficiencies in most of the control categories, as illustrated in figure 4. VA’s IG reported deficiencies in each of these categories for the department.

As a result of these deficiencies, the IGs at 18 of the 24 CFO Act agencies designated information security as either a material weakness (six agencies, including VA) or significant deficiency (12 agencies) in internal control over financial reporting for their agency. For VA, fiscal year 2018 was the 17th year in a row that the department had reported a material weakness in information security. In addition, IGs at 21 of the 24 agencies, including VA, cited information security as a major management challenge for their agency for fiscal year 2018.

Most Civilian CFO Act Agencies, Including VA, Have Reported Meeting Many Cybersecurity Implementation Targets

The administration has developed key milestones and performance metrics for agency chief information officers (CIO) to use to assess their agency’s progress toward achieving outcomes that strengthen federal cybersecurity. The milestones and metrics have specific implementation targets, most of which are expected to be met by the end of fiscal year 2020.

As of fiscal year 2018, most civilian CFO Act agencies, including VA, had reported meeting most of the implementation targets for that year. VA reported meeting six of 10 targets. Table 2 shows the number of agencies meeting their targets as of fiscal year 2018, as well as VA’s status in doing so.

VA Faces Key Security Challenges As It Modernizes and Secures Its Information Systems

In several reports issued since fiscal year 2016, we described deficiencies related to key challenges that VA has faced in safeguarding its information and information systems. The challenges we reported related to effectively implementing information security controls; mitigating known security deficiencies; establishing elements of its cybersecurity risk management program; and identifying critical cybersecurity staffing needs. Our work stresses the need for VA to address these challenges as well as manage IT supply chain risks as it modernizes and secures its information systems.

Effectively Implementing Information Security Controls VA has been challenged to effectively implement security controls over its information and information systems. As previously mentioned in this statement, the VA IG reported that the department did not have an effective information security program and has had deficient information security controls over its financial systems. The weaknesses described by the IG are consistent with the control deficiencies we identified during an examination of VA’s high-impact systems that we reported on in 2016. In those reports, we described deficiencies in VA’s implementation of access controls, patch management, and contingency planning. These deficiencies existed, in part, because the department had not effectively implemented key elements of its information security program. Until VA rectifies reported shortcomings in its agency-wide information security program, it will continue to have limited assurance that its sensitive information and information systems are sufficiently safeguarded.

Adequately Mitigating Known Security Deficiencies VA has not consistently mitigated known security deficiencies in a timely manner. As mentioned earlier, VA has reported a material weakness in information security for financial reporting purposes for 17 consecutive years. In fiscal year 2016, we recommended 74 actions for the department to take to improve its cybersecurity program and remedy known control deficiencies with selected high-impact systems. However, as of October 2019, over 3 years later, VA had implemented only 32 (or 43 percent) of the 74 recommendations. One of the remaining unimplemented recommendations calls for the department to consistently and comprehensively perform security control assessments. This recommended activity is an important element of a cybersecurity program and helps to provide assurance that controls are operating as intended and to detect controls that are not functioning correctly.

VA has also been challenged in assuring that its actions to mitigate vulnerabilities and implement recommended improvements are effective. The department has asserted that it had implemented 39 of the 42 remaining open recommendations from our fiscal year 2016 reports. However, the evidence VA provided was insufficient to demonstrate that it had fully implemented the recommendations. The department subsequently provided additional evidence, which was also insufficient, indicating that its remedial action process was not validating the effectiveness of actions taken to resolve known deficiencies. Until VA adequately mitigates security control deficiencies, the sensitive data maintained on its systems will remain at increased risk of unauthorized modification and disclosure, and the systems will remain at risk of disruption.

Fully Establishing Elements of a Cybersecurity Risk Management Program VA has been challenged in managing its cybersecurity risk. In July 2019, we reported that the department had fully met only one of the five foundational practices for establishing a cybersecurity risk management program. Although VA established the role of a cybersecurity risk executive, the department had not fully: developed a cybersecurity risk management strategy that addressed key elements, such as risk tolerance and risk mitigation strategies; documented risk-based policies that required the department to perform agency-wide risk assessments; conducted an agency-wide cybersecurity risk assessment to identify, assess, and manage potential enterprise risks; or established coordination between cybersecurity and enterprise risk management.

VA concurred with our four recommendations to address these deficiencies and asserted that it is acting to do so. Nevertheless, until VA fully establishes a cybersecurity risk management program, its ability to convey acceptable limits regarding the selection and implementation of controls within the established organizational risk tolerance will be diminished.

Identifying Critical Cybersecurity Staffing Needs VA has been challenged to accurately identify the work roles of its workforce positions that perform IT, cybersecurity, or cyber-related functions—a key step in identifying its critical cybersecurity staffing needs. In March 2019, we reported that the department had likely miscategorized the work roles of many of these positions in its personnel system. Specifically, VA had reported that 3,008 (or 45 percent) of its 6,636 positions in the 2210 IT management occupational series— positions that most likely performed IT, cybersecurity, and cyber-related functions—were not performing these functions.

VA concurred with our recommendation to review the work roles for positions in the 2210 IT management occupational series and assign the appropriate work roles, and stated that it had begun to do so. Nevertheless, until VA completely and accurately categorizes the work roles of its workforce positions performing IT, cybersecurity, and cyber- related functions, the reliability of the information needed to improve workforce planning will be diminished and its ability to effectively identify critical staffing needs will be impaired.

Managing IT Supply Chain Risks as Part of IT Modernization Programs Assessing and managing supply chain risks are important considerations for agencies, including VA, when operating and modernizing IT systems. In July 2018, we reported that reliance on a global IT supply chain introduces risks to federal information systems. We noted that supply chain threats are present during various phases of a system’s development life cycle and we identified the following threats: Installation of malicious or intentionally harmful hardware or software; Installation of counterfeit hardware or software;

Failure or disruption in the production or distribution of critical

Reliance on a malicious or unqualified service provider; and Installation of hardware or software that contains unintentional vulnerabilities, such as defects in code that can be exploited.

These threats can have a range of impacts, including allowing adversaries to take control of systems or decreasing the availability of materials or services needed to develop systems.

Accordingly, agencies such as VA need to take appropriate measures to assess and manage IT supply chain risks as they operate and modernize their information systems. Failure to do so could result in data loss, modification, or exfiltration; loss of system availability; and a persistent negative impact on the agency’s mission.

In summary, similar to other federal agencies, VA continues to be challenged in implementing an effective agency-wide program and controls for securing its information and information systems. As VA pursues efforts to modernize and secure its IT systems, it will need to successfully address multiple challenges in order to achieve effective outcomes.

Chair Lee, Ranking Member Banks, and Members of the Subcommittee, this completes my written statement. I would be pleased to answer your questions.

GAO Contact and Staff Acknowledgments

If you or your staff members have any questions concerning this testimony, please contact me at (202) 512-6244 or wilshuseng@gao.gov.

Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this statement. Other individuals who made key contributions to this testimony include Jeffrey Knott (Assistant Director), Di’Mond Spencer (Analyst-in-Charge), Chris Businsky, Nancy Glover, Franklin Jackson, and Daniel Swartz. Also contributing were Melina Asencio, Scott Pettis, and Zsaroq Powe.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.