Information Security: OPM Has Improved Controls, but Further Efforts Are Needed
Released: 2017-08-03T00:00:00

Letter

Background

OPM collects and maintains personal information on millions of individuals, including sensitive security clearance data. The agency is the central human resources agency for the federal government, overseeing all policy to support federal agencies’ human resources departments— from classification and qualifications systems to pay, leave, and benefit policies. In addition, the agency provides investigative products and services for more than 100 federal agencies to use as the basis for suitability for employment and security clearance determinations. It also provides more than 95 percent of the government’s background investigations, conducting approximately 2.2 million investigations a year. The agency had a fiscal year 2016 discretionary budget authority of about $245 million and around 5,300 full-time equivalent employees.

On June 4, 2015, OPM reported that a breach to its information technology systems and data had potentially compromised the personal information of about 4.2 million former and current federal employees. In July 2015, OPM reported that a separate but related cyber incident targeting its databases containing background investigation records was estimated to have compromised security clearance background information of about 21.5 million individuals. In the months that followed the breach, further investigation by the agency revealed that the information compromised as a result of these breaches included employee Social Security numbers, residency and education history, employment history, information about immediate family and other personal and business acquaintances, criminal and financial history, job assignments, performance ratings, training information, and the fingerprints of approximately 5.6 million individuals. An estimated 22.1 million individuals had some form of PII stolen, with 3.6 million being a victim of both breaches.

OPM’s director is responsible for ensuring the adequacy of the agency’s information security program, including information security policies, procedures, and practices. The OPM Chief Information Officer (CIO) leads the development, management, operations, and support of the IT infrastructure, with the assistance of the managers and staff in OCIO. The agency’s Chief Information Security Officer (CISO) serves as the CIO’s primary information security adviser and guides the information security activities of the agency’s authorizing officials and information security officers. OPM also has a Management Review Board, which includes the CISO, Deputy CISO, and certain branch chiefs as members. This board is intended to manage information security risks by reviewing and approving the creation and closure actions associated with plans of action and milestones (POA&M), which address identified weaknesses.

Federal Law Establishes Security Requirements to Protect Federal Information and Systems

The Federal Information Security Modernization Act (FISMA) of 2014 is intended to provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets and for ensuring the effective oversight of information security risks, including those throughout civilian, national security, and law enforcement agencies. FISMA assigns responsibility to the head of each agency for providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of information systems used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency. The law also delegates to the agency CIO (or comparable official) the authority to ensure compliance with FISMA requirements.

FISMA also requires each agency to develop, document, and implement an agency-wide information security program to provide risk-based protections for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. Such a program includes assessing risk; developing and implementing cost-effective security plans, policies, and procedures; developing plans for providing adequate information security for networks, facilities, and systems; providing security awareness and specialized training; testing and evaluating the effectiveness of controls; planning, implementing, evaluating, and documenting remedial actions to address information security deficiencies; developing and implementing procedures for detecting, reporting, and responding to security incidents; and ensuring continuity of operations. In addition, FISMA requires agencies to comply with NIST standards and the Office of Management and Budget (OMB) requires agencies to comply with NIST guidelines. Further, FISMA requires the operation of a central federal information security incident center, a role now filled by the DHS’s US-CERT.

US-CERT Has a Role in Strengthening Agency Information Security Programs

The mission of US-CERT is to strive for a safer, stronger Internet for all Americans by responding to major incidents, analyzing threats, and exchanging critical cybersecurity information with trusted partners around the world. This mission is reflected in the four critical activities it is responsible for carrying out:

Providing cybersecurity protection to federal civilian executive branch agencies through intrusion detection and prevention capabilities.

Developing timely and actionable information for distribution to federal departments and agencies; state, local, tribal, and territorial governments; critical infrastructure owners and operators; private industry; and international organizations. Some of the information currently distributed includes weekly vulnerability bulletins and technical alerts.

Responding to incidents and analyzing data about emerging cyber threats.

Collaborating with foreign governments and international entities to enhance the nation’s cybersecurity posture.

US-CERT has developed programs and resources to carry out these activities, including the distribution of technical alerts, tips, and weekly vulnerability bulletins. In addition, it occasionally performs reviews at the agency and system levels, an activity that allows it to provide agencies more detailed information on agency- and/or system-specific weaknesses, vulnerabilities, and actions to remediate them.

Government-wide Cybersecurity Initiatives Have Been Established

OMB has established various initiatives intended to protect federal systems. These include, but are not limited to, OMB’s 30-day Cybersecurity Sprint, the October 2015 CSIP, and the CAP Goals. Agency participation and compliance with these key initiatives, which are outlined in table 1, are mandatory.

Prior GAO Recommendations Aimed to Improve OPM’s Information Security

In August 2014, we issued a report that examined federal agency oversight of contractor-operated federal IT systems. We reported that OPM, one of six federal agencies reviewed, had generally established security and privacy requirements and had planned for assessments to determine the effectiveness of contractor implementation of controls. However, the system assessments performed were not always effective. We recommended that OPM improve its oversight of contractor testing to ensure that tests are being fully executed for all contractor-operated systems. According to OPM officials, efforts are underway to implement the recommendation.

In May 2016, we reported on the implementation of OPM’s information security program and the security of selected high-impact systems. We reported that OPM, one of four agencies reviewed, had implemented numerous controls to protect selected systems, but access controls had not always been implemented effectively. Weaknesses also existed in patching known software vulnerabilities and planning for contingencies. An underlying reason for these weaknesses was that OPM had not fully implemented key elements of their information security program. We recommended that OPM fully implement key elements of its program, including addressing shortcomings related to its security plans, training, and system testing. According to OPM officials, the agency is in the process of taking actions to address these recommendations.

In addition, we issued a restricted version of the May 2016 report that identified vulnerabilities specific to each of the two systems we reviewed and made recommendations to resolve access control weaknesses in those systems. In December 2016, OPM indicated its concurrence with the recommendations and provided time frames for implementing them.

OPM Has Made Progress in Improving Its Security to Prevent, Mitigate, and Respond to Breaches, but Efforts Are Not Complete

Since the 2015 data breaches, OPM has made progress in improving its security to prevent, mitigate, and respond to data breaches involving sensitive personal records and background investigations information. After breaches of personnel and background investigation information were reported, US-CERT worked with the agency to resolve issues and develop a comprehensive mitigation strategy. Toward this end, in September 2015, US-CERT made 19 recommendations to OPM to help the agency improve its overall security posture and, thus, improve its ability to protect its systems and information from security breaches.

As of May 2017, OPM had fully implemented 11 of the recommendations. For the remaining 8 recommendations, actions for 4 were still in progress. For the other 4 recommendations, OPM indicated that it had completed actions to address them, but we noted further improvements were needed. Further, OPM had not validated actions taken to address the recommendations in a timely manner.

Beyond actions associated with the US-CERT recommendations, OPM established a new organization—the National Background Investigation Bureau (NBIB)—to perform background investigation services. It signed a memorandum of agreement with the Department of Defense (DOD) to develop and secure new systems to support the bureau’s mission.

OPM Has Made Progress Implementing US-CERT Recommendations, but Actions Remain

OPM has made progress in implementing the 19 US-CERT recommendations, but has opportunities to improve on the actions it has taken. As shown in table 2 and subsequently discussed, the agency completed actions for 11 recommendations; needed to further improve on actions taken for 4 other recommendations it indicated had been completed; and needed to complete actions in progress for the remaining 4.

Due to the sensitive nature of the recommendations, we are not providing the specific recommendations or specific examples associated with them. Generally, the recommendations pertained to strengthening activities and controls related to passwords, access permissions, patches, audit and monitoring, among other things.

OPM Did Not Effectively Monitor Actions Taken to Address the US-CERT Recommendations

OMB requires agencies to create a POA&M to track efforts to remediate identified weaknesses, such as those leading to the 19 recommendations made by US-CERT. In addition, OPM’s policy requires that scheduled completion dates be included in the plan. The policy also requires a system’s Information System Security Officer (ISSO) to develop a weakness closure package containing evidence of how items in the POA&M have been remediated before the issue (recommendation in this case) can be closed. The policy further requires that the closure package be reviewed by the Management Review Board, which approves closure.

Although OPM has a POA&M to address the 19 recommendations, it had not updated completion dates in the plan. The POA&M showed scheduled completion dates of either October or December 2015 for all recommendations. However, a separate recommendation tracking document provided to us indicated a planned completion date in the third quarter of 2017 for at least one recommendation. With such inconsistencies and lack of updates, OPM’s ability to gauge performance is limited.

Further, the agency had not validated in a timely manner its actions to implement the recommendations. For example, the plan indicated that all actions to address at least 7 of the 19 recommendations had been completed in September or October 2015. However, as of April 2017, at least 17 months later, OPM had not reviewed closure packages or otherwise validated the effectiveness of the actions taken to implement these recommendations. OPM OCIO officials explained that the Management Review Board, at a December 2016 meeting, had discussed the expected evidence required to demonstrate formal closure. In addition, they noted that the US-CERT recommendations in the POA&M would not be closed out until evidence was collected to validate the actions taken.

While the intent to validate evidence of remediation actions is commendable, the length of time OPM has taken to do so is troubling in light of the cybersecurity incidents at the agency and given the heightened risk environment in which it operates. Because the US-CERT recommendations are intended to improve the agency’s security posture, more timely validation of the effectiveness of the actions taken is warranted. Until closure packages are created and the evidence of such actions is validated, OPM has limited assurance that the actions taken have effectively mitigated vulnerabilities that can expose its systems to cybersecurity incidents.

OPM Established the National Background Investigations Bureau to Help Improve Security Since the Breach

In addition to its actions to address the US-CERT recommendations in response to the breaches that affected background investigation data, OPM updated roles and responsibilities for handling background investigations. Following the recommendation of a 90-day suitability and security interagency review that identified changes needed to strengthen the background investigation process, in January 2016, the administration announced its plans to create the NBIB within OPM. As of October 2016, OPM had transferred responsibility for performing personnel background investigations from its old Federal Investigative Services unit to NBIB and entered into a memorandum of agreement with DOD to develop and operate information systems supporting the bureau.

According to the bureau’s fact sheet, NBIB is intended to: improve the security of background investigation IT systems through a partnership with DOD, improve access to criminal history records through the creation of a law enforcement liaison unit, improve the automation and management of background investigation records, improve the efficiency of background investigation business processes, and consolidate the management of federal and contract field operations.

According to OPM OCIO officials, existing background investigation information systems and data will continue to be maintained at OPM while DOD designs and develops a new system to support NBIB. OPM plans to maintain the legacy data for historical and reporting purposes once the new system is operational. At this time, the legacy background investigation system is expected to operate for another 3 years or until all cases in it can be closed out.

To support future NBIB operations, the Defense Information Systems Agency (DISA) is in the initial stages of designing the new system, DOD OCIO officials said. While OPM will remain the owner of the background investigations data and processes, DISA will build, operate, and secure the National Background Investigation System, according to the memorandum of agreement between the agencies. According to the DOD officials, the primary benefit of having DISA host and operate the system is that it will be able to take advantage of DOD’s existing information security controls to help ensure the security of the system.

OPM Made Progress Addressing Policies and Practices Associated with Key Government-wide Initiatives and Requirements, but Had Not Fully Implemented All of Them

OMB’s CSIP and CAP Goals require federal agencies, including OPM, to take specific cybersecurity actions to bolster their system security. The requirements include identifying high value assets, minimizing the number of privileged users, using multifactor authentication to access resources, limiting the access privileged accounts have, using data encryption at rest and in transit, deploying DHS cyber threat indicators, using anti-phishing and anti-malware technology, and subjecting systems to continuous monitoring. Of the eight required actions we selected for review, OPM had developed and documented specific policies that addressed seven of them, had fully implemented two, and had taken actions to partially implement the remaining six. Until OPM completes implementation of the government-wide requirements, its systems are at greater risk than they need be.

OPM Identified Its High Value Assets

High value assets refer to those assets, systems, facilities, data, and datasets that are of particular interest to potential adversaries. These assets, systems, and datasets may contain sensitive controls, instructions, or data used in critical federal operations; or house unique collections of data (by size or content), making them of particular interest to criminal, politically-motivated, or state-sponsored actors. According to CSIP, federal agencies must continue to identify and submit a list of high value assets to DHS.

OPM had developed, documented, and implemented an information security policy for identifying its high value assets. For example, OPM’s policy stated that, as a part of its security authorization process, a security categorization of its information systems shall be conducted to include an evaluation to determine if a system will be a high value asset. The ISSO is responsible for documenting those systems identified as being high value assets using prescribed templates.

Further, OPM had taken action to identify its high value assets. To do this, according to OCIO officials, the agency considered factors such as 1) Federal Information Processing Standards (FIPS) Publication 199 categorization of high impact; 2) the sensitivity of system information; 3) the amount of PII; and 4) the size, location, and mission of a system. By identifying a list of its high value assets, OPM is better positioned to quickly identify and initiate efforts to protect its high value assets from imminent danger of a cybersecurity attack.

OPM Implemented Actions to Minimize the Number of Certain Privileged Users, but Not for Others

According to CSIP, privileged users refer to those users with a network account with elevated privileges that is typically allocated to system administrators, network administrators, database administrators, and others who are responsible for system/application control, monitoring, or administration functions—functions and responsibilities beyond the control of ordinary users. Cyber Sprint and CSIP require federal agencies to tighten policies and practices for privileged users by inventorying and minimizing the number of privileged users.

OPM defined the scope of its privileged users and implemented a process for inventorying privileged accounts. The agency’s policy defines users with elevated privileges as being those users who are authorized to perform security-relevant functions that ordinary users are not authorized to perform.

OPM demonstrated that it reduced the number of network administrators; however, the agency had not minimized other types of accounts with elevated privileges. To ensure privileged access is required for these other types of accounts, OPM OCIO officials explained that the agency conducts periodic reviews of accounts and that this review consists of ensuring that privileged access for these accounts is still warranted. However, the agency could not provide any artifacts to demonstrate this process, other than periodic reporting of the number of privileged users.

Establishing policy and minimizing the number of network administrators is a positive step. However, until OPM demonstrates that privileged access for other relevant accounts is warranted, increased risk exists that individuals may have access privileges not required to perform their job.

OPM Required Multifactor Authentication to Its Network, but Not to Two Other Systems Reviewed

Multifactor authentication—the use of more than one of the combinations of the following factors: something you know (e.g., a password), something you have (e.g., an identification badge), or something you are (e.g., a fingerprint or other biometric)—is a stronger form of authentication than single-factor authentication. According to OMB M-11-11, existing physical and logical access control systems must be upgraded to use personal identity verification (PIV) credentials, in accordance with NIST guidelines. In 2015, the Cyber Sprint required agencies to “dramatically accelerate” the use of a PIV card or alternative form of multifactor authentication for access to information systems, and CSIP requires agencies to complete implementation. Further, the CAP Goal requires agencies to implement a set of capabilities that ensure the use of multiple factors to authenticate to information technology resources. NIST states that agencies can satisfy certain identification and authentication requirements by complying with the requirements in Homeland Security Presidential Directive 12 and using multifactor authentication, such as PIV cards.

OPM had developed and documented information security policies for implementing multifactor authentication, such as enforcing the use of PIV cards. For example, OPM’s policy states that multifactor authentication is required for network and local access for privileged and non-privileged accounts and the use of the cards is required to gain access to information systems, when feasible.

OPM had implemented the use of PIV cards on one of three systems we reviewed. However, it did not require or implement the use of PIV cards or other multifactor authentication methods for the two other systems. According to OPM OCIO officials, the agency plans to complete implementation of PIV cards for all systems no later than 2018.

In its fiscal year 2016 FISMA audit report, OPM’s Office of the Inspector General (OIG) reported that it had validated the agency’s implementation of network-level multifactor authentication based on a prior recommendation. However, the OIG reported that only 2 of OPM’s 46 major systems (applications) were compliant with OMB requirements related to PIV authentication, and recommended that the OCIO meet the requirements of OMB M-11-11 by upgrading its major information systems to require multifactor authentication using PIV credentials. The office concurred with the recommendation and stated that it would work to continue the implementation of an initial enterprise identity and access management solution for enforcing multifactor authentication, including the use of PIV credentials where feasible and appropriate. OPM officials indicated in the report that they were working towards multifactor authentication at the system level in order to create multiple layers of security, but that implementation efforts are ongoing.

Until OPM upgrades all of its information systems to require the use of multifactor authentication mechanisms like PIV cards, its systems and applications may be susceptible to attack if an attacker compromises its network. Because we consider these actions to be in progress, we are not making a recommendation at this time.

OPM Controlled the Access of Privileged User Accounts, but Additional Actions are Needed

To further protect systems, agencies should employ the principle of least privilege. This principle involves granting users the most restrictive set of privileges needed to perform authorized tasks. One CAP Goal specifies that agencies should implement a set of capabilities that ensures users have access to only those resources that are required for their job function. Further, the Cyber Sprint initiative and CSIP require agencies to tighten policies and practices for privileged users by, to the greatest extent possible, limiting functions that users can perform when using privileged accounts and ensuring that privileged user activities are logged and that such logs are reviewed regularly.

OPM has developed, documented, and partially implemented an information security policy that incorporated the principle of least privilege. For example, OPM’s policy requires that users with privileged accounts only use these accounts for security-related functions and use non-privileged accounts for other system functions. The policy also requires that privileged user activities be logged and reviewed regularly. OPM initiated efforts to implement this policy; however, it has not been fully implemented. Due to the sensitive nature of the recommendation and the actions needed to implement it, these details are provided in a separate report with limited distribution.

OPM’s Implementation of Data Encryption Varied for Selected Systems

Encryption of data can be used to help protect the integrity and confidentiality of data and computer programs by rendering data unintelligible to unauthorized users and by protecting the integrity of transmitted (in transit) or stored (at rest) data. According to OMB Circular A-130, when the assessed risk indicates the need, agencies must encrypt federal information at rest and in transit unless otherwise protected by alternative physical and logical safeguards implemented at multiple layers, including networks, systems, applications, and data. It notes that agencies must apply encryption to federal information categorized as either moderate or high impact in accordance with FIPS Publication 199 unless encrypting such information is technically infeasible or would demonstrably affect the ability of agencies to carry out their mission, functions, or operations.

OPM has developed, documented, and partially implemented an information security policy relevant to data encryption. For example, OPM policy requires system owners to ensure that moderate- and high-impact information systems and PII are protected using data encryption at rest and in transit in accordance with FIPS 140-2.

Nevertheless, OPM’s implementation of data encryption at rest and in transit varied for the three systems we reviewed. Specifically,

One system was not configured to encrypt data in transit, but its production database was configured to encrypt data at rest.

The second system was configured to encrypt data in transit, but was not configured to encrypt data at rest.

For the third system, encryption efforts were nearly complete as of March 2017, and the agency was working to complete this effort. Accordingly, we are not making a recommendation at this time.

Until OPM fully deploys encryption for the selected systems, the agency will be at increased risk that the confidentiality and integrity of the data in transit and stored on its systems is not fully protected.

OPM Took Steps to Deploy Threat Indicators

Threat indicators play a key role in creating shared situational awareness of malicious cyber activity. According to the Cyber Sprint initiative, agencies must immediately deploy indicators provided by DHS regarding priority threat-actor techniques, tactics, and procedures to scan systems and check logs. In addition, CSIP states that, on an ongoing basis, agencies must scan for indicators of compromise within 24 hours of receipt of the threat indicators from DHS. Further, the Standards for Internal Control in the Federal Government state that management is to document in policies the internal control responsibilities of the organization. The standards further state that controls be documented; documentation of controls is evidence that controls are identified, capable of being communicated to those responsible for their performance, and capable of being monitored and evaluated by the entity.

Although OPM had deployed DHS threat indicators and scanned for them, its policy had not been updated for this specific requirement. The agency had developed and documented a policy that describes threat indicators such as signatures. For example, OPM’s information security handbook states that signatures related to malware should be updated.

The agency also had a procedure in place that gives the CISO responsibility for ensuring that security alerts and advisories are received on a continuous basis, and notes that scanning will occur periodically. However, neither the policy nor procedure described responsibilities for ensuring the 24-hour scanning requirements are accomplished and monitored. By updating the policy and procedure to specifically document roles and responsibilities associated with DHS threat indicator requirements, such as scanning, OPM could further improve upon its ability to ensure that controls are being communicated to those responsible for their performance and are capable of being monitored and evaluated.

OPM Used Several Anti- Malware and Anti-Phishing Technologies, but Shortcomings Existed

Anti-phishing and malware defense is important to protect agencies from phishing attempts, where attackers use social engineering with authentic- looking e-mails, websites, or instant messages to get users to download malware, open malicious attachments, or open links that direct them to a website that requests information or executes malicious code. According to the CAP Goal for anti-phishing and malware defense, agencies must implement technologies, processes, and training that reduce the risk of malware introduced through e-mail and malicious web sites.

OPM had deployed several anti-malware technologies, but shortcomings existed with the tools deployed. Due to the sensitive nature of the types of tools deployed and any shortcomings, we are not providing specific examples in this report. This information is provided in a separate report with limited distribution.

OPM also implemented an effective training exercise to reduce the risk of malware introduced through e-mail and malicious websites. At the request of OPM, DHS’s National Cybersecurity Assessment and Technical Services conducted e-mail phishing exercises to assess the agency’s potential risk and vulnerabilities to e-mail phishing attacks. Over the course of months, OPM showed improvement with results from the phishing exercises. Specifically, in April 2016, DHS reported that it had sent 3,000 fictitious e-mails with a link that would redirect users to a website that describes the dangers of clicking on untrusted links. Of the 3,000 e-mails, 366 unique users (about 12 percent) clicked on the phishing link. Subsequent testing indicated that users were better informed. In September 2016, for the 882 suspicious e-mails sent over the course of 7 campaigns, DHS reported only one instance (less than 1 percent) of a user clicking on a phishing link. By having personnel better informed to detect phishing attempts, OPM has greater assurance that agency systems will not be compromised by such a threat.

OPM Did Not Assess Selected Systems According to Its Continuous Monitoring Plan

Continuous monitoring is an important activity in assessing the security impacts on an information system resulting from planned and unplanned changes to the hardware, software, firmware, or environment of operation. According to NIST, continuous monitoring facilitates ongoing awareness of threats, vulnerabilities, and information security to support organizational risk management decisions. The CAP Goal for Information Security Continuous Monitoring (ISCM) states that agencies should provide ongoing observation, assessment, analysis, and diagnosis of an organization’s cybersecurity posture, hygiene, and operational readiness. Additionally, OMB Memorandum 14-03 requires federal agencies to develop and maintain an ISCM strategy and establish an ISCM program.

Further, to facilitate continuous monitoring by agencies, DHS established the Continuous Diagnostics and Mitigation (CDM) program. The program involves the delivery of tools and services intended to provide the ability to enhance and automate existing agency continuous network monitoring capabilities, correlate and analyze critical security-related information, and enhance risk-based decision making at the agency and federal levels. CSIP states that federal agencies are to accelerate the implementation of capabilities and tools to identify risks to their systems and networks, including DHS’s CDM program. Further, NIST SP 800-53 recommends that an organization provide role-based security training to personnel with assigned security roles and responsibilities.

OPM had established an ISCM program and took actions to implement continuous monitoring practices. The agency also developed a continuous monitoring strategy that requires system owners to assess security controls for ongoing continuous monitoring of its information systems based on the established security control assessment frequencies specified in the continuous monitoring plan. According to the agency’s fiscal year 2016 continuous monitoring plan, owners are to assess specified controls on each system periodically according to the schedule in the plan.

However, OPM did not consistently assess the security controls at defined frequencies for the three selected systems we reviewed. For example, the agency did not assess the controls for the systems for several months at a time. According to OPM OCIO officials, security controls for two systems were not assessed in accordance with defined frequencies due to a shortage of ISSOs at the agency, and the other system was not assessed because the system was undergoing reauthorization. However, until OPM consistently performs periodic assessments of the selected systems, the agency will have less assurance of whether controls for these systems are effective and operating as intended.

In its 2016 FISMA report, the OIG identified a weakness in OPM’s information security governance regarding the extremely high employee turnover rate for the ISSO positions and OPM’s lack of filling those positions. Subsequently, the OIG recommended that OPM hire a sufficient number of ISSOs to adequately support all of the agency’s major information systems. The agency concurred with the recommendation and indicated that plans were in place to hire a sufficient number of ISSOs to support all of its major information systems.

OPM deployed continuous monitoring tools obtained through DHS’s CDM program, and developed and deployed its own internal continuous monitoring dashboard. Officials stated that the agency completed the first phase of DHS’s CDM program and is in the process of implementing the second phase.

However, OPM has not issued role-based training requirements for the individuals configuring and maintaining the deployed CDM tools. OCIO officials told us the agency drafted role-based training requirements for CDM users, but could not demonstrate to us that it has done so.

Until OPM develops and implements role-based training requirements for staff using its CDM tools, it will not be able to ensure that staff are using the tools properly. As a result, the usefulness of the tools for monitoring the security of the agency’s information systems may be diminished.

OPM’s Procedures for Overseeing the Security of its Contractor-Operated Systems Did Not Ensure that Controls Were Comprehensively Tested

OPM has implemented elements of contractor oversight such as recording security assessment findings for contractor-operated systems in remediation plans, but it did not ensure that system security assessments involved comprehensive testing. The agency requires ISSOs to conduct quality assurance reviews that include reviewing security assessments of contractor-operated systems; however, its policy did not include detailed guidance on how the reviews are to be conducted.

OPM Has Not Ensured that Security Control Assessments for Contractor-Operated Systems Are Comprehensive

To determine the effectiveness of contractors’ implementation of federal information security requirements, agencies rely on security control assessments for contractor-operated systems. FISMA requires that agencies periodically test the management, operational, and technical controls for their systems, including for those systems that are operated by a contractor of an agency or other organization on behalf of an agency. In addition, NIST SP 800-53 recommends that agencies assess systems to determine if controls are implemented correctly, operating as intended, and producing the desired results. It also requires that a plan be developed that describes the assessment procedures to be used to determine security control effectiveness, and that the agency produce a report that contains the results of this assessment. Further, NIST SP 800- 53A contains a suggested methodology for control assessments, including personnel to interview, documents to examine, and testing to be performed. It also states that different assessment methodologies may be used as long as they are sufficient to identify weaknesses.

OPM ensured that security control assessments had been conducted for the contractor-operated systems we selected for review; however, instances existed where the methodology employed to conduct the assessments was not sufficient to identify potential weaknesses. Specifically, third-party assessors, on behalf of OPM’s contractors, recently conducted security assessments for each of the three contractor- operated systems we reviewed. The methodologies for the assessments included document examinations, interviews, and system testing.

We determined that many of the selected controls had been properly assessed, as shown in table 3.

The assessors had addressed most controls for at least two systems satisfactorily; nevertheless, shortcomings existed in the completeness of the testing of specific controls. For example, for System 1, 23 of the 120 controls we reviewed had not been properly assessed. For the 23 controls, the assessor did not test the system to determine if the controls were in place. In addition, for System 3, the security control assessment provided few details on the procedures used to evaluate the effectiveness of the system’s security controls. Instead, the assessors recorded the exact same procedures for every control, and few had enough detail in the results to determine if the assessors had employed sufficient procedures.

OPM has developed, documented, and implemented a process for overseeing the security of contractor-operated systems. The process involved reviewing the third-party security control assessments, but it did not ensure the comprehensiveness of the assessments. OPM has established a quality assurance process that includes reviewing security control assessments. This process consisted of a standard form letter that the ISSO completes after reviewing the assessment package provided by the third-party assessor. For all three selected contractor- operated systems, security officers completed the letter and noted shortcomings with the security control assessments:

System 1: the ISSO noted some problems due to a lack of provided evidence. For example, the assessor concluded that a number of controls were partially satisfied, despite evidence not being provided by the contractor to the assessor.

System 2: the security officer identified documentation issues with several controls. For example, the system security plan described the system inconsistently with other documents, such as the contingency plan.

System 3: the ISSO stated that most of the evidence provided by the assessor was not referenced to the specific procedures performed.

Nevertheless, the security officers did not comment on the comprehensiveness of testing, such as the scope and depth of testing by the third-party assessors. In February 2017, OPM issued an updated authorization guide, which stated that the security officer should review the assessment results and evidence and conduct a quality assurance review on the procedures executed by the independent assessor. However, the guide does not include instructions on how the security officer should perform this review. Until OPM provides more detailed guidance to the ISSOs, the ISSOs may not conduct a rigorous review of the assessment. Therefore, the agency will have less assurance that the security controls for its contractor-operated systems are comprehensively assessed.

We have previously made recommendations related to OPM’s procedures for ensuring the sufficiency of security control assessments for its systems, including those operated by contractors on its behalf. In our August 2014 report related to agency oversight of information technology contractors, we recommended that the agency develop, document, and implement oversight procedures for ensuring that a system test is fully executed for each contractor-operated system. The agency concurred with the recommendation, but, as of April 2017, had not provided evidence that the recommendation had been implemented.

Further, in our May 2016 report related to the security of high-impact systems, we recommended that OPM reevaluate security control assessments to ensure that they comprehensively test technical controls for two selected high-impact systems, one of which was a contractor- operated system. The agency did not concur with our recommendation. However, without comprehensive security control assessments for these systems, OPM is at increased risk that it may not detect vulnerabilities in the systems. Therefore, we believe the recommendation is warranted.

OPM Has Developed and Documented Remedial Action Plans for Weaknesses Identified During Security Assessments

A remedial action plan is a key component of an agency’s information security program, as described in FISMA. Such a plan assists agencies in identifying, assessing, prioritizing, and monitoring progress in correcting security weaknesses that are found in an information system. NIST recommends that agencies develop a POA&M for an information system to document the agency’s planned remedial actions to correct identified weaknesses.

OPM developed a POA&M for each of the three reviewed systems and recorded 63 of 64 security weaknesses identified in security assessments for those systems. Tracking the weaknesses that arise from security assessments allows OPM to keep track of the weaknesses as they are remediated or their risk is accepted. Table 4 shows the number of security weaknesses per system reviewed.

OPM policy also requires management oversight and review of remediation plans. Contractors are to provide evidence, which is to be reviewed and approved by multiple parties at OPM before a POA&M is considered closed. However, because the assessments we selected were so recent, we were unable to evaluate whether this process had been effectively implemented.

Conclusions

OPM collects and maintains highly sensitive personal information on millions of individuals, including sensitive security clearance data. Cyber incidents at OPM demonstrated the impact that increasingly sophisticated cyber threats can cause and underscore the importance of protecting the agency’s systems. OPM has improved its security posture and is in the process of taking numerous actions, such as addressing recommendations from US-CERT and implementing government-wide requirements and initiatives that could decrease the risk of future security breaches if effectively implemented. However, by not validating remedial actions in a timely manner, the agency has limited assurance whether these actions effectively mitigated vulnerabilities that can expose systems to incidents. In addition, OPM had not consistently updated milestones for outstanding US-CERT recommendations or complied with its own plan for conducting periodic control assessments. Also, training needed to ensure proper use of monitoring tools was not being completed because the agency has not documented such requirements. Further, key security controls on selected contractor-operated systems have not always been comprehensively tested. Until OPM further improves controls over its information and information systems, it has limited assurance that sufficient security controls are in place and operating as intended.

Recommendations for Executive Action

To further improve security over personnel and other sensitive information at the agency, we are recommending that the Acting Director of OPM implement the following five recommendations: 1. Update the POA&M to reflect expected completion dates for implementing the recommendations made by US-CERT. 2. Improve the timeliness of validating evidence associated with actions taken to address the US-CERT recommendations. 3. Update policy to reflect deployment of DHS threat indicators and the specific 24-hour scanning requirement. 4. Develop and implement role-based training requirements for staff using CDM tools. 5. Provide detailed guidance on the quality assurance process that includes evaluating security control assessments.

In a separate report with limited distribution, we are making nine recommendations to the Acting Director to improve upon actions taken to implement the recommendations made by US-CERT and to further implement government-wide requirements.

Agency Comments and Our Evaluation

We received written comments on a draft of this report from OPM. In its comments, which are re-printed in appendix II, the agency concurred with four of our five recommendations and partially concurred with one recommendation.

OPM partially concurred with our recommendation that it improve the timeliness of validating evidence associated with actions taken to address the US-CERT recommendations. The agency did not specifically address the reason for its partial concurrence, but stated that it will review its management practices to support more timely closure of POA&Ms. Regardless of whether OPM reviews its management practices, performing timely validation of evidence is critical. As noted in this report, at least 17 months had passed without OPM validating evidence that it had effectively implemented the US-CERT recommendations. Until the evidence is validated, OPM will have limited assurance that the actions taken have mitigated vulnerabilities that can expose its systems to cybersecurity incidents.

In addition, OPM provided comments concerning the approach of our audit and aspects of our report message. In particular, the agency stated that GAO did not fully acknowledge OPM’s “defense in depth” strategy and that the report does not present a fully accurate picture of the agency’s cybersecurity posture. As we state in this report, our objectives were to evaluate OPM’s actions taken since the 2015 breach, implementation of requirements associated with selected government- wide initiatives, and oversight of contractor-operated systems. We designed and performed audit procedures to collect sufficient evidence to accomplish these objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions.

Beyond the results of this audit, we previously reported in 2016 that OPM needed to improve security controls over its high-impact systems that we selected for review. In two prior reports, we made numerous recommendations to enhance the agency’s information security program and to resolve access control weaknesses in those systems. To date, these recommendations remain open. Based on the results of our prior work and this audit, we believe our current report appropriately reflects OPM’s cybersecurity posture, consistent with our audit objectives.

OPM also indicated that it has taken steps to enhance its cybersecurity posture in multiple areas through the addition of cybersecurity tools and security updates, staff and agency-wide training, critical personnel hiring, and collaboration with its interagency partners. We agree that these are positive actions. Effective implementation of these actions and our recommendations is essential to ensuring that sufficient security controls are in place and operating as intended.

We are sending copies of this report to appropriate congressional committees, the acting Director of the Office of Personnel Management, including its Office of the Inspector General, and other interested congressional parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact Gregory C. Wilshusen at (202) 512-6244 or wilshuseng@gao.gov, or Dr. Nabajyoti Barkakati at (202) 512-4499 or barkakatin@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III.

Appendix I: Objectives, Scope, and Methodology

Our objectives were to evaluate the Office of Personnel Management’s (OPM) 1) actions since the 2015 data breaches to prevent, mitigate, and respond to data breaches involving sensitive personnel records and information; 2) information security policies and practices as they relate to selected government-wide initiatives and requirements; and 3) procedures for overseeing the security of OPM information maintained by contractors providing information technology services.

To address the first objective, we assessed the extent to which the agency had implemented 19 recommendations that the United States Computer Emergency Response Team (US-CERT) made in its 2015 breach investigation report. We chose to focus on the status of US- CERT’s recommendations for this objective in order to avoid duplication of effort. According to US-CERT, its recommendations outlined mitigations and security best practices based on the specific compromise and OPM’s cybersecurity environment, and are tailored to the OPM environment.

To determine the extent of implementation and whether further improvements were needed, we reviewed the status (e.g., complete or in progress) of OPM’s actions to address the recommendations made by US-CERT. We focused on one or more actions described in the plans of action and milestones provided to us. We interviewed officials from OPM’s Office of the Chief Information Officer (OCIO) and reviewed the agency’s information security documentation, to include policies, plans, and procedures. We also performed limited testing of the agency’s internal network and software tools to determine the extent to which US- CERT’s recommendations had been implemented. This testing included examining system and device configurations, firewall rules, system status reports, and account listings. We focused on those software tools that OPM indicated it had deployed as actions taken to implement US-CERT recommendations. If, after reviewing the plans provided by OPM and performing our own testing, we could not account for a specific recommendation or disagreed with the implementation status, we followed up with the agency.

For this objective, we evaluated the reliability of the data related to the number of workstations at OPM, as well as the number of outstanding patches. We assessed the data reliability by various means, including reviewing related documents, conducting observations of systems generating data, interviewing knowledgeable agency officials, and reviewing internal controls such as agency policies and procedures. We concluded that the data were sufficiently reliable for the purposes of this reporting objective.

As part of this objective, because the data breaches involved background investigation information, we also reviewed OPM’s plans to establish the new National Background Investigations Bureau (NBIB), its plans to transfer the information systems supporting NBIB to the Department of Defense (DOD), and DOD’s plans for the National Background Investigations System. To accomplish this, we reviewed the memorandum of agreement between the agencies and implementation plans and interviewed officials from OPM and DOD.

To address the second objective, we focused on the security controls agencies are required to implement, as described in the Office of Management and Budget’s October 2015 Cybersecurity Strategy and Implementation Plan (CSIP) and the Cybersecurity Cross-Agency Priority (CAP) Goals. In addition, OMB issued an updated version of its Circular A-130, which we also reviewed. Based on our review of these documents, we determined that government-wide requirements associated with them include: 1) identifying high value assets, 2) minimizing the number of privileged users, 3) using multifactor authentication, 4) limiting the access for privileged accounts, 5) using data encryption, 6) deploying cyber threat indicators issued by the Department of Homeland Security, 7) using anti-phishing and anti- malware technology, and 8) subjecting systems to continuous monitoring. Further, we reviewed and applied the National Institute of Standards and Technology’s (NIST) standards and guidelines that are related to these requirements.

To determine the extent to which OPM had implemented the requirements associated with the initiatives, we reviewed agency policies, implementation plans, and other related documents, and interviewed OPM OCIO officials and contractors. We verified this information and collected new information by reviewing relevant controls on three selected systems. We selected these systems based on the agency categorizing them as high-impact systems and them not being recently audited by GAO. Because system weaknesses identified in this report could be exploited, we are not identifying the system names or other specifics related to our selection. In a separate report with limited distribution, we provide more details regarding our scope and methodology. The review we conducted was targeted to acquire information specifically related to this objective and was therefore not comprehensive in nature. Some of the testing we performed included reviewing configuration settings, administrative account privileges and authorizations, and data encryption.

To address our third objective, we interviewed OPM officials and reviewed OPM policy and system security assessments. For selected OPM contractor-operated systems, we reviewed the system’s security assessments to determine whether the security control review conducted by the assessor was adequate to evaluate the effectiveness of the controls tested. We selected the two active, contractor-operated systems that were not involved in the breach, but were categorized by the agency as high-impact systems. We also selected one active system that the agency categorized as moderate impact. Because system weaknesses identified in this report could be exploited, we are not identifying the systems’ names or other specifics related to our selection. We focused the scope of our review on assessments of moderate- and high-impact controls in the following NIST Special Publication (SP) 800-53 defined control families: access controls, audit and accountability, security assessment and authorization, configuration management, contingency planning, risk assessments, and system and information integrity. In addition, we excluded controls identified by the assessors as either inherited or not applicable.

We determined the sufficiency of the procedures used by comparing the requirements and recommended testing procedures—as defined in NIST SP 800-53 and NIST SP 800-53A—of each control with the testing procedures documented by assessors in the assessment results. For each control, we evaluated whether the type (e.g., interview, observation, technical testing) and scope of the testing performed was such that one could accurately determine whether a given control had been effectively implemented. We also reviewed the plans of action and milestones associated with each assessment to determine whether the assessment results were reflected in the plans.

We conducted this performance audit from January 2016 to August 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Office of Personnel Management

Appendix III: GAO Contacts and Staff Acknowledgments

GAO Contacts

Staff Acknowledgments

In addition to the contacts named above, West Coile and Jeffrey Knott (assistant directors); Justin Palk (analyst-in-charge); Corey Evans, Nancy Glover, David Plocher, Brandon Sanders, Michael Stevens, and Edward Varty made key contributions to this report.