LANL is responsible for planning and executing all facets of stockpile stewardship, including assessing, refurbishing, and certifying nuclear weapons. The laboratory operates and manages numerous nuclear facilities. Critical activities include plutonium, uranium, and tritium processing; research and development on special nuclear material; high- energy radiography; radiation measurement; packaging of nuclear materials; and the management of radioactive and hazardous waste. To help carry out these critical missions, LANL uses its unclassified and classified computer networks to manage its business operations, conduct nonnuclear experiments, and analyze nuclear weapons and their delivery systems to meet requirements established by the Department of Defense. Protecting the computer systems that support LANL’s operations has never been more important. Government officials are increasingly concerned about attacks from individuals and groups with malicious intent, such as terrorists and foreign intelligence agencies. These concerns are well-founded for a number of reasons, including the dramatic increase in the reports of security incidents in the United States and the steady advance in the sophistication and effectiveness of attack technologies. As the nation’s defense and intelligence communities increasingly rely on commercially available information technology, the likelihood increases that information attacks will threaten vital national interests. A basic management objective for any organization is to protect the resources that support its critical operations from unauthorized access, use, destruction, or disruption. Organizations accomplish this objective by designing and implementing controls that are intended to, among other things, prevent, limit, and detect unauthorized access to computing resources, programs, information, and facilities. Inadequate security controls diminish the reliability of computerized information and increase the risk of unauthorized disclosure, modification, and destruction of sensitive information and disruption of service. Security controls include those related to user identification and authentication, cryptography, audit and monitoring, configuration management, and physical security. LANL has implemented measures to enhance its information security, but weaknesses remain. In particular, LANL has implemented a network security system that can detect potential intrusions on the network. However, LANL has vulnerabilities in several critical areas, including (1) identifying and authenticating users, (2) encrypting sensitive information, (3) monitoring and auditing compliance with security policies, (4) controlling and documenting changes to a computer system’s hardware and software, and (5) restricting physical access to computing resources. A computer system must be able to identify and authenticate different users so that activities on the system can be linked to specific individuals. When an organization assigns unique user accounts to specific users, the system is able to distinguish one user from another—a process called identification. The system also must establish the validity of a user’s claimed identity by requesting some kind of information, such as a password, that is known only by the user—a process known as authentication. The combination of identification and authentication— such as user account/password combinations—provides the basis for establishing individual accountability and for controlling access to the system. As NIST notes, multifactor authentication schemes are stronger than single factor authentication. In keeping with this standard, LANL’s password policy requires that one-time passcodes (using token cards and personal identification numbers (PIN), i.e., two-factor authentication) be used whenever possible or practical. It further states that users are not to share passwords and that vendor-supplied default passwords must be changed immediately. LANL had implemented a strong authentication solution for its network through the use of two-factor authentication with a one-time password— use of a token (cryptocard); a PIN; and a one-time number code. However, strong authentication was not always used. Once a user successfully accessed the network, the user could create a separate login password that would allow alternative access to sensitive information on the unclassified network. Such access was allowed for file sharing and e-mail. Furthermore, users shared default identifications and passwords for managing certain network devices. As a result, LANL was at increased risk that unauthorized users could access sensitive information in files and e- mails, as well as obtain access to network devices. Cryptography underlies many of the mechanisms used to enforce the confidentiality and integrity of critical and sensitive information. A basic element of cryptography is encryption. The National Security Agency recommends disabling protocols that do not encrypt information, such as user identification and password combinations transmitted across the network. Although LANL had implemented cryptography, it was not always effective or used in transmitting sensitive information. LANL integrated Kerberos with its authentication process. Kerberos is designed to provide strong authentication for client/server applications by using secret-key cryptography so that each party can prove its identity across an insecure network connection. However, the laboratory relied on a Kerberos implementation that uses a weak and outdated encryption algorithm. Furthermore, LANL neither uses encryption to protect certain network management connections, nor requires encryption for authentication to certain internal services. Instead, the laboratory used clear text protocols (i.e., unencrypted) to manage key network devices, such as internal firewalls and switches. As a result, sensitive data transmitted through the unclassified network is at an increased risk of being compromised. To establish individual accountability, monitor compliance with security policies, and investigate security violations, it is crucial to determine who has taken actions on the system, what these actions were, and when they were taken. According to NIST, when performing vulnerability scans, greater emphasis should be placed upon systems that are accessible from the Internet (e.g., Web and e-mail servers); systems that house important or sensitive applications or data (e.g., databases); or network infrastructure components (e.g., routers, switches, and firewalls). In addition, according to commercial vendors, running scanning software in an authenticated mode allows the software to detect additional vulnerabilities. NIST also states that the use of secure software development techniques, including source code review, is essential to preventing a number of vulnerabilities from being introduced into items such as a Web service. Although LANL regularly monitored its unclassified network for security vulnerabilities, the monitoring is not comprehensive. LANL frequently scans its network using multiple software tools that search for known vulnerabilities on various network devices. However, the scans were not comprehensive. For example, at the time of our review, the laboratory’s vulnerability scan neither included sensitive applications such as databases, nor did it run in an authenticated mode. In addition, LANL did not conduct source code reviews. As a result, the laboratory may not detect certain vulnerabilities, leaving the network at increased risk of compromise or disruption. The purpose of configuration management is to establish and maintain the integrity of an organization’s work products. Organizations can better ensure that only authorized applications and programs are placed into operation by establishing and maintaining baseline configurations and monitoring changes to these configurations. Configuration management involves ensuring the correctness of the security settings in the operating systems, applications, or computing and network devices, and securely maintaining operations. Patch management, a component of configuration management, is important for mitigating software vulnerability risks. When software vulnerabilities are discovered, the software vendor may develop and distribute a patch or work-around to mitigate the vulnerability. NIST recommends that organizations have an explicit and documented patching policy and a systematic, accountable, and documented process for installing and testing patches. In addition, LANL policy requires that all Windows-based systems on the unclassified network participate in a patch management system. In addition to patch management, to further protect an organization’s systems, such as from malicious e-mails, NIST states that organizations should determine which types of attachments to allow and to block potentially dangerous ones. Although LANL had implemented innovative techniques to maintain its system configuration and install patches, shortcomings existed in the patch process. The laboratory used an automated tool to configure and maintain its Unix servers, and deployed a tool to its Windows systems to track and implement patches on the majority of systems we reviewed. It also used its vulnerability scanning tools to verify the latest patch levels of Windows systems. However, LANL did not always consistently implement or appropriately test these patches. For example, LANL had not applied a critical operating system patch or patches for a number of general third- party applications. As a result, LANL cannot ensure that all needed patches are applied to critical system resources or that untested patches will not have unintentional consequences, increasing the risk of exposing critical and sensitive unclassified data to unauthorized access. Furthermore, although the laboratory had configured its e-mail system to prevent many common cyber attacks, it was still vulnerable to attack because the system allowed various file types as e-mail attachments. These files could be used to install malicious software onto an unsuspecting user’s workstation, potentially compromising the unclassified network. Physical security controls are important for protecting computer facilities and resources from espionage, sabotage, damage, and theft. These controls restrict physical access to computer resources, usually by limiting access to the buildings and rooms in which the resources are housed and by periodically reviewing the access granted in order to ensure that it continues to be appropriate. NIST requires that federal organizations control all physical access points (including designated entry/exit points) to facilities containing information systems (except for those areas within the facilities officially designated as publicly accessible) and verify individual access authorizations before granting access to the facilities. In addition, NIST requires that federal agencies control physical access to information system transmission lines to prevent eavesdropping, in-transit modification, disruption, or physical tampering, and that these agencies protect power equipment for information systems from damage or destruction. Furthermore, LANL policy requires that access to exclusion areas that house sensitive information technology (IT) resources and the equipment that supports these resources be limited to authorized personnel. LANL has various protections in place for its IT resources. It effectively secures many of its sensitive areas and computer equipment and takes other steps to provide physical security. For example, LANL issued electronic badges and employed hand geometry devices to help control access to many of its sensitive and restricted areas.