Information Security: Actions Needed by Census Bureau to Address Weaknesses
Released: 2013-02-20T00:00:00

Letter

Background

The Census Bureau’s mission is to collect and provide comprehensive data about the nation’s people and economy. Core activities include conducting decennial, economic, and government censuses; conducting demographic and economic surveys; managing international demographic and socioeconomic databases; providing technical advisory services to foreign governments; and performing other activities such as producing official population estimates and projections.

The Census Bureau is part of the Department of Commerce and is in the department’s Economics and Statistics Administration, led by the Under Secretary for Economic Affairs. It is headed by a director and is organized into directorates corresponding to key programmatic and administrative functions, as depicted in figure 1.

To support the IT operations for all of its activities, including those related to decennial censuses, the Census Bureau reported that it planned to spend $384 million on major IT investments in fiscal year 2012.

Role of IT at the Census Bureau

The Census Bureau’s mission to plan, take, process, and publish the results of censuses and surveys requires the work of thousands of people and, increasingly, the use of automation to compile the information. For nearly 100 years, census data were tabulated by clerks who made tally marks or added columns of figures with a pen or a pencil. As the nation grew and there were more people, items, and characteristics to count, speedier tabulation methods had to be invented or the results of one census would not be processed before it was time for the next one. In 1880, the bureau used a “tabulating machine”—a wooden box in which a roll of paper was threaded past an opening where a clerk marked the tallies in various columns and then added up the marks when the roll was full—which made tabulating at least twice as fast as the previously-used manual processes.

By 1950, mechanical tabulating improved to 2,000 items per minute. In 1951, the bureau used the first large-scale electronic computer, UNIVAC I, designed and built specifically for its use. This machine was able to tabulate 4,000 items per minute. Beginning in 1970, the bureau took advantage of new high-speed equipment that converted data on computer tape directly to words and numbers on off-set negative film used in publishing. Then, in the mid-1980s, statistics were made available on diskettes for use in microcomputers and users were able to obtain statistics online. In the later 1980s, the bureau began testing CD-ROM (compact disc/read-only memory) laser disks as a medium for releasing data.

The 2000 census demonstrated probably the biggest leap forward in the use of technology for collecting and disseminating data. The bureau’s previous response scanning system (which dated to the 1950s) was replaced with optical character recognition technology, allowing the bureau to design a respondent-friendly (instead of machine-friendly) questionnaire in which write-in responses could also be captured electronically. In addition, the bureau’s previous online data system from the 1990s evolved into online data available through the Census Bureau’s website. Further technological advances were made in the 2010 Decennial Census through the use of handheld computers for parts of census operations and the integration of Global Positioning System information into Census Bureau maps.

While advances in capturing and tabulating census data can improve the bureau’s ability to fulfill its mission, the costs for these improvements have been high. The 2010 Decennial Census, at $13 billion, was the most expensive U.S. census in history. One reason for this was the greater- than-anticipated use of paper-based processing due to performance issues with key IT systems, which increased the price of the census by almost $3 billion. Based on these past trends, the cost of the next decennial census could reach approximately $25 billion, although, thus far, the bureau is planning to spend roughly $12 to $18 billion.

Title 13 Protects Sensitive Census Bureau Information

For many years, each decennial census was conducted pursuant to a specific act of Congress. In 1954, that body of acts was brought together in Title 13 of the United States Code, the laws under which the Census Bureau operates. Title 13 spells out the basic scope of the censuses and surveys, the requirements for the public to provide information as well as for the Census Bureau to keep that information confidential, and the penalties for violating these obligations. Specifically, the bureau may not disclose or publish any private information that identifies an individual or business, such as names, addresses, Social Security numbers, and telephone numbers. Other federal laws, including the Confidential Information Protection and Statistical Efficiency Act of 2002 and the Privacy Act of 1974, reinforce these protections.

According to bureau documentation, the bureau takes several steps to protect the public’s personal information. For example, it displays its data protection and privacy principles on its website, pledges to remove personally identifiable information—such as names, telephone numbers, and addresses—from data files, and uses various approaches to protect personal information, including computer technologies, statistical methodologies, and security procedures. For example, according to the bureau, names and addresses are removed from forms, the remaining information is transferred to a machine readable form, and the original questionnaires are then destroyed. Before any census tabulation is published, it is checked to make certain that no individual, household, or organization can be identified, and that information cannot be inferred by reading the table or by analyzing the figures it contains. Every person who works with the bureau’s confidential information takes an oath to uphold the law. Violating the confidentiality of a respondent is a federal crime with serious penalties, including a federal prison sentence of up to 5 years, a fine of up to $250,000, or both.

According to the Census Bureau, results from previous censuses are stored in secure locations. In the case of population and housing census data, the questionnaires are microfilmed before destruction and the microfilm is stored in the bureau’s National Processing Center in Jeffersonville, Indiana, where an individual or an heir or legal representative may obtain information for proof of age or residence in the form of an official transcript. Copies of population census schedules from 1790 through 1940, are available for research at the National Archives, on the Internet, and at libraries in various parts of the country, but subsequent records are closed to the public for 72 years to protect the confidentiality of the information they contain. (The Freedom of Information Act, designed to make records available to individuals, does not apply to identifiable data the Census Bureau collects for statistical purposes.)

Responsibility for Census Bureau Information Systems

The bureau’s IT operations are divided among three locations: Census Bureau headquarters in Suitland, Maryland; the Bowie Computing Center in Bowie, Maryland; and the National Processing Center in Jeffersonville, Indiana. See figure 2 for a depiction of the Census Bureau’s network.

At these locations, the Census Bureau’s information systems are organized into 27 “CENs,” with each CEN containing a set of information resources that share the same direct management control. These systems include networks, telecommunications, and specific applications.

Headquarters develops national policies and is the primary location hosting the bureau’s statistical programs. The Bowie Computing Center is the bureau’s primary data center, and the National Processing Center is the bureau’s primary location for mailing, receiving, and scanning data from hard copy survey forms. The bureau has additional facilities nationwide, including field offices, regional data centers, and call centers.

Many of the bureau’s enterprise IT resources and services are managed by the Information Technology Directorate, which is led by the Associate Director for Information Technology, who serves as the Chief Information Officer for the bureau. Within the IT Directorate, three offices play key roles in administering Census Bureau IT operations: (1) the Telecommunications Office, at headquarters in Suitland, is responsible for operating the wide area network that provides connectivity among headquarters, major sites, regional offices, and other government agencies; (2) the Local Area Network Technologies Support Office, also located in Suitland, manages end user desktops, core productivity applications, and connectivity from user workstations to the core network; and (3) the Computer Services Division, located in Bowie, manages server operations across the bureau.

Responsibility for other key IT systems lies within other bureau organizations, and the majority of the bureau’s IT staff are located outside of the bureau’s IT Directorate. According to the Census Bureau, of 1,148 IT staff, the IT Directorate has 256, Economic Programs has 262, the Decennial Census has 156, Field Operations has 185, and Demographic Programs has 123. In addition, according to the bureau, the IT Directorate was allocated $130 million in fiscal year 2012 to be spent on systems it manages and $254 million was allocated for systems managed by other directorates.

FISMA Establishes Responsibilities for the Census Bureau’s Information Security Program

The Federal Information Security Management Act of 2002 (FISMA) requires each federal agency to develop, document, and implement an agencywide information security program to provide security for the information and information systems that support the operations and assets of the agency, including those provided or managed by other agencies, contractors, or other sources. The Secretary of Commerce is responsible for ensuring that the department, including the Census Bureau, provides an information security program, commensurate with risk, for information collected or maintained by or on behalf of the agency, and information systems used or operated by the agency or on its behalf. The Secretary, as agency head is also responsible for ensuring that senior agency officials, such as the Under Secretary for Economic Affairs who oversees the Census Bureau, provide information security for the operations and assets under their control.

The Director of the Census Bureau is accountable to the Department of Commerce for the Census Bureau’s information security program, and has delegated oversight of the program to the bureau’s Chief Information Officer. The Census Bureau’s Chief Information Officer has appointed the bureau’s Chief Information Security Officer to serve as the bureau’s Senior Agency Information Security Officer. The Chief Information Security Officer is responsible for ensuring that the bureau’s information security program follows applicable federal laws.

The Office of Information Security, led by the bureau’s Chief Information Security Officer, centrally administers the bureau’s information security program. The bureau has designated key roles in IT security according to FISMA and the bureau’s IT security policies (see table 1).

Control Weaknesses Threaten Information and Systems that Support Census Bureau Mission

Although the Census Bureau has taken steps to safeguard the information and systems that support its mission, security control weaknesses pervaded its systems and networks, thereby jeopardizing the bureau’s ability to sufficiently protect the confidentiality, integrity, and availability of its information and systems. These deficiencies included those related to access controls, as well as other controls such as configuration management and contingency planning. A key reason for these weaknesses is that the bureau has not yet fully implemented an agencywide information security program to ensure that controls are appropriately designed and operating effectively. As a result, the bureau has limited assurance that its information and information systems are being adequately protected against unauthorized access, use, disclosure, modification, disruption, or loss.

Census Bureau Did Not Fully Implement Access Controls

Access controls are designed and implemented to ensure the reliability of an agency’s computerized information. Both logical and physical access controls are intended to prevent, limit, and detect unauthorized access to computing resources, programs, information, and facilities. Access controls include those related to (1) protection of system boundaries, (2) identification and authentication, (3) authorization, (4) cryptography, (5) audit and monitoring, and (6) physical security. Inadequate design or implementation of access controls increases the risk of unauthorized disclosure, modification, and destruction of sensitive information and disruption of service.

Boundary protection controls logical connectivity into and out of networks and controls connectivity to and from devices connected to the network. For example, multiple firewalls can be deployed to prevent both outsiders and trusted insiders from gaining unauthorized access to systems, and intrusion detection technologies can be deployed to defend against attacks from the Internet. Unnecessary connectivity to an organization’s network increases not only the number of access paths that must be managed and the complexity of the task, but also the risk of unauthorized access in a shared environment. NIST guidance states that agencies should provide adequate protection for networks and employ information control policies and enforcement mechanisms to control the flow of information between designated sources and destinations within information systems. The National Security Agency (NSA) provides leading practices that agencies may adopt for securing and configuring information systems. These practices include establishing a dedicated management network, also called an out-of-band network, to provide several benefits, such as allowing parallel management of all devices, fault analysis, and recovery and recommend against the use of unencrypted protocols to manage IT infrastructure.

The Census Bureau had taken steps to protect network boundaries. For example, the bureau used firewalls to protect its network from unwanted Internet intrusions. The bureau had also implemented an intrusion detection system on key network segments to monitor for malicious network activity.

However, the bureau did not sufficiently control connectivity to key network devices and servers. Specifically, the bureau did not protect access to its network devices and servers by using a separate dedicated network for centralized management and administration of many network devices and servers. Rather, various bureau management activities were on the general network and therefore were more vulnerable to compromise because of the broader access to the general network. In the event that the bureau’s general network is compromised, there is an increased risk that the bureau may not be able to manage its systems or even detect an attack. In addition, the bureau was using insecure protocols to manage its IT infrastructure, placing sensitive data such as administrative user accounts and passwords at risk of compromise.

A computer system must be able to identify and authenticate different users so that activities on the system can be linked to a specific individual. When an organization assigns a unique user account to a specific user, the system is able to distinguish that user from another—a process called identification. The system must also establish the validity of a user’s claimed identity by requesting some kind of information, such as a password, that is known only by the user—a process known as authentication. The combination of identification and authentication—such as a user account/password combination—provides the basis for establishing individual accountability and for controlling access to the system. NIST 800-53 guidelines recommend that information systems uniquely identify and authenticate all users (or processes on behalf of users) and that systems be set to establish complex passwords to reduce the likelihood of a successful attack. Census Bureau policy also requires minimum standards for password parameters such as complexity, minimum and maximum lifetime restrictions, reuse, and account lock out.

Furthermore, Office of Management and Budget (OMB) guidelines direct federal agencies to use multifactor authentication for remote access to agency systems and NIST guidelines recommend that when using cryptographic keys for authentication, the authentication process prove possession and control of the encryption key. Typically, this requires that the key be encrypted using some form of activation data such as a password. Additionally, bureau policy states that encryption keys should be changed periodically. NIST guidelines also recommend that, before devices establish a connection, they should be identified and authenticated.

Finally, in February 2011, OMB directed agencies to issue implementation policies for personal identity verification cards (PIV), used to verify employee identity, by March 31, 2011. Agencies were required to use PIV credentials as the common means of authentication for physical and logical access to agency facilities, networks, and information systems. A PIV card must contain the personally identifiable information for the employee or individual to which it is issued and allow identification to be verified by both a human and an automated system.

However, the Census Bureau did not identify and authenticate all its systems and devices and its implementation of PIV cards was not complete. Specifically,

Several bureau systems used shared accounts for administrative access, making it more difficult to enforce individual accountability and reconstruct events to support investigations after-the-fact.

Multiple components of bureau infrastructure and servers did not meet the bureau’s minimum password requirements. As a result, there is a heightened risk that unauthorized individuals could exploit these vulnerabilities by guessing a password and using the password to obtain unauthorized access to bureau systems and databases.

Encryption keys were stored without passwords in certain cases and passwords were not changed as required, increasing the risk that administrator user accounts and passwords could be compromised by attackers.

Several of the bureau’s network devices were configured to use unauthenticated network protocols. Without proper authentication, these protocols can be easily compromised and cause various network disruptions, including network denial of service, unauthorized modification of the network infrastructure, improper routing of network traffic, and issues with logging network data.

The bureau had not yet completed its implementation of its PIV card system and several cards issued under the bureau’s PIV initiative were not PIV-compliant. Bureau project plans indicated that deployment of logical access will not be completed until June 2013. Without a consistent and complete implementation of the PIV standard for both physical and logical access, the bureau increases the risk that its access control systems will not limit access appropriately.

Authorization is the process of granting or denying access rights and permissions to a protected resource, such as a network, a system, an application, a function, or a file. For example, operating systems have some built-in authorization features such as permissions for files and folders. Network devices, such as routers, have access control lists that can be used to authorize a user who can access and perform certain actions on the device. A key component of granting or denying access rights is the concept of “least privilege.” Least privilege is a basic principle for securing computer resources and information. This principle means that a user is granted only those access rights and permissions needed to perform official duties. To restrict legitimate user access to only those programs and files needed to perform work, agencies establish access rights and permissions. “User rights” are allowable actions that can be assigned to a user or to a group of users. File and directory permissions are rules that regulate which users can access a particular file or directory and the extent of that access. To avoid unintentionally authorizing user access to sensitive files and directories, an agency must give careful consideration to its assignment of rights and permissions.

NIST guidance recommends that federal agencies grant a user only the access and rights to information and information systems needed to perform official duties. NSA network security leading practices recommend prohibiting the root account from logging directly into a remote system and creating a set of filtering rules, also known as an access control list, which permits the traffic identified on the list and prohibits other traffic. NSA leading practices also recommend disabling the use of insecure protocols that permit excessive access.

Although the Census Bureau had established an access control requirement based on least privilege and need-to-know principles, the bureau did not always limit user access rights and permissions to only those necessary to perform official duties. For example, unneeded administrative privileges had been granted to certain users on a key bureau infrastructure system and several of the system’s infrastructure devices were also missing access control lists to protect them from potential exploit. Such lists can be used to establish access rules that limit access to resources such as ports used to connect to the network or to a sensitive network used for system administration. However, these lists were not being used on several of the infrastructure devices we reviewed. In addition, the bureau had allowed excessive privileges to default accounts on several databases and used an insecure protocol that permitted excessive access to sensitive system files. The result of these weaknesses is an increased risk of unauthorized access to Census Bureau systems and information.

Cryptography underlies many of the mechanisms used to enforce the confidentiality and integrity of critical and sensitive information. Cryptographic tools help control access to information by making it unintelligible to unauthorized users and by protecting the integrity of transmitted or stored information. A basic element of cryptography is encryption. Encryption is the conversion of data into a form, called a cipher text, which cannot be easily understood. Encryption can be used to provide basic data confidentiality and integrity by transforming plain text into cipher text using a special value known as a key and a mathematical process known as an algorithm. NIST SP 800-53 states that agencies should use encryption to protect the confidentiality of remote access sessions and they should encrypt sessions between host systems. The NIST standard for an encryption algorithm is Federal Information Processing Standards (FIPS) 140-2. NIST SP 800-52 also recommends the use of secure socket layer certificates that are signed by a trusted certificate authority, as a means of ensuring authenticity of servers within a network.

However, Census Bureau encryption controls were not consistently implemented in accordance with these guidelines. Specifically,

Weak password encryption algorithms were used on several devices and for protocols used for the bureau’s network. The use of these weak algorithms increases the risk of passwords being compromised by brute force attacks.

Several databases did not use encryption to appropriately protect data, either while being stored or in transmission. For example, a database containing data collected and protected under Title 13 was not using advanced security features, including encryption, offered by the vendor. Several other databases also were not using encrypted communications. Without encryption, Title 13 data are more susceptible to potential disclosure.

Components of a bureau system were configured to transmit data without encryption. This creates the possibility of sensitive information being transmitted in clear text across the network, making it susceptible to interception and reuse.

The bureau made extensive use of secure socket layer certificates as a means of ensuring the authenticity of a server and establishing secure communications with the server. However, the certificates were often invalid or not signed by a trusted certificate authority. As a result, they cannot be relied on to establish a secure means of communication and the risk is increased that Title 13 data contained in the database could be compromised in transit.

To establish individual accountability, monitor compliance with security policies, and investigate security violations, it is crucial to determine what, when, and by whom specific actions have been taken on a system. Agencies can accomplish this by implementing system or security software that provides an audit trail (a log of system activity) that is used to determine the source of a transaction or attempted transaction and to monitor a user’s activities. Audit and monitoring, key components of risk management, involve the regular collection, review, and analysis of auditable events for indications of inappropriate or unusual activity, and the appropriate investigation and reporting of such activity. Automated mechanisms may be used to integrate audit monitoring, analysis, and reporting into an overall process for investigation and response to suspicious activities. Use of such mechanisms may enable near real-time continuous monitoring of critical or volatile security controls. Audit and monitoring controls can help security professionals routinely assess computer security, perform investigations during and after an attack, and even recognize an ongoing attack. Audit and monitoring technologies include network and host-based intrusion detection systems, audit logging, security event correlation tools, and computer forensics. NIST guidelines state that agencies should retain sufficient audit logs to allow monitoring of key activities, provide support for after-the-fact investigation of security incidents, and meet agency information retention requirements.

NIST and OMB guidelines emphasize the use of continuous monitoring to improve information security. Continuous monitoring of security controls employed within or inherited by the system is an important aspect of managing risk to information from the operation and use of information systems. The objective of continuous monitoring is to determine if the set of deployed security controls continues to be effective over time in light of the inevitable changes that occur to a system and within an agency. Such monitoring is intended to assist in maintaining an ongoing awareness of information security, vulnerabilities, and threats to support agency risk management decisions. The monitoring of security controls using automated support tools can help facilitate continuous monitoring.

Although the Census Bureau used various tools to help detect security breaches, such as intrusion detection systems, it did not consistently implement integrated and effective audit and monitoring controls. For example, vulnerability scans of its systems and network devices were performed in an unauthenticated manner, thus limiting the bureau’s visibility of system configurations and the usefulness of the scans. The network intrusion detection system also did not cover several key segments of the network and was running at or beyond its design capacity, which causes loss of key forensic data and an inability to detect potential events. Centralized logging of critical network services was not being performed, thus limiting the effectiveness of audit and monitoring activities. In addition, the bureau did not use real-time automated mechanisms to monitor its security posture and check for unauthorized connections of rogue devices to its network. Modern malware can spread in a matter of minutes instead of weeks or months. By not implementing a complete audit and monitoring program, the bureau faces an increased risk that it will not be able to identify weaknesses and remediate them in a timely manner, thus compromising the confidentiality, integrity, and availability of sensitive data. Table 2 describes the status of the bureau’s implementation of auditing and monitoring practices.

Physical security controls are a key component of limiting unauthorized access to sensitive information and information systems. These controls are important for protecting computer facilities and resources from espionage, sabotage, damage, and theft. They include restricting physical access to computer resources and sensitive information, usually by limiting access to the buildings and rooms in which the resources are housed and periodically reviewing access rights to ensure that access continues to be appropriate based on established criteria. Such controls include perimeter fencing, surveillance cameras, security guards, gates, locks, and environmental controls such as smoke detectors, fire alarms and extinguishers, and uninterruptible power supplies. NIST guidelines state that federal agencies should implement physical security and environmental safety controls to protect employees and contractors, information systems, and the facilities in which they are located. Furthermore, the Interagency Security Committee issues baseline sets of security measures to be implemented at all federal facilities. These baselines provide guidance to agencies on how to protect parking areas, monitor agency facilities, and identify authorized personnel.

The Census Bureau did not fully implement all applicable guidance for physical security of its information resources. The bureau did demonstrate effective physical security in several cases, including screening of visitor vehicles, intrusion detection, closed circuit television coverage, and a policy requiring the use of badges. However, implementation of these measures was not consistent across all of the facilities that we reviewed. For example, one facility routinely disabled the use of access readers, potentially allowing unauthorized access to the Census Bureau’s network and phone systems. This and other weaknesses could expose Census Bureau information resources to accidental or malicious damage, and result in the loss of protected data.

Weaknesses in Other Important Controls Increase Risk

In addition to access controls, other important controls should be in place to ensure the confidentiality, integrity, and availability of an agency’s information. These controls include policies, procedures, and techniques to (1) manage and implement system configurations, and (2) establish plans for contingencies if normal operations are disrupted. Weaknesses in these areas could increase the risk of unauthorized use, disclosure, modification, or loss of the Census Bureau’s mission-sensitive information.

Configuration management controls ensure that only authorized and fully tested software is placed in operation, software and hardware are updated, patches are applied to these systems to protect against known vulnerabilities, and changes are documented and approved. To protect against known vulnerabilities, effective procedures must be in place, appropriate software installed, and patches updated promptly. Up-to-date patch installation helps mitigate flaws in software code. An information system with inadequate configuration management controls is at an increased risk of facing significant damage and may enable malicious individuals to exploit system vulnerabilities.

The Census Bureau has documented policies and procedures for managing and implementing configuration management settings for its systems, including a policy for establishing secure configuration standards for bureau systems. However, the bureau did not always implement configuration management controls. For example, patch management practices lacked centralized oversight and control to effectively administer patches and several database servers had not been patched or were running outdated software. In addition, key communication systems were not securely configured and did not have FIPS 140-2-validated encryption and network devices were configured in a way that allowed unencrypted logins, which could allow user IDs and passwords to be compromised. Further, the bureau had not implemented the routine monitoring of its configurations for its infrastructure applications and did not document emergency changes before making them. According to the bureau, changes are verbally approved and then documented after implementation. Without proper implementation of configuration management policies and procedures and adequate security controls, the bureau’s systems are susceptible to many known vulnerabilities.

Contingency planning helps ensure that if normal operations are interrupted, network managers are able to detect, mitigate, and recover from a service disruption while preserving access to vital information.

Contingency plans detail emergency response, backup operations, and disaster recovery for information systems. These plans should be clearly documented, communicated to potentially affected staff, updated to reflect current operations, and regularly tested. NIST guidelines state that the criticality and sensitivity of computerized operations and IT resources must be predetermined. NIST guidelines also recommend that agencies develop, document, and implement plans and procedures to support contingency planning, such as a continuity of operations plan, for information systems that support the agency’s operations and assets.

The Census Bureau has satisfied several, but not all NIST contingency planning practices. For example, the bureau provided evidence that it had taken steps to actively mitigate disruptions to its primary data center through the implementation of emergency power, fire suppression, and flood mitigation measures. Additionally, the bureau stored backup copies of data for its critical systems off site at a secured location. However, the Census Bureau did not satisfy many of the other practices for contingency planning. Without an effective and complete contingency plan, an agency’s likelihood of recovering important systems in a timely manner is diminished. Table 3 describes the status of the bureau’s implementation of several of the bureau’s contingency planning practices.

A key reason for the weaknesses in controls over the Census Bureau’s information and information systems is that it has not yet implemented all elements of its agencywide information security program to ensure that controls are effectively established and maintained. FISMA requires each agency to develop, document, and implement an information security program that, among other things, includes: periodic assessments of the risk and the magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems; policies and procedures that (1) are based on risk assessments, (2) cost-effectively reduce risks, (3) ensure that information security is addressed throughout the life cycle of each system, and (4) ensure compliance with applicable requirements; security awareness training to inform personnel of information security risks and their responsibilities in complying with agency policies and procedures and information security training for personnel who have significant security responsibilities for information security; and procedures for detecting, reporting, and responding to security incidents.

Weaknesses in an information security program could increase the risk that emerging security weaknesses will not be identified and that sensitive information and assets will not be adequately safeguarded from inadvertent or deliberate misuse, improper disclosure, or destruction.

NIST guidelines call for agencies to develop a risk management framework with the goal of embedding security in the culture and systems of that agency instead of using a point-in-time tool for compliance. That framework should include an assessment of the impact those risks could have on organizational operations and an analysis of the acceptable level of risk under which the agency could absorb the resulting loss while still maintaining operation of its systems (a risk impact analysis). In addition, to monitor the effectiveness of its security controls, the agency should conduct a vulnerability assessment of its systems to ensure that security requirements for the system are being met. The results of the risk impact analysis and the effectiveness of security controls should be documented. Finally, NIST and OMB specify that federal agencies should develop remedial action plans, also known as plans of action and milestones (POA&M) that describe specific tasks and milestones for correcting security weaknesses in information systems and are used to set priorities and monitor progress in correcting the weaknesses.

The bureau’s risk management program emphasizes the following capabilities:

Risk profiles/scoring— Risk profiles are developed based on standardized questionnaires containing business and technological factors, and a risk scoring methodology to identify appropriate security controls and determine the level of risk for each control. Profiles are to incorporate the content of the system security plan and risk assessment into a single, quantitative measure of risk to facilitate risk- based decisions.

Automation—The use of automated assessments to consistently and repeatedly assess Census Bureau information systems against organizational benchmarks.

Integration with the software development life cycle—Consideration of security during system design and development to reduce postdeployment security-related changes.

Reporting—Providing routine reports to management, system owners, and authorizing officials quantifying the risk for a given information system, including potential risk, mitigated risk, risk accepted by the authorizing official, and the residual risk for the system.

Figure 3 is an example of a report generated under the new program. It shows the status of various elements in the bureau’s risk management program.

According to bureau officials, implementation of the new program will increase the emphasis on real-time monitoring of information systems, allow the bureau to prioritize limited resources to address security vulnerabilities, and provide improved awareness by bureau management of information security risks through routine and more easily understandable reporting.

While the bureau’s new program may produce these benefits, it does not yet present a complete picture of the risks to Census Bureau systems. Specifically, the bureau’s policies and NIST guidelines direct the bureau to consider both individual system controls and common controls (controls shared by multiple systems) in assessing system risk. However, the bureau’s security assessment report for its pilot system did not include an assessment of the risks associated with the specified common controls; instead, it stated that the data were not finalized and not available. Census Bureau officials said that the assessment of the common controls had not been completed under the new strategy, and thus was not reflected in the security assessment report for the system. Until the bureau clearly documents its assessment of common controls for its information systems, it may not have an accurate understanding of the risks these systems are subject to.

In addition, although the Census Bureau’s system security plans listed more than 1,200 security controls for each of the seven components of the pilot system, the assessments of those controls and the related security assessment report did not fully identify and document several vulnerabilities identified during our review. For example, the bureau was not fully enforcing session inactivity time outs for remote users and was allowing remote users to simultaneously access internal bureau networks and the Internet. Risks for these vulnerabilities were not accepted in the security assessment report used to authorize operation of the system, although the time out vulnerability was identified and accepted in a later document.

Furthermore, documentation supporting both risk-based decisions and closure of remediation plans was missing or unclear. Both NIST and Census Bureau guidance state the importance of documenting in sufficient detail whether implementation of a control effectively addresses the control requirement and the rationale for any accepted risks. However, the bureau’s documentation of key decisions was not always available, clear and complete. For example, we reviewed seven system security plans for seven pilot system components and identified 48 cases where security controls did not pass their respective control assessments, known as exceptions. Of these exceptions, the bureau chose to accept 23 exceptions and attempted to remediate 25. Of the 23 exceptions the bureau chose to accept, documentation was not provided for 7.

For the 25 exceptions the bureau attempted to remediate, the bureau initially created a POA&M for each exception to monitor the progress in correcting the weaknesses. Five of these POA&Ms remained open as of May 2012 and 20 had been closed. However, 17 of the 20 closed POA&Ms did not have documentation that demonstrated that the weaknesses had been addressed. For example, the documentation for 6 of the closed POA&Ms stated that integrity scans had been performed to address the weaknesses but the supporting evidence did not indicate that the scans had been completed. Census Bureau officials stated that the authorizing official for the pilot system chose to accept the risk from these weaknesses, but this had not been documented as part of the POA&M closure. In addition, 11 of the 20 closed POA&Ms were closed because the risk was accepted and approved by the system owner, information security representative, and authorizing official on a risk acceptance form but there was no evidence documented that mitigating controls were in place. In many cases, the bureau listed compensating controls in the risk acceptance form that mitigated the risk, but did not provide evidence that it had tested these compensating controls to assess their effectiveness. For example, an exception related to encryption stated that the system relied on the underlying operating system and network infrastructure to mitigate the issue but did not clearly explain how this was to occur.

While the bureau’s new program for risk management may produce potential benefits to the bureau, the effectiveness of its remediation efforts cannot be known unless the bureau ensures that its actions have been documented.

An entitywide information security management program is the foundation of a security control structure and a reflection of senior management’s commitment to addressing security risks. Per FISMA, the security management program should establish a framework and a continuous cycle of activity for assessing risk, developing and implementing effective security procedures, and monitoring the effectiveness of these procedures. Without a well-designed program, security controls may be inadequate; responsibilities may be unclear, misunderstood, or improperly implemented; and controls may be inconsistently applied.

The Census Bureau’s 2010 IT Security Program Policies referenced the 18 control areas that address FISMA requirements for a security management program at a high level, with the intent that detailed guidance and requirements are included in the underlying system-level documentation, according to bureau officials. However, although the bureau requires that its IT security program and policies be revised at least annually, it has not been updated since April 2010. According to bureau officials, a revision had been drafted, but its approval had been delayed, in part due to the bureau’s efforts to implement its new risk management framework. Until the Census Bureau’s IT Security Program Policies are updated and finalized, the bureau may not have assurance that controls over its information are appropriately applied to its systems and operating effectively.

FISMA mandates that federal employees and contractors who use agency information systems that support agency operations and assets be provided with training in information security awareness. Furthermore, OMB guidance states that personnel should have this training before they are granted access to systems or applications. According to FISMA and OMB, the information security awareness training should inform personnel, including contractors and other users of information systems supporting the operations and assets of an agency, of information security risks associated with their activities and their roles and responsibilities to properly and effectively implement the practices that are designed to reduce these risks. FISMA also includes requirements for training personnel who have significant responsibilities for information security. Depending on an employee’s specific security role, training could include specialized topics such as incident detection and response, physical security, or firewall configuration. NIST SP 800-53 Rev. 3 further recommends that agencies require refresher training for security awareness and role-based on an agency-defined basis, and document users’ completion of required training. In addition, Census Bureau policy requires all personnel to complete annual security awareness training and those personnel with significant network security roles and responsibilities to complete sufficient information system security training and continuing education to ensure compliance with agency policy.

Table 4 describes the implementation status of the bureau’s information security awareness and training practices. While the Census Bureau has developed and documented awareness and training policies and procedures, not all users who should have completed security awareness or role-based training did so, and the bureau’s training database did not track security awareness activities for all users. Until the Census Bureau tracks security awareness activities and enforces the completion of security awareness and role-based training for all users, the bureau does not have reasonable assurance that its employees have the adequate knowledge, skills, and abilities consistent with their roles to protect the information housed within bureau systems to which they are assigned.

Incident response controls are necessary for rapidly detecting incidents, minimizing loss and destruction, mitigating the weaknesses that were exploited, and restoring computing services. While strong controls may not prevent all incidents, agencies can reduce the risks associated with these events by detecting and promptly responding before significant damage is done. Agencies should create an incident response policy and use it as the basis for incident response procedures. The ability to identify incidents using appropriate audit and monitoring techniques enable an agency to initiate its incident response plan in a timely manner. Once an incident has been identified, an agency’s incident response processes and procedures should provide the capability to correctly log the incident, properly analyze it, and take appropriate action.

Table 5 shows the status of the bureau’s implementation of incident response practices. While the Census Bureau had policies and procedures for handling information security incidents in place, including developing a process of preparation, detection, analysis, containment, eradication, and recovery, it had only partially implemented them. Without effective processes and procedures, the bureau will have greater difficulty in detecting incidents, minimizing the resultant loss and destruction, mitigating the exploited weaknesses and restoring services.

Conclusions

The Census Bureau has taken important steps in implementing controls to protect the information and systems that support its mission. However, significant weaknesses in access controls and other information security controls exist that impair its ability to ensure the confidentiality, integrity, and availability of the information and systems supporting its mission. A key reason for many of the weaknesses is that the bureau has not yet fully implemented elements of its information security program to ensure that effective controls are established and maintained. Effective implementation of such a program includes comprehensively assessing risk, establishing appropriate policies and procedures, providing security awareness training, and responding to incidents. Until the bureau addresses identified control weaknesses and fully implements its information security program, it will have limited assurance that its information and information systems are adequately protected against unauthorized access, disclosure, modification, or loss.

Recommendations for Executive Action

To fully implement its agencywide information security program, we recommend that the Acting Secretary of Commerce direct the Under Secretary for Economic Affairs who oversees the Economics and Statistics Administration and the Acting Director of the U.S. Census Bureau to implement the following 13 recommendations. 1. Clearly document the bureau’s assessment of common controls for information systems before granting an authorization to operate. 2. Clearly document acceptance of risks and remedial actions for management review and approval before closing them. 3. Establish a deadline for updating and finalizing the bureau’s IT Security Program Policies document. 4. Fully implement the bureau’s new process for tracking employee completion of security awareness training in the database of record. 5. Enforce the requirement for annual security awareness training for all users and ensure all users complete the training. 6. Enforce the requirement that all individuals with significant security responsibilities complete both initial and refresher role-based training. 7. Provide sufficient opportunities for incident response personnel to complete required training and certifications and verify compliance. 8. Develop plans and criteria or metrics for incident response plan tests and exercises, and evaluate the effectiveness of the incident response capability. 9. Verify that incident response personnel document in the incident log the actions taken to contain, eradicate, and recover from incidents. 10. Fully develop an incident response plan by documenting metrics used for measuring the bureau’s incident response effectiveness and defining the resources and management support necessary to develop an incident response capability that meets the Census Bureau’s unique needs. 11. Ensure that all reportable incidents are reported to US-CERT. 12. Complete development of a mature digital forensics capability to better detect and validate malware incidents. 13. Develop a process to formally review incidents, gather lessons learned from ongoing incident handling activities and incorporate identified improvements into training, testing, and procedures.

In a separate report with limited distribution, we are making 102 recommendations to address the technical weaknesses related to access controls, configuration management, and contingency planning that we identified.

Agency Comments and Our Evaluation

The Acting Secretary of Commerce provided written comments from the bureau on a draft of this report on January 2, 2013 (reprinted in app. II). In its comments, the Census Bureau expressed broad agreement with the overall theme of the report but did not directly comment on the recommendations. The bureau stated that it is putting together a team from throughout the organization to carefully review each finding and prepare a specific course of action to address them. However, it raised concerns about four specific aspects of the summary of findings which GAO addressed as appropriate.

Specifically, with respect to our draft finding that the bureau had not updated and finalized its IT security program and policies document since April 2010, the bureau stated that subsequent to our field work ending in September 2012, its updated policy document was published in October 2012. The bureau stated that our finding should state that its policy is to be revised every other year, instead of annually as stated in the draft, but did not provide written documentation to support this statement. The Census Bureau’s IT Security Program Policies document, dated April 2010, that we were provided for review stated in the program management control family, which is applicable to the information security requirements for the bureau as a whole, that review and revision of the Census Bureau’s information security program plan and certain supporting policies be done annually. Accordingly, we believe our report is accurate. Further, we believe the actions taken by the bureau meet the intent of our recommendation which was to establish a deadline for updating and finalizing the bureau’s IT Security Program Policies document.

With respect to our draft finding that the bureau’s security assessment report for its pilot system did not include an assessment of the risks associated with the specified common controls, and that the data was not finalized or available, the bureau acknowledged that results of an assessment of the common controls were not presented on the risk assessment report that was provided to the authorizing official in the new risk management framework format. However, the bureau stated that it had assessed the common controls. We did not intend to imply that the bureau had not conducted an assessment of common controls only that it was not included in the security assessment report. Accordingly, we have clarified our language and recommendation in the report to better reflect this scenario.

Regarding our draft finding that the bureau’s continuous monitoring program did not include mechanisms for near real-time continuous monitoring, the bureau stated that the frequency at which it performs scans is based on the identified risk of the control or system being assessed, and that monthly scans were consistent with the risk level it had identified for Title 13 data. However, this statement is inconsistent with the risk-based continuous monitoring plans that we were provided by the bureau during our review, which called for weekly scanning in several cases. Furthermore, NIST guidelines note the importance of near real- time data as an input to an agency’s security decision-making process, and the bureau’s risk management framework documentation noted that near real-time risk monitoring is a long-term goal for the bureau. We have clarified our finding to better reflect the bureau’s continuous monitoring plans.

Finally, in responding to our draft finding that the bureau did not provide a deadline for when it would fully implement database and application scans, the bureau stated that it had provided a schedule during our fieldwork and subsequently provided another schedule intended to clarify those deadlines. However, upon review of the new schedule, it did not address deadlines for implementing database and application scans. As a result, we believe the finding is valid.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until 30 days from the date of this letter. At that time, we will send copies to the Acting Secretary of Commerce, the Acting Director of the U.S. Census Bureau, and interested congressional committees. In addition, the report will be available at no charge on GAO’s website at http://www.gao.gov.

If you have any questions about this report, please contact Gregory C. Wilshusen at (202) 512-6244 or Dr. Nabajyoti Barkakati at (202) 512- 4499. We can also be reached by e-mail at wilshuseng@gao.gov or barkakatin@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix III.

Appendix I: Objective, Scope, and Methodology

The objective of our review was to determine whether the Census Bureau effectively implemented appropriate information security controls to protect the confidentiality, integrity, and availability of the information and systems that support its mission.

To determine the effectiveness of the bureau’s security controls, we gained an understanding of the overall network control environment, identified interconnectivity and control points, and examined controls for the agency’s networks and facilities. Specifically, we reviewed controls over the bureau’s network infrastructure and systems that support its handling of information collected and protected pursuant to Title 13. We performed our work at the bureau headquarters in Suitland, Maryland, at the Bowie Computing Center in Bowie, Maryland, and at the National Processing Center in Jeffersonville, Indiana.

We selected 12 systems for review. We initially focused on systems that contained Title 13 data screened for public release as well as systems that had private or potentially sensitive data. However, during our review, we discovered that some systems included portions of others due to the interconnected nature of the bureau’s environment, so we included those systems in our scope as well.

To evaluate the bureau’s controls over its information systems, we used our Federal Information System Controls Audit Manual, which contains guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized information; National Institute of Standards and Technology (NIST) standards and guidelines; bureau policies, procedures, practices, and standards; and standards and guidelines from relevant security and IT security organizations, such as the National Security Agency, Center for Internet Security, and Interagency Security Committee. Where applicable, we assessed the status according to how completely the bureau’s policies and practices aligned with the guidance. In these cases, we assigned ratings of “implemented”, “partially implemented”, or “not implemented” based on that assessment. A rating of “partially implemented” was given if the bureau’s activities satisfied at least one component of the relevant standards and guidelines. reviewed network access paths to determine if boundaries had been adequately protected; reviewed the complexity and expiration of password settings to determine if password management was being enforced; analyzed users’ system authorizations to determine whether they had more permissions than necessary to perform their assigned functions; observed configurations for providing secure data transmissions across the network to determine whether sensitive data were being encrypted; reviewed software security settings to determine if modifications of sensitive or critical system resources had been monitored and logged; reviewed the Census Bureau’s implementation of continuous monitoring and use of automated tools to determine the extent to which it uses these tools to manage IT assets and monitor the security configurations and vulnerabilities for its IT assets; observed physical access controls to determine if computer facilities and resources were being protected from espionage, sabotage, damage, and theft; examined configuration settings and access controls for routers, network management servers, switches, and firewalls; inspected key servers and workstations to determine if critical patches had been installed and/or were up to date; and examined polices, and procedures, and implementation of controls related to segregation of duties.

Using the requirements identified by the Federal Information Security Management Act of 2002, which establishes key elements for an effective agencywide information security program, and associated NIST guidelines and bureau requirements, we evaluated the Census Bureau’s information security program by: analyzing processes and documentation that were part of the bureau’s new risk management framework implementation to determine the extent to which it accurately characterized information security risks; analyzing bureau policies, procedures, practices, and standards to determine their effectiveness in providing guidance to personnel responsible for securing information and information systems, including areas such as segregation of duties; examining the security awareness training process for employees and contractors to determine whether they had received training according to federal requirements; examining training records for personnel who have significant responsibilities to determine whether they had received training commensurate with those responsibilities; and reviewing bureau policies and procedures and a selection of information security incidents to determine the extent to which bureau incident handling practices complied with applicable NIST guidelines and federal requirements. We selected 24 incidents for detailed review based on our initial examination of 1,015 incidents that the bureau logged between Jan. 4, 2010 and Feb. 8, 2012. We selected a non-generalizable, judgmental sample of 8 incidents from each of the following 3 categories: incidents still open, incidents closed based on information not in the log, and incidents which, based on the log data, appeared as if they may not have been handled in accordance with bureau policies or procedures or NIST guidelines.

As part of our review of the bureau’s agencywide information security program, we reviewed several sources of computer-generated data. These included the bureau’s: inventory of information systems, plans of action and milestones for identified information security annual IT security training completion data, role-based training for individuals with significant security responsibilities, and log of information security incidents.

To verify the reliability of the data in these systems, we examined it for obvious outliers, omissions, and errors. We also verified a selection of individual records for accuracy and completeness, and verified our analysis of the information with agency officials. We determined that these sources of data were sufficiently reliable for our purposes.

We conducted this performance audit from January 2012 through January 2013 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Appendix II: Comments from the Department of Commerce

Appendix III: GAO Contacts and Staff Acknowledgments

Contacts

Staff Acknowledgments

In addition to the individuals named above, the following made key contributions to this report: Ed Alexander, West Coile, Vijay D’Souza, Duc Ngo, and Chris Warweg (assistant directors), Angela Bell, Saar Dagani, Nancy Glover, Thomas J. Johnson, Myong Kim, Vernetta Marquis, Justin Palk, John Spence, and Eugene Stevens.