Information Security
Federal Agencies Show Mixed Progress in Implementing Statutory Requirements Gao ID: GAO-06-527T March 16, 2006For many years, GAO has reported that ineffective information security is a widespread problem that has potentially devastating consequences. In its reports to Congress since 1997, GAO has identified information security as a governmentwide high-risk issue--most recently in January 2005. Concerned with accounts of attacks on commercial systems via the Internet and reports of significant weaknesses in federal computer systems that make them vulnerable to attack, Congress passed the Federal Information Security Management Act of 2002 (FISMA), which permanently authorized and strengthened the federal information security program, evaluation, and reporting requirements established for federal agencies. This testimony discusses the federal government's progress and challenges in implementing FISMA, as reported by the Office of Management and Budget (OMB), the agencies, and the Inspectors General (IGs), and actions needed to improve FISMA reporting and address underlying information security weaknesses.
In its fiscal year 2005 report to Congress, OMB discusses progress in implementing key information security requirements, but at the same time cites challenging weaknesses that remain. The report notes several governmentwide findings, such as the varying effectiveness of agencies' security remediation processes and the inconsistent quality of agencies' certification and accreditation (the process of authorizing operation of a system, including the development and implementation of risk assessments and security controls). Nevertheless, fiscal year 2005 data reported by 24 major agencies, compared with data reported for the previous 2 fiscal years, show that these agencies have made steady progress in certifying and accrediting systems, although they reported mixed progress in meeting other key statutory information security requirements. For example, agencies reported that only 61 percent of their systems had tested contingency plans, thereby reducing assurance that agencies will be able to recover from the disruption of those systems with untested plans. Federal entities can act to improve the usefulness of the annual FISMA reporting process and to mitigate underlying information security weaknesses. OMB has taken several actions to improve FISMA reporting--such as requiring agencies to provide performance information based on the relative importance or risk of the systems--and can further enhance the reliability and quality of reported information. Agencies also can take actions to fully implement their FISMA-mandated programs and address the weaknesses in their information security controls. Such actions include completing and maintaining accurate inventories of major systems, prioritizing information security efforts based on system risk levels, and strengthening controls that are to prevent, limit, and detect access to the agencies' information and information systems.
GAO-06-527T, Information Security: Federal Agencies Show Mixed Progress in Implementing Statutory Requirements
This is the accessible text file for GAO report number GAO-06-527T
entitled 'Information Security: Federal Agencies Show Mixed Progress in
Implementing Statutory Requirements' which was released on March 17,
2006.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
United States Government Accountability Office:
GAO:
Testimony:
Before the House Committee on Government Reform:
For Release on Delivery:
Expected at 10:00 a.m. EST Thursday, March 16, 2006:
Information Security:
Federal Agencies Show Mixed Progress in Implementing Statutory
Requirements:
Statement of Gregory C. Wilshusen, Director, Information Security
Issues:
GAO-06-527T:
GAO Highlights:
Highlights of GAO-06-527T, a testimony to the House Committee on
Government Reform:
Why GAO Did This Study:
For many years, GAO has reported that ineffective information security
is a widespread problem that has potentially devastating consequences.
In its reports to Congress since 1997, GAO has identified information
security as a governmentwide high-risk issue”most recently in January
2005.
Concerned with accounts of attacks on commercial systems via the
Internet and reports of significant weaknesses in federal computer
systems that make them vulnerable to attack, Congress passed the
Federal Information Security Management Act of 2002 (FISMA), which
permanently authorized and strengthened the federal information
security program, evaluation, and reporting requirements established
for federal agencies.
This testimony discusses:
* The federal government‘s progress and challenges in implementing
FISMA, as reported by the Office of Management and Budget (OMB), the
agencies, and the Inspectors General (IGs).
* Actions needed to improve FISMA reporting and address underlying
information security weaknesses.
What GAO Found:
In its fiscal year 2005 report to Congress, OMB discusses progress in
implementing key information security requirements, but at the same
time cites challenging weaknesses that remain. The report notes several
governmentwide findings, such as the varying effectiveness of agencies‘
security remediation processes and the inconsistent quality of
agencies‘ certification and accreditation (the process of authorizing
operation of a system, including the development and implementation of
risk assessments and security controls). Nevertheless, fiscal year 2005
data reported by 24 major agencies, compared with data reported for the
previous 2 fiscal years (see fig.), show that these agencies have made
steady progress in certifying and accrediting systems, although they
reported mixed progress in meeting other key statutory information
security requirements. For example, agencies reported that only 61
percent of their systems had tested contingency plans, thereby reducing
assurance that agencies will be able to recover from the disruption of
those systems with untested plans.
Federal entities can act to improve the usefulness of the annual FISMA
reporting process and to mitigate underlying information security
weaknesses. OMB has taken several actions to improve FISMA
reporting”such as requiring agencies to provide performance information
based on the relative importance or risk of the systems”and can further
enhance the reliability and quality of reported information. Agencies
also can take actions to fully implement their FISMA-mandated programs
and address the weaknesses in their information security controls. Such
actions include completing and maintaining accurate inventories of
major systems, prioritizing information security efforts based on
system risk levels, and strengthening controls that are to prevent,
limit, and detect access to the agencies‘ information and information
systems.
Reported Data for Selected Performance Measures for 24 Major Agencies
[See PDF for image]
[End of figure]
www.gao.gov/cgi-bin/getrpt?GAO-06-527T.
To view the full product, including the scope and methodology, click on
the link above. For more information, contact Gregory C. Wilshusen at
(202) 512-6244 or wilshuseng@gao.gov.
[End of section]
Mr. Chairman and Members of the Committee:
I am pleased to be here today to discuss the state of federal
information security and the efforts by federal agencies to implement
requirements of the Federal Information Security Management Act of 2002
(FISMA).[Footnote 1] For many years, we have reported that poor
information security is a widespread problem that has potentially
devastating consequences.[Footnote 2] Since 1997, we have identified
information security as a governmentwide high-risk issue in reports to
Congress.[Footnote 3] Concerned with accounts of attacks on commercial
systems via the Internet and reports of significant weaknesses in
federal computer systems that made them vulnerable to attack, Congress
passed FISMA, which permanently authorized and strengthened the federal
information security program, evaluation, and reporting requirements
established for federal agencies.
In my testimony today, I will summarize our analysis of the reported
status of the federal government's implementation of FISMA. I will note
areas where the agencies have made progress in implementing the
requirements of the Act and those areas where weaknesses remain. I will
also touch on additional actions that federal entities can take to help
fully implement the mandated information security programs and to
improve the effectiveness of information security controls.
In conducting this work, we reviewed and summarized OMB's fiscal year
2005 report to Congress on FISMA implementation, dated March 1, 2006.
We also analyzed and summarized the fiscal year 2005 FISMA reports from
24 major federal agencies[Footnote 4] and their inspectors general
(IGs). In addition, we reviewed standards and guidance issued by OMB
and the National Institute of Standards and Technology (NIST) pursuant
to their responsibilities under the Act. We did not validate the
accuracy of the data reported by the agencies or OMB, but we did
analyze the IGs' fiscal year 2005 FISMA reports to identify any issues
related to the accuracy of agency-reported information. Finally, we
examined and summarized key findings of related GAO products. We
performed our work from October 2005 to March 2006 in accordance with
generally accepted government auditing standards.
Results in Brief:
In its fiscal year 2005 report to Congress, OMB noted that the federal
government has made progress in meeting key performance measures for
information security; however, uneven implementation of security
efforts has left weaknesses in several areas. OMB identified weaknesses
with the extent of agencies' oversight of contractor systems, testing
of security controls, and reporting of security incidents, as well as
the quality of agencies' plans of action and milestones and
certification and accreditation processes. The report presented a plan
of action that OMB is pursuing with federal agencies to improve their
management of information security.
The fiscal year 2005 reports submitted by the agencies present a mixed
picture of FISMA implementation in the federal government. In their
fiscal year 2005 reports, 24 major federal agencies generally reported
an increasing number of systems meeting key information security
performance measures, such as percentage of systems certified and
accredited and percentage of contingency plans tested. Nevertheless,
progress was uneven. For example, the percentage of agency systems
reviewed declined from 96 percent in 2004 to 84 percent in 2005, and
the percentage of employees and contractors receiving security
awareness training also declined, from 88 percent in 2004 to 81 percent
in 2005.
Federal entities can act to improve the usefulness of the annual FISMA
reporting process and to mitigate underlying information security
weaknesses. OMB has taken several actions to improve FISMA reporting -
-such as requiring agencies to indicate the relative importance or risk
level of their systems --and can further enhance the reliability and
quality of reported information. Agencies can also take actions to
fully implement their FISMA-mandated programs and address the
weaknesses in their information security controls. Such actions include
completing and maintaining accurate inventories of major systems,
prioritizing information security efforts based on system risk levels,
and strengthening controls that are designed to prevent, limit, and
detect access to the agencies' information and information systems.
Background:
Increasing computer interconnectivity--most notably growth in the use
of the Internet--has revolutionized the way that our government, our
nation, and much of the world communicate and conduct business. While
this interconnectivity offers us huge benefits, without proper
safeguards it also poses significant risks to the government's computer
systems and, more importantly, to the critical operations and
infrastructures they support. We reported in 2005 that while federal
agencies showed improvement in addressing information security, they
also continued to have significant control weaknesses in federal
computer systems that put federal operations and assets at risk of
inadvertent or deliberate misuse, financial information at risk of
unauthorized modification or destruction, sensitive information at risk
of inappropriate disclosure, and critical operations at the risk of
disruption.[Footnote 5]
The significance of these weaknesses led us to conclude in the audit of
the federal government's fiscal year 2005 financial statements[Footnote
6] that information security was a material weakness.[Footnote 7] Our
audits also identified instances of similar types of weaknesses in non-
financial systems.
To fully understand the significance of the weaknesses we identified,
it is necessary to link them to the risks they present to federal
operations and assets. Virtually all federal operations are supported
by automated systems and electronic data, and agencies would find it
difficult, if not impossible, to carry out their missions and account
for their resources without these information assets. Hence, the degree
of risk caused by security weaknesses is high. The weaknesses we
identified place a broad array of federal operations and assets at
risk. For example,
* Resources, such as federal payments and collections, could be lost or
stolen.
* Computer resources could be used for unauthorized purposes or to
launch attacks on other computer systems.
* Sensitive information, such as taxpayer data, social security
records, medical records, and proprietary business information could be
inappropriately disclosed, browsed, or copied for purposes of
industrial espionage or other types of crime.
* Critical operations, such as those supporting national defense and
emergency services, could be disrupted.
* Data could be modified or destroyed for purposes of fraud, identity
theft, or disruption.
* Agency missions could be undermined by embarrassing incidents that
result in diminished confidence in federal organizations' abilities to
conduct operations and fulfill their fiduciary responsibilities.
Congress and the administration have established specific information
security requirements, in both law and policy, to help protect the
information and information systems that support these critical
operations and assets.
FISMA Authorized and Strengthened Information Security Requirements:
Enacted into law on December 17, 2002, as title III of the E-Government
Act of 2002, FISMA authorized and strengthened information security
program, evaluation, and reporting requirements. The Act assigns
specific responsibilities to agency heads, chief information officers,
and IGs. It also assigns responsibilities to OMB, which include
developing and overseeing the implementation of policies, principles,
standards, and guidelines on information security and reviewing at
least annually, and approving or disapproving, agency information
security programs.
Overall, FISMA requires each agency (including agencies with national
security systems) to develop, document, and implement an agencywide
information security program. This program should provide security for
the information and information systems that support the operations and
assets of the agency, including those provided or managed by another
agency, contractor, or other source. Specifically, this program is to
include:
* periodic assessments of the risk and magnitude of harm that could
result from the unauthorized access, use, disclosure, disruption,
modification, or destruction of information or information systems;
* risk-based policies and procedures that cost-effectively reduce
information security risks to an acceptable level and ensure that
information security is addressed throughout the life cycle of each
information system, including minimally acceptable system configuration
requirements;
* subordinate plans for providing adequate information security for
networks, facilities, and systems or groups of information systems;
* security awareness training for agency personnel, including
contractors and other users of information systems that support the
operations and assets of the agency;
* periodic evaluation of the effectiveness of information security
policies, procedures, and practices, performed with a frequency
depending on risk, but no less than annually, and that includes testing
of management, operational, and technical controls for every system
identified in the agency's required inventory of major information
systems;
* a process for planning, implementing, evaluating, and documenting
remedial action to address any deficiencies in the information security
policies, procedures, and practices of the agency;
* procedures for detecting, reporting, and responding to security
incidents; and:
* plans and procedures to ensure continuity of operations for
information systems that support the operations and assets of the
agency.
FISMA also established a requirement that each agency develop,
maintain, and annually update an inventory of major information systems
(including major national security systems) that are operated by the
agency or under its control. This inventory is to include an
identification of the interfaces between each system and all other
systems or networks, including those not operated by or under the
control of the agency.
Each agency is also required to have an annual independent evaluation
of its information security program and practices, including control
testing and compliance assessment. Evaluations of non-national security
systems are to be performed by the agency IG or by an independent
external auditor, while evaluations related to national security
systems are to be performed only by an entity designated by the agency
head. The agencies are to report annually to OMB, selected
congressional committees, and the Comptroller General on the adequacy
of information security policies, procedures, practices, and compliance
with FISMA requirements. In addition, agency heads are required to make
annual reports of the results of their independent evaluations to OMB.
OMB must submit a report to Congress no later than March 1 of each year
on agency compliance, including a summary of the findings of agencies'
independent evaluations.
Other major provisions direct that the National Institute of Standards
and Technology (NIST) develop, for systems other than national security
systems: (1) standards to be used by all agencies to categorize all
their information and information systems based on the objectives of
providing appropriate levels of information security according to a
range of risk levels; (2) guidelines recommending the types of
information and information systems to be included in each category;
and (3) minimum information security requirements for information and
information systems in each category. NIST must also develop a
definition of and guidelines concerning detection and handling of
information security incidents and guidelines.
OMB Reporting Instructions and Guidance Emphasize Performance Measures:
OMB provides instructions to the agencies and their IGs on the annual
FISMA reporting requirements. OMB's fiscal year 2005 reporting
instructions, similar to the 2004 instructions, have a strong focus on
performance measures. OMB has developed performance measures in the
following areas:
* certification and accreditation,[Footnote 8]
* testing of security controls,
* agency systems and contractor systems reviewed annually,
* testing of contingency plans,
* incident reporting,
* annual security awareness training for employees and contractors,
* annual specialized training for employees with significant security
responsibilities, and:
* minimally acceptable configuration requirements.
Further, OMB has provided instructions for continued agency reporting
on the status of remediation efforts through plans of action and
milestones. Required for all programs and systems where an IT security
weakness has been found, these plans list the weaknesses and show
estimated resource needs or other challenges to resolving them, key
milestones and completion dates, and the status of corrective actions.
The plans are to be submitted twice a year to OMB. In addition,
agencies are to submit quarterly updates that indicate the number of
weaknesses for which corrective action has been completed as originally
scheduled, or has been delayed, as well as the number of new weaknesses
discovered since the last update.
The annual IGs' reports requested by OMB are to be based on the results
of their independent evaluations, including work performed throughout
the reporting period (such as work performed as part of the annual
financial audits of the agencies). While OMB asked the IGs to respond
to some of the same questions as the agencies, it also asked them to
assess whether their agency had developed, implemented, and was
managing an agencywide plan of actions and milestones. Further, OMB
asked the IGs to assess the quality of the certification and
accreditation process at their agencies, as well as the status of their
agency's inventory of major information systems. OMB did not request
that the IGs validate agency responses to the performance measures.
Instead, as part of their independent evaluations of a subset of agency
systems, IGs were asked to assess the reliability of the data for those
systems that they evaluated.
OMB's Report to Congress Noted Improvements and Weaknesses:
In its March 2006 report to Congress on fiscal year 2005 FISMA
implementation,[Footnote 9] OMB emphasized that the federal government
has made progress in meeting key performance measures for IT security;
however, uneven implementation of security efforts leaves weaknesses in
several areas. OMB determined through its assessment of FISMA reports
that advances have occurred at a governmentwide level in the following
areas of IT security:
* Systems certification and accreditation. Agencies recorded a 19
percent increase in the total number of IT systems and reported that
the percentage of certified and accredited systems rose from 77 percent
in fiscal year 2004 to 85 percent in 2005. Moreover, OMB noted that 88
percent of systems assessed as high-risk have been certified and
accredited.
* Assessed quality of the certification and accreditation process.
OMB's analysis of reports from the IGs revealed an increase in agencies
with a certification process rated as "satisfactory" or higher, from 15
in 2004 to 17 in 2005.
* Plans of action and milestone process. OMB noted that out of 25
agencies that it reviewed in detail,[Footnote 10] 19 IGs report that
their agencies have effective remediation processes, compared to 18 in
2004.
In addition to these areas of improvement, OMB detected areas with
continuing weaknesses:
* Contractor systems oversight. IGs for 6 of 24 agencies (one agency IG
did not respond) rated agency oversight of contractor systems in the
"rarely" range, while 3 others rated this oversight in the next lowest
range, "sometimes."
* Security controls testing. Agencies tested the security controls on a
lower percentage of systems, dropping from 76 percent in fiscal year
2004 to 72 percent in 2005. OMB noted a better rate of testing for high-
risk systems, with a governmentwide total of 83 percent.
* Incident reporting. OMB stated that some agencies continue to report
security incidents to the Department of Homeland Security only
sporadically and that others report notably low levels of incidents.
* Agencywide plans of action and milestones. While IGs for 19 agencies
reported effective POA&M processes, 6 others reported ineffective
processes.
* Certification and accreditation process. OMB commented that while no
IG rated the certification and accreditation process for its agency as
failing, eight rated the process as "poor."
The OMB report also discusses a plan of action to improve performance,
assist agencies in their information security activities, and promote
compliance with statutory and policy requirements. OMB has set a goal
for agencies to have 90 percent of their systems certified and
accredited and their certification and accreditation process rated as
"satisfactory" or better by their IGs.
Agency 2005 FISMA Reports Show Mixed Results:
In their FISMA-mandated reports for fiscal year 2005, the 24 major
agencies reported both improvements and weaknesses in major performance
indicators. The following key measures showed increased performance
and/or continuing challenges:
* percentage of systems certified and accredited;
* percentage of agencies with an agencywide minimally acceptable
configuration requirements policy;
* percentage of agency systems reviewed annually;
* percentage of contractor systems reviewed annually;
* percentage of employees and contractors receiving annual security
awareness training;
* percentage of employees with significant security responsibilities
receiving specialized security training annually; and:
* percentage of contingency plans tested.
Figure 1 illustrates that the major agencies have made steady progress
in fiscal year 2005 certifying and accrediting their systems, although
they have made mixed progress in meeting other key performance measures
compared with the previous two fiscal years. Summaries of the results
for specific measures follow.
Figure 1: Reported Data for Selected Performance Measures for 24 Major
Agencies:
[See PDF for image]
[End of figure]
Certification and Accreditation:
Included in OMB's policy for federal information security is a
requirement that agency management officials formally authorize their
information systems to process information and, thereby accept the risk
associated with their operation. This management authorization
(accreditation) is to be supported by a formal technical evaluation
(certification) of the management, operational, and technical controls
established in an information system's security plan. For FISMA
reporting, OMB requires agencies to report the number of systems
authorized for processing after completing certification and
accreditation.
Data reported for this measure showed continued overall increases for
most agencies over the last three years. For example, 15 agencies
reported an increase in the percentage of their systems that had
completed certification and accreditation. Overall, 85 percent of
agencies' systems governmentwide were reported as certified and
accredited in 2005, compared to 77 percent in 2004 and 62 percent in
2003. In addition, 20 agencies reported that 90 percent or more of
their systems had successfully completed the process, as illustrated in
figure 2.
Figure 2: Percentage of Agencies Reporting the Percentage of Their
Systems that are Certified and Accredited for Processing in Fiscal Year
2005:
[See PDF for image]
[End of figure]
Agencies appeared to appropriately focus their certification and
accreditation efforts on high-risk systems. Agencies certified and
accredited a higher percentage of their high-risk systems (88 percent)
than their moderate-risk systems.
Configuration Management:
FISMA requires each agency to have policies and procedures that ensure
compliance with minimally acceptable system configuration requirements,
as determined by the agency. In fiscal year 2004, for the first time,
agencies reported on the degree to which they had security
configurations for specific operating systems and software
applications. Our analysis of the 2005 agency FISMA reports found that
all 24 major agencies reported that they had agencywide policies
containing system configurations, an increase from the 20 agencies who
reported having them in 2004. However, implementation of these
requirements at the system level continues to be uneven. Specifically,
14 agencies reported having system configuration policies, but they did
not always implement them on their systems.
Annual Review of Agency Systems:
FISMA requires that agency information security programs include
periodic testing and evaluation of the effectiveness of information
security policies, procedures, and practices to be performed with a
frequency that depends on risk, but no less than annually. This effort
is to include testing of management, operational, and technical
controls of every information system identified in the FISMA-required
inventory of major systems. Periodically evaluating the effectiveness
of security policies and controls and acting to address any identified
weaknesses are fundamental activities that allow an organization to
manage its information security risks cost-effectively, rather than
reacting to individual problems ad hoc only after a violation has been
detected or an audit finding has been reported. In order to measure the
performance of security programs, OMB requires that agencies report the
number and percentage of systems that they have reviewed during the
year.
Agencies reported a decrease in the percentage of their systems that
underwent an annual review in 2005, after reporting major gains in this
performance measure in 2004. In the 2005 reports, agencies stated that
84 percent of their systems had been reviewed in the last year, as
compared to 96 percent in 2004. While 23 agencies reported that they
had reviewed 90 percent or more of their systems in 2004, 19 agencies
reported this achievement in 2005, as shown in figure 3.
Figure 3: Percentage of Agencies Reporting the Percentage of Their
Systems that have been Reviewed in Fiscal Year 2005:
[See PDF for image]
[End of figure]
Annual Review of Contractor Systems:
Under FISMA, agency heads are responsible for providing information
security protections for information collected or maintained by or on
behalf of the agency and information systems used or operated by an
agency or by a contractor. As OMB emphasized in its fiscal year 2005
FISMA reporting guidance, agency IT security programs apply to all
organizations that possess or use federal information or that operate,
use, or have access to federal information systems on behalf of a
federal agency. Such other organizations may include contractors,
grantees, state and local governments, and industry partners. According
to longstanding OMB policy concerning sharing government information
and interconnecting systems, federal security requirements continue to
apply, and the agency is responsible for ensuring appropriate security
controls.
The key performance measure of annual review of contractor systems by
agencies decreased from 83 percent in 2004 to 74 percent in 2005,
reducing the rate of reviews performed to below 2003 levels. However,
the number of agencies that reported reviewing over 90 percent of their
contractor systems has increased from 10 in 2004 to 17 in 2005. A
breakdown of the percentages for fiscal year 2005 is provided in figure
4.
Figure 4: Percentage of Agencies Reporting the Percentage of Their
Contractor Systems that have been Reviewed in Fiscal Year 2005:
[See PDF for image]
[End of figure]
Although agencies reported that 74 percent of their contractor systems
were reviewed in 2005, they only reviewed 51 percent of the contractor
systems assessed as high-risk, as opposed to 89 percent of moderate-
risk systems and 84 percent of low-risk systems. Without adequate
contractor review, agencies cannot be assured that federal information
held and processed by contractors is secure.
Security Awareness Training:
FISMA requires agencies to provide security awareness training. This
training should inform personnel, including contractors and other users
of information systems supporting the operations and assets of an
agency, of information security risks associated with their activities
and of the agency's responsibilities in complying with policies and
procedures designed to reduce these risks. Our studies of best
practices at leading organizations[Footnote 11] have shown that such
organizations took steps to ensure that personnel involved in various
aspects of information security programs had the skills and knowledge
they needed.
In their FISMA submissions for fiscal year 2005, agencies reported that
they provided security awareness training to the majority of their
employees and contractors. However, while 19 agencies reported that
they had trained more than 90 percent of their employees and
contractors in basic security awareness (see fig. 5), the overall
percentage of employees trained among the 24 major federal agencies
reviewed dropped from 88 percent in 2004 to 81 percent in 2005, a level
almost equal to that reported in 2003.
Figure 5: Percentage of Agencies Reporting the Level of Their Employees
and Contractors that have Received IT Security Awareness Training in
Fiscal Year 2005:
[See PDF for image]
[End of figure]
Specialized Security Training:
Under FISMA, agencies are required to provide training in information
security to personnel with significant security responsibilities. As
previously noted, our study of best practices at leading organizations
has shown that such organizations recognized that staff expertise
needed to be updated frequently to keep security employees current on
changes in threats, vulnerabilities, software, technologies, security
techniques, and security monitoring tools. OMB directs agencies to
report on the percentage of their employees with significant security
responsibilities who have received specialized training.
Agencies reported varying levels of compliance in providing specialized
training to employees with significant security responsibilities. Of
the 24 agencies that we reviewed, 12 reported that they had provided
specialized security training for 90 percent or more of these
employees. (see fig. 6).
Figure 6: Percentage of Agencies Reporting the Level of Their Employees
with Significant Security Responsibilities that have Received
Specialized Security Training in Fiscal Year 2005:
[See PDF for image]
[End of figure]
Although there was a gain of one point in the percentage of employees
who received specialized security training for fiscal year 2005 (82
percent) over 2004 (81 percent), both of these years show a decrease
from the level reported in 2003 (85 percent). Given the rapidly
changing threats in information security, agencies need to keep their
IT security employees up to date on changes in technology. Otherwise,
agencies may face increased risk of security breaches.
Testing of Contingency Plans:
Contingency plans provide specific instructions for restoring critical
systems, including such elements as arrangements for alternative
processing facilities in case the usual facilities are significantly
damaged or cannot be accessed due to unexpected events such as a
temporary power failure, the accidental loss of files, or a major
disaster. It is important that these plans be clearly documented,
communicated to potentially affected staff, and updated to reflect
current operations. The testing of contingency plans is essential to
determining whether the plans will function as intended in an
emergency, and the frequency of plan testing will vary depending on the
criticality of the entity's operations. The most useful tests involve
simulating a disaster to test overall service continuity. Such a test
includes testing whether the alternative data processing site will
function as intended and whether critical computer data and programs to
be recovered from off-site storage will be accessible and current. In
executing the plan, managers are able to identify weaknesses and make
changes accordingly. Moreover, such tests assess how well employees
have been trained to carry out their roles and responsibilities during
a disaster. To show the status of implementing this requirement, OMB
specifies that agencies report the number of systems with tested
contingency plans.
Overall, agencies continued to report that they have not tested a
significant number of their contingency plans with only 61 percent of
systems with tested plans. Although this number continues to show small
increases each year since 2003, figure 7 illustrates that 5 agencies
reported less than 50 percent of their systems had tested contingency
plans.
Figure 7: Percentage of Agencies Reporting the Level of Their Systems
that have Tested Contingency Plans in Fiscal Year 2005:
[See PDF for image]
[End of figure]
In addition, agencies do not appear to be appropriately prioritizing
testing of contingency plans by system risk level, with high-risk
systems having the lowest rate of systems with tested plans of the
three risk levels. Without testing, agencies can have limited assurance
that they will be able to recover mission critical applications,
business processes, and information in the event of an unexpected
interruption.
Inventory of Major Systems:
FISMA requires that agencies develop, maintain, and annually update an
inventory of major information systems operated by the agency, or under
its control. The total number of agency systems is a key element in
OMB's performance measures, in that agency progress is indicated by the
percentage of total systems that meet specific information security
requirements. For the 2005 reports, OMB required agencies to report the
number of major systems and asked the IGs about the status and accuracy
of their agencies' inventories.
In 2005, agencies reported 10,261 systems, composed of 9,175 agency
systems and 1,094 contractor systems. However, only 13 IGs reported
that their agencies' inventories were substantially complete. A
complete inventory of major information systems is a key element of
managing the agency's IT resources, including the security of those
resources. Without reliable information on agencies' inventories, the
agencies, the administration, and Congress cannot be fully assured of
agencies' progress in implementing FISMA.
Risk Assessments:
FISMA mandates that agencies assess the risk and magnitude of harm that
could result from the unauthorized access, use, disclosure disruption,
modification, or destruction of their information and information
systems. The Federal Information Processing Standard (FIPS) 199,
Standards for Security Categorization of Federal Information and
Information Systems, and related NIST guidance provide a common
framework for categorizing systems according to risk. The framework
establishes three levels of potential impact on organizational
operation, assets, or individuals should a breach of security occur--
high (severe or catastrophic), moderate (serious), and low (limited)--
and is used to determine the impact for each of the FISMA-specified
security objectives of confidentiality, integrity, and availability.
Once determined, security categories are to be used in conjunction with
vulnerability and threat information in assessing the risk to an
organization. OMB's fiscal year 2005 reporting instructions included
the new requirement that agencies report their systems and certain
performance measures using FIPS 199 risk levels. If agencies did not
categorize systems, or used a method other than FIPS 199 to determine
risk level, they were required to explain why in their FISMA reports.
For the first time, in the 2005 reporting, agencies reported the risk
levels for their agency and contractor systems, as illustrated in table
1.
Figure 8: Systems Reported by Risk Level in Fiscal year 2005:
[See PDF for image]
Source: GAO analysis.
[End of table]
Agencies reported that 9 percent of their systems were not categorized
by risk level. The majority of systems without risk levels assigned
were found at 4 agencies. One agency did not categorize 77 percent of
its systems. Without assigned risk levels, agencies cannot make risk-
based decisions on the security needs of their information and
information systems.
Actions are Needed to Improve FISMA Reporting and Underlying
Information Security Weaknesses:
There are actions that OMB and the agencies can take to improve FISMA
reporting and compliance and to address underlying weaknesses in
information security controls. In our July 2005 report,[Footnote 12] we
evaluated the adequacy and effectiveness of agencies' information
security policies and practices and the federal government's
implementation of FISMA requirements. We recommended that the Director
of OMB take actions in revising future FISMA reporting instructions to
increase the usefulness of the agencies' annual reports to oversight
bodies by:
* requiring agencies to report FISMA data by risk category;
* reviewing guidance to ensure the clarity of instructions;
* requesting the IGs report on the quality of additional agency
processes, such as the annual system reviews.
These recommendations were designed to strengthen reporting under FISMA
by encouraging more complete information on the implementation of
agencies' information security programs.
Consistent with our recommendation, OMB required agencies to report
certain performance measures by system risk level for the first time in
fiscal year 2005. As a result, we were able to identify potential areas
of concern in the agencies' implementation of FISMA. For example,
agencies do not appear to be prioritizing certain information security
control activities, such as annual review of contractor systems or
testing of contingency plans, based on system risk levels. For both of
these activities, federal implementation of the control is lower for
high-risk systems than it is for moderate or low-risk systems.
OMB has also taken steps to increase the clarity of instructions in
their annual guidance. It has removed several questions from prior
years that could have been subject to differing interpretations by the
IGs and the agencies. Those questions related to agency inventories and
to plans of actions and milestones. In addition, OMB clarified
reporting instructions for minimally acceptable configuration
requirements. The resulting reports are more consistent and, therefore,
easier to analyze and compare.
However, opportunities still exist to enhance reporting on the quality
of the agencies' information security-related processes. The
qualitative assessments of the certification and accreditation process
and the plans of actions and milestones have greatly enhanced
Congress', OMB's, and our understanding of the implementation of these
requirements at the agencies. Additional information on the quality of
agencies' processes for annually reviewing or testing systems, for
example, could improve understanding of these processes by examining
whether federal guidance is applied correctly, or whether weaknesses
discovered during the review or test are tracked for remediation.
Extending qualitative assessments to additional agency processes could
improve the information available on agency implementation of
information security requirements.
Federal Agencies Need to Take Actions to Increase FISMA Compliance and
Address Already Identified Information Security Weaknesses:
Agencies need to take action to implement the information security
management program mandated by FISMA and use that program to address
their outstanding information security weaknesses. An agencywide
security program provides a framework and continuing cycle of
activities for managing risk, developing security policies, assigning
responsibilities, and monitoring the adequacy of the entity's computer-
related controls. Without a well-designed program, security controls
may be inadequate; responsibilities may be unclear, misunderstood, or
improperly implemented; and controls may be inconsistently applied.
Such conditions may lead to insufficient protection of sensitive or
critical resources and disproportionately high expenditures for
controls over low-risk resources.
As we have previously reported,[Footnote 13] none of the 24 major
agencies has fully implemented agencywide information security programs
as required by FISMA. Agencies often did not adequately assess risks,
develop sufficient risk-based policies or procedures for information
security, ensure that existing policies and procedures were implemented
effectively, or monitor operations to ensure compliance and determine
the effectiveness of existing controls. Moreover, as demonstrated by
the 2005 FISMA reports, many agencies still do not have complete and
accurate inventories of their major systems. Until agencies effectively
and fully implement agencywide information security programs, federal
data and systems will not be adequately safeguarded against
unauthorized use, disclosure, and modification.
Agencies need to take action to implement and strengthen their
information security management programs. Such actions should include
completing and maintaining an accurate, complete inventory of major
systems, and prioritizing information security efforts based on system
risk levels. Strong incident procedures are necessary to detect,
report, and respond to security incidents effectively. Agencies also
should implement strong remediation processes that include processes
for planning, implementing, evaluating, and documenting remedial
actions to address any identified information security weaknesses.
Finally, agencies need to implement risk-based policies and procedures
that efficiently and effectively reduce information security risks to
an acceptable level.
Even as federal agencies are working to implement information security
management programs, they continue to have significant control
weaknesses in their computer systems that threaten the integrity,
reliability, and availability of federal information and systems. In
addition, these weaknesses place financial information at risk of
unauthorized modification or destruction, sensitive information at risk
of inappropriate disclosure, and critical operations at risk of
disruption.
The weaknesses appear in both access controls and other information
security controls defined in our audit methodology for performing
information security evaluations and audits.[Footnote 14] These areas
are (1) access controls, which ensure that only authorized individuals
can read, alter, or delete data; (2) software change controls, which
provide assurance that only authorized software programs are
implemented; (3) segregation of duties, which reduces the risk that one
individual can independently perform inappropriate actions without
detection; (4) continuity of operations planning, which provides for
the prevention of significant disruptions of computer-dependent
operations, and (5) an agencywide security program, which provides the
framework for ensuring that risks are understood and that effective
controls are selected and properly implemented.
In the 24 major agencies' fiscal year 2005 reporting regarding their
financial systems, 6 reported information security as a material
weakness and 14 reported it as a reportable condition.[Footnote 15] Our
audits also identified similar weaknesses in nonfinancial systems. In
our prior reports, we have made specific recommendations to the
agencies to mitigate identified information security weaknesses. The
IGs have also made specific recommendations as part of their
information security review work.
Agencies Should Address Weaknesses in Access Controls:
Agencies would benefit from addressing common weaknesses in access
controls. As we have previously reported, the majority of the 24 major
agencies had access control weaknesses.[Footnote 16] A basic management
control objective for any organization is to protect data supporting
its critical operations from unauthorized access, which could lead to
improper modification, disclosure, or deletion of the data. Based on
our previous work performing information security audits, agencies can
take steps to enhance the four basic areas of access controls:
* User identification and authentication. To enable a computer system
to identify and differentiate users so that activities on the system
can be linked to specific individuals, agencies assign unique user
accounts to specific users, a process called identification.
Authentication is the method or methods by which a system establishes
the validity of a user's claimed identity. Agencies need to implement
strong user identification and authentication controls.
* User access rights and file permissions. The concept of "least
privileged" is a basic underlying principle for security computer
systems and data. It means that users are only granted those access
rights and file permissions that they need to do their work. Agencies
would benefit from establishing the concept of least privilege as the
basis for all user rights and permissions.
* Network services and devices. Sensitive programs and information are
stored on networks, which are collections of interconnected computer
systems and devices that allow users to share resources. Organizations
secure their networks, in part, by installing and configuring networks
devices that permit authorized requests and limit services that are
available.[Footnote 17] Agencies need to put in place strong controls
that ensure only authorized access to their networks.
* Audit and monitoring of security-related events. To establish
individual accountability, monitor compliance with security policies,
and investigate security violations, it is crucial that agencies
implement system or security software that provides an audit trail that
they can use to determine the source of a transaction, or to monitor
the activities of users on the agencies' systems. To detect and prevent
unauthorized activity, agencies should have strong monitoring and
auditing capabilities.
Agencies Need to Act to Implement Other Information Security Controls:
In addition to electronic access controls, other important controls
should be in place to ensure the security and reliability of an
agency's data.
* Software change controls. Counteracting identified weaknesses in
software change controls would help agencies ensure that software was
updated correctly and that changes to computer systems were properly
approved. Software change controls ensure that only authorized and
fully tested software is placed in operation. These controls --which
also limit and monitor access to powerful programs and sensitive files
associated with computer operations --are important in providing
reasonable assurance that access controls are not compromised and that
the system will not be impaired. These policies, procedures, and
techniques help to ensure that all programs and program modifications
are properly authorized, tested, and approved. Failure to implement
these controls increases the risk that unauthorized programs or changes
could be --inadvertently or deliberately --placed into operation.
* Segregation of duties. Agencies have opportunities to implement
effective segregation of duties to address the weaknesses identified in
this area. Segregation of duties refers to the policies, procedures,
and organizational structure that help to ensure that one individual
cannot independently control all key aspects of a process or computer-
related operation and thereby conduct unauthorized actions or gain
unauthorized access to assets or records. Proper segregation of duties
is achieved by dividing responsibilities among two or more individuals
or organizational groups. For example, agencies need to segregate
duties to ensure that individuals cannot add fictitious users to a
system, assign them elevated access privileges, and perform
unauthorized activities without detection. Without adequate segregation
of duties, there is an increased risk that erroneous or fraudulent
transactions can be processed, improper program changes implemented,
and computer resources damaged or destroyed.
* Continuity of operations. The majority of agencies could benefit from
having adequate continuity of operations planning. An organization must
take steps to ensure that it is adequately prepared to cope with the
loss of operational capabilities due to earthquake, fire, accident,
sabotage, or any other disruption. An essential element in preparing
for such catastrophes is an up-to-date, detailed, and fully tested
continuity of operations plan. To ensure that the plan is complete and
fully understood by all key staff, it should be tested, including
surprise tests, and test plans and results documented to provide a
basis for improvement. Among the aspects of continuity planning that
agencies need to address should be: (1) ensuring that plans contain
adequate contact information for emergency communications; (2)
documenting the location of all vital records for the agencies and
methods of updating those records in an emergency; (3) conducting
tests, training, or exercises frequently enough to have assurance that
the plan would work in an emergency. Losing the capability to process,
retrieve, and protect information that is maintained electronically can
significantly affect an agency's ability to accomplish its mission.
* Physical security. Physical security controls are important for
protecting computer facilities and resources from espionage, sabotage,
damage, and theft. These controls restrict physical access to computer
resources, usually by limiting access to the buildings and rooms in
which the resources are housed. With inadequate physical security,
there is increased risk that unauthorized individuals could gain access
to sensitive computing resources and data and inadvertently or
deliberately misuse or destroy them.
In summary, through the continued emphasis of information security by
Congress, the administration, agency management, and the accountability
community, the federal government has seen improvements in its
information security. However, despite the advances shown by increases
in key performance measures, progress remains mixed. If information
security is to continue to improve, agency management must remain
committed to the implementation of FISMA and the information security
management program it mandates. Only through the development of strong
IT security management can the agencies address the persistent, long-
standing weaknesses they face in information security controls.
Mr. Chairman, this concludes my statement. I would be happy to answer
any questions that you or members of the Committee may have at this
time. Should you have any questions about this testimony, please
contact me at (202) 512-6244. I can also be reached by e-mail at
wilshuseng@gao.gov. Individuals making key contributions to this
testimony include Suzanne Lightman, Assistant Director, Larry Crosland,
Joanne Fiorino, and Mary Marshall.
FOOTNOTES
[1] Federal Information Security Management Act of 2002, Title III, E-
Government Act of 2002, Pub. L. No. 107-347, Dec. 17, 2002
[2] GAO, Information Security: Opportunities for Improved OMB Oversight
of Agency Practices, GAO/AIMD-96-110 (Washington, D.C.: Sept. 24, 1996)
[3] GAO, High-Risk Series: An Update, GAO-05-207 (Washington, D.C.:
Jan., 2005).
[4] These 24 departments and agencies are the Departments of
Agriculture, Commerce, Defense, Education, Energy, Health and Human
Services, Homeland Security, Housing and Urban Development, Interior,
Justice, Labor, State, Transportation, Treasury, and, Veterans Affairs,
the Environmental Protection Agency, General Services Administration,
Office of Personnel Management, National Aeronautics and Space
Administration, National Science Foundation, Nuclear Regulatory
Commission, Small Business Administration, Social Security
Administration, and U.S. Agency for International Development.
[5] GAO, Information Security: Weaknesses Persist at Federal Agencies
Despite Progress Made in Implementing Related Statutory Requirements,
GAO-05-552 (Washington, D.C.: July 15, 2005).
[6] GAO, Fiscal Year 2005 U.S. Government Financial Statements:
Sustained Improvement and Financial Management is Crucial to Addressing
our Nation's Financial Conditions and Long-term Fiscal Imbalance, GAO-
06-406T (Washington, D.C.: March 1, 2006).
[7] A material weakness is a condition that precludes the entity's
internal control from providing reasonable assurance that
misstatements, losses, or noncompliance material in relation to the
financial statements or to stewardship information would be prevented
or detected on a timely basis.
[8] Agency management officials are required to formally authorize
their information systems to process information and, thereby accept
the risk associated with their operation. This management authorization
(accreditation) is to be supported by a formal technical evaluation
(certification) of the management, operational, and technical controls
established in an information system's security plan.
[9] Office of Management and Budget, FY2005 Report to Congress on the
Implementation of the Federal Information Security Management Act of
2002 (Washington, D.C.: March, 2006).
[10] OMB includes the Smithsonian Institution in its list of major
agencies. Our analysis in this testimony does not include the
Smithsonian Institution.
[11] GAO, Executive Guide: Information Security Management: Learning
From Leading Organizations, GAO/AIMD-98-68 (May, 1998).
[12] GAO-05-552
[13] GAO-05-552
[14] GAO, Federal Information System Controls Audit Manual, GAO/AIMD-
12.19.6 (Washington, D.C.: January 1999). This methodology is used for
our information security controls evaluations and audits, as well as by
the IGs for the information security control work done as part of
financial audits at the agencies.
[15] Reportable conditions are significant deficiencies in the design
or operation of internal control that could adversely affect the
entity's ability to record, process, summarize, and report financial
data consistent with the assertions of management in the financial
statements.
[16] GAO-05-552
[17] Devices used to secure networks include (1) firewalls that prevent
unauthorized access to the network; (2) routers that filter and forward
data; (3) switches that forward information through segments of a
network; and, (4) servers that host applications and data.
