Established by the Communications Act of 1934, FCC regulates interstate and international communications by radio, television, wire, satellite, and cable. It is responsible for, among other things, making available rapid, efficient, nationwide, and worldwide wire and radio communication services at reasonable charges and on a nondiscriminatory basis, and more recently, promoting competition and reducing regulation of the telecommunications industry in order to secure lower prices and higher quality services for consumers. FCC is charged with carrying out various activities, including issuing licenses for broadcast television and radio; overseeing licensing, enforcement, and regulatory functions of carriers of cellular phones and other personal communication services; regulating the use of radio spectrum and conducting auctions of licenses for spectrum; investigating complaints and taking enforcement actions if it finds that there have been violations of the various communications laws and commission rules that are designed to protect consumers; addressing public safety, homeland security, emergency management, and preparedness; educating and informing consumers about communications goods and services; and reviewing mergers of companies holding FCC-issued licenses. FCC’s basic structure is prescribed by statute. It is composed of five commissioners, appointed by the President with the advice and consent of the Senate to serve 5-year terms. No more than three commissioners The President designates one of may come from any one political party.the commissioners as chairman. The chairman derives authority from the provisions of the Communications Act and FCC rules which define the chairman’s duties to include, among other things, presiding at all meetings and sessions of the commission, representing the commission in all matters relating to legislation and before other government offices, and generally organizing and coordinating the work of the commission. The commissioners delegate many of FCC’s day-to-day responsibilities to the commission’s 7 bureaus and 10 offices. The chairman also delegates management and administrative responsibilities, including IT, to FCC’s Office of the Managing Director. The FCC relies extensively on computerized systems to support its mission-related operations in addition to information security controls to protect agency data. The use of IT to implement the commission’s business operations is performed by FCC’s Information Technology Center which is organizationally placed within the Office of the Managing Director. Through its computer network and systems, the FCC collects and maintains non-public information, including proprietary information of businesses regulated by the commission. In an effort to meet federal information security requirements and address implementing guidance, the Managing Director established a cybersecurity program and delegated key information security responsibilities to the commission’s Chief Information Officer (CIO). The CIO is responsible for, among other things: overseeing the development and maintenance of the cybersecurity program; designating and assigning responsibility to the FCC’s Chief Information Security Officer (CISO) for managing the program; coordinating with the Managing Director to ensure provision of adequate budget, staffing, and training resources required to implement the program; and evaluating and approving CISO-recommended resolution of issues related to cybersecurity. Information security is critical for any organization that depends on information systems and computer networks to carry out its mission or business. It is especially important for government agencies, such as the FCC, where maintaining the public’s trust is essential. While the use of interconnected electronic information systems allows FCC to accomplish its mission more quickly and effectively, their use also poses significant risks to the commission’s computer systems and to the critical operations they support. We have previously reported on the increasing number of cybersecurity attacks affecting federal information systems. Consistent with this, reports of security incidents from federal agencies are on the rise. Federal agencies have reported increasing numbers of security incidents that placed sensitive information at risk, with potentially serious impacts on federal operations, assets, and people. Over the past 6 years, the number of incidents reported by federal agencies to the United States Computer Emergency Readiness Teamyear 2006 to 48,563 incidents in fiscal year 2012, an increase of more than 780 percent. Accordingly, we have designated information security increased from 5,503 incidents in fiscal as a governmentwide high risk area since 1997, a designation that remains in force today. Without proper safeguards, systems are vulnerable to individuals and groups with malicious intent who can intrude and use their access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. In September 2011, the FCC discovered that it had suffered a security breach on its agency network. FCC’s actions to respond to the incident included, among other things, identifying and removing infected workstations and identifying significant factors that increased risk to its network. FCC initiated the ESN project in order to continue its response to the incident, mitigate the risk to its information resources from the malicious software, reduce the risk of a successful future attack, and address weaknesses in its security controls and network architecture. To execute this project, in November 2011, FCC requested and received approval from the Office of Management and Budget to use $10 million in previously deobligated funds and gained congressional agreement with the reprogramming plan in December 2011, contingent upon the commission providing Congress with quarterly briefings on the project’s status until completion. The ESN project includes two major efforts: (1) implementing enhanced security controls, and (2) designing and implementing a sustainable cyber threat analysis and mitigation program. Enhanced security controls. The project is intended to enhance and augment FCC’s existing security controls through changes to the network architecture and by implementing, among other things, additional intrusion detection tools, network firewalls, and audit and monitoring tools. Cyber threat analysis and mitigation. In addition to enhancing security controls, the ESN project aims to develop a sustainable cyber threat analysis and mitigation program that is to include risk management guidelines for assessing security threats and subsequent mitigation strategies. This effort is intended to provide FCC with mechanisms to analyze the criticality of commission assets, assess the likelihood that threats will endanger assets, and identify actions to reduce those risks and mitigate the consequences of an attack. In January 2012, FCC officials briefed congressional staff on its development plans for the ESN project, including, among other things, the planned schedule for acquiring and implementing new hardware and enhanced security controls and for instituting a cyber threat analysis and mitigation program in multiple phases over a 1-year period, from February 1, 2012, to January 31, 2013. The reprogrammed funds were made available for the project in February 2012, and FCC subsequently purchased equipment and engaged a prime contractor for the project in April 2012. FCC entered the project’s system development phase in April 2012, received final delivery of hardware in June 2012, and deployed the initial components of the project by the end of July 2012. This included making changes to the network architecture to enhance protection for an initial portion of the commission’s executives and their key staff. Officials stated that activities to deploy enhanced protections for all users at FCC headquarters are projected to be completed in February 2013, and that these protections will be expanded to the commission’s field offices at a later date. To protect against and detect cyber attacks, FCC also deployed a malware protection system for its network and a tool to monitor its workstations for signs of compromise. Figure 1 depicts the project timeline from the discovery of the security incident through the projected date of completion for the ESN project. FCC did not effectively implement appropriate information security controls in the initial components of the ESN project. Although the commission deployed enhanced security controls and tools for monitoring and controlling security threats as of August 2012, it had not securely configured these tools and other network devices to sufficiently protect the confidentiality, integrity, and availability of its sensitive information. These weaknesses occurred, at least in part, because FCC did not fully perform key security risk management activities during the development and deployment of the ESN project. As a result, FCC limited the effectiveness of its security enhancements and its sensitive information remained at unnecessary risk of inadvertent or deliberate misuse, improper disclosure, or destruction. A basic management objective for any organization is to protect confidentiality, integrity, and availability of the information and systems that support its critical operations and assets. Organizations accomplish this by designing and implementing access and other controls that are intended to protect information and systems from unauthorized disclosure, modification, and loss. Specific controls include, among other things, those related to system boundary protections, identification and authentication of users, authorization restrictions, cryptography, audit and monitoring procedures, and configuration management. NIST guidance recommends, among other things, that organizations should (1) control and regulate the information transmitted between interconnected systems; (2) ensure that passwords are encrypted while being stored; and (3) employ tools and techniques to monitor events on information systems, detect attacks, and provide identification of unauthorized use of systems. The initial components of the project included making changes to the network architecture to better protect the commission’s executives and their key staff. In addition, the commission deployed a malware protection system on its network and a tool to monitor its workstations for signs of compromise. However, FCC did not effectively implement or securely configure key security tools and devices to protect these users and its information against cyber attacks. For example: Certain boundary protection controls were configured in a manner that limited the effectiveness of network monitoring controls. Stored passwords were not always strongly encrypted on network devices. Although a malware protection tool had been implemented to detect and prevent cyber attacks, the tool’s capabilities for preventing certain attacks were not fully implemented. As a result of these and other deficiencies, FCC faces an unnecessary risk that individuals could gain unauthorized access to its sensitive systems and information. In addition to the above deficiencies, we identified other security weaknesses in controls related to boundary protection, identification and authentication, authorization, cryptography, audit and monitoring, and configuration management that limit the effectiveness of the security enhancements and unnecessarily place sensitive information at risk of unauthorized disclosure, modification, or exfiltration. The control weaknesses we identified during this review are described in a separate report with limited distribution.