Information security is critical for any organization that depends on information systems and computer networks to carry out its mission or business. It is especially important for government agencies, where the public’s trust is essential. The dramatic expansion in computer interconnectivity and the rapid increase in the use of the Internet are changing the way our government, the nation, and much of the world communicate and conduct business. Without proper safeguards, systems are vulnerable to individuals and groups with malicious intent who can intrude and use their access to obtain sensitive information, commit fraud, disrupt operations, or launch attacks against other computer systems and networks. These concerns are well founded for a number of reasons, including a dramatic increase in reports of security incidents, ease of obtaining and using hacking tools, a steady advance in the sophistication and effectiveness of attack technology, and dire warnings of new and more destructive attacks to come. Computer-supported federal operations are similarly at risk. Our previous reports, and those of agency inspectors general, describe persistent information security weaknesses that place a variety of federal operations at risk of disruption, fraud, or inappropriate disclosure of sensitive data. We have designated information security as a governmentwide high-risk area since 1997—a designation that remains today. Recognizing the importance of securing federal agencies’ information systems, Congress enacted the Federal Information Security Management Act (FISMA) in December 2002 to strengthen the security of information and systems within federal agencies. FISMA requires each agency, using a risk-based approach to information security management, to develop, document, and implement an agency-wide information security program to provide information security for the information and systems that support the operations and assets of the agency—including those operated or maintained by contractors or others on behalf of the agency. The Federal Bureau of Investigation (FBI), which is a component of the Department of Justice (DOJ), has mission responsibilities that include investigating serious federal crimes, protecting the nation from foreign intelligence and terrorist threats, and assisting other law enforcement agencies. Over 12,000 special agents and 16,000 analysts and mission support personnel are located in the bureau’s Washington, D.C., headquarters and in more than 70 offices in the United States and 50 offices in foreign countries. Mission responsibilities at the bureau are divided among the following five major organizational components. Administration: manages the bureau’s personnel programs, budgetary and financial services, records, information resources, and information security. National Security: integrates investigative and intelligence activities against current and emerging national security threats, and provides information and analysis for the national security and law enforcement communities. Criminal Investigations: investigates serious federal crimes and probes federal statutory violations involving exploitation of the Internet and computer systems. Law Enforcement Services: provides law enforcement information and forensic services to federal, state, local, and international agencies. Office of the Chief Information Officer: develops the bureau’s information technology strategic plan and operating budget and develops and maintains technology assets. The organizational components are further organized into subcomponents, such as divisions, offices, and other groups. The FBI Security Division, within the Administration component, and the Office of the Chief Information Officer collaborated to establish information security initiatives. One initiative included the establishment of the Enterprise Security Operations Center (ESOC), which monitors and protects FBI’s systems from external attacks and insider misuse and ensures the availability, confidentiality, and nonrepudiation of FBI information. A second initiative was the deployment of a Public Key Infrastructure, which provided strong authentication of users’ identification to applications. To execute its mission responsibilities, FBI relies extensively on information technology. The bureau operates and maintains hundreds of computerized systems, networks, databases, and applications. Recognizing the need to modernize its computer systems and networks, FBI proposed a major technology upgrade plan to Congress in September 2000. The Information Technology Upgrade Project, which FBI subsequently renamed Trilogy, was FBI’s largest automated information systems modernization initiative to date. Trilogy consisted of three parts: (1) the information presentation component to upgrade computer hardware and software, (2) the transportation network component to upgrade the communication network, and (3) the user application component to upgrade and consolidate the most important investigative applications. FBI completed the first two components—the information presentation and the transportation network—in April 2004, upgrading its information technology infrastructure with new desktop computers and deploying a wide area network to enhance electronic communication among offices and with other law enforcement organizations. The data traversing the network includes privacy act and sensitive investigative information. FBI information system security weaknesses have been exploited by insiders in the past. The U.S. Secret Service, along with CERT® Coordination Center, studied insider threats, and stated in a May 2005 report that “insiders pose a substantial threat by virtue of their knowledge of, and access to, employer systems and/or databases.” The espionage of Robert Hanssen, a former FBI agent, illustrated how an insider can take advantage of inadequacies in the bureau’s information system security controls. After discovery of Hanssen’s espionage, in 2001, the Attorney General commissioned an outside review of FBI’s security program. The commission found significant deficiencies in bureau information security policies and practices, in areas such as certification and accreditation (C&A), physical security, security awareness training, access control, and auditing. The report stated that those deficiencies flow from a pervasive inattention to security, which had been at best a low priority. Additionally, shortly after Hanssen’s arrest in 2001, the Senate Select Committee on Intelligence and the Attorney General requested that the DOJ Office of Inspector General (OIG) review FBI’s performance in deterring, detecting, and investigating the espionage activities. The report pointed out that the agent exploited serious weaknesses in FBI’s information security and made a specific recommendation on detecting improper computer usage and enforcing “need to know”—granting access only when it is an operational necessity. According to agency officials, the bureau is addressing this and other recommendations. The objective of our review was to determine whether the FBI has effectively implemented appropriate information security controls on a critical internal network, deployed as part of the Trilogy modernization effort, to protect the confidentiality, integrity, and availability of its law enforcement and investigative information. To evaluate the effectiveness of the security controls over this critical network, we examined routers, network management servers, switches, firewalls, and controlled interfaces at FBI headquarters. Our evaluation was based on (1) our Federal Information System Controls Audit Manual, which provides guidance for reviewing information system controls that affect the confidentiality, integrity, and availability of computerized data; (2) previous reports from the DOJ OIG; and (3) the Federal Information Security Management Act, which establishes key elements that are required for an effective information security program. Specifically, we evaluated information system controls that are intended to limit, detect, and monitor access to sensitive network computing resources, thereby safeguarding them from misuse and protecting them from unauthorized disclosure and modification; encrypt sensitive data on the network; prevent the introduction of unauthorized changes to application or system protect physical access to network resources; and ensure completion of appropriate background investigations of bureau personnel with privileged access on the network. In addition, we evaluated FBI’s information security program as it related to the network operating environment. Such a program includes key activities such as assessing risk; developing and implementing policies, procedures, and security plans; providing security awareness and training; testing and evaluating control effectiveness; planning, implementing, evaluating, and documenting remedial actions to address information security deficiencies; and ensuring continuity of operations. To evaluate these controls and activities, we identified and examined pertinent DOJ and FBI security policies and procedures. In addition, to determine whether network security controls were in place, adequately designed, and operating effectively, we conducted vulnerability assessments of the network’s key servers, routers, and switches. These assessments included discussions with agency staff to gain an understanding of FBI’s processes and controls. In order to take advantage of prior work in this area, we also held discussions with OIG staff and reviewed information security reports pertaining to FBI networks and information systems. We performed our review at FBI headquarters in Washington, D.C., from March 2006 through December 2006 in accordance with generally accepted government auditing standards. Weaknesses existed in certain access controls and other controls intended to protect the confidentiality, integrity, and availability of the law enforcement and investigative information transmitted by a critical internal network. Our review of the network revealed weaknesses in access controls and patch management. A key reason for these weaknesses was that, although FBI had developed an information security program, it had not effectively or fully implemented key activities of this program for the network. As a result, sensitive data traversing this network were vulnerable to unauthorized access, disclosure, and modification and these weaknesses could lead to disruptions in FBI operations. A basic management objective for any organization is to protect the resources that support its critical operations from unauthorized access. Organizations accomplish this objective by designing and implementing controls that are intended to prevent, limit, and detect unauthorized access to computing resources, programs, and information. Access controls include those related to network devices and services, user identification and authentication, authorization, cryptography, audit and monitoring of security-related events, and physical access to information resources. Inadequate controls diminish the reliability of computerized information and increase the risk of unauthorized disclosure, modification, and destruction of sensitive information, and of disruption of service. Specific examples associated with the weaknesses reported below are described in more detail in a classified version of this report. Networks are collections of interconnected computer systems and devices that allow individuals to share resources, such as computer programs and information. Because sensitive programs and information are stored on or transmitted along networks, effectively securing networks is essential to protecting computing resources and data from unauthorized access, manipulation, and use. Organizations secure their networks, in part, by installing and configuring network devices that permit authorized network service requests, deny unauthorized requests, and limit the services that are available on the network.