Comprehensive Policies, Use of Secure Technologies, Risk-Based Approach, Training, and Monitoring Among Leading Practices for Deploying and Monitoring Secure Wireless Networks

Leading practices for deploying and monitoring secure wireless networks  include comprehensive policies, configuration controls, training, and other  practices as described in table 4. Employ a Centralized Wireless Management Structure That Is Integrated with the Existing Wired Network

Security experts agreed that a centralized wireless management structure  that is integrated with the management of the existing wired network can  provide a more effective means to manage the wireless infrastructure and  the information security program as a whole. Experts also noted the importance  of continuously monitoring the wireless network for rogue access points  and client devices. Agencies Have Acted to Secure Wireless Networks, but Additional Steps Are Needed to Effectively Mitigate Security Challenges

Agencies have taken several steps to address the security of their wireless  networks; however, these steps have not been fully and comprehensively  applied across the government. Specifically, application was inconsistent  among the agencies for most of the following leading practices:    Most agencies developed policies that reflected NIST guidelines and  leading practices, but gaps existed in these policies, particularly with  respect to dual-connected laptops and use of mobile devices on  international travel. All agencies required a risk-based approach for management of wireless  technologies. Many agencies used a decentralized structure for management of wireless,  limiting the potential standardization that centralized management can  provide, and guidance on centralization is limited. The five agencies where we did detailed testing generally securely  configured wireless access points, but they had numerous weaknesses in  laptop and smartphone configurations. Most agencies were missing key elements related to wireless security in  their security awareness training. Twenty agencies required encryption, and eight of these agencies specified  that a VPN must be used during remote access; four agencies did not  require encryption. Many agencies had insufficient practices for monitoring or conducting  security assessments. Existing governmentwide guidance and oversight efforts do not fully  address agency implementation of the leading practices. Finally, 1 agency did not address mobile device  security in its annual training. Until  OMB, DHS, NIST, and individual agencies take steps to fully implement  leading security practices, federal wireless networks will remain at  increased vulnerability to attack, and information on these networks is  subject to unauthorized access, use, disclosure, or modification. We also recommend that the Secretary of Commerce instruct the Director  of NIST to develop and issue guidelines in the following four areas:  technical steps agencies can take to mitigate the risk of dual connected  laptops,    governmentwide secure configurations for wireless functionality on  laptops and for smartphones such as BlackBerries,    appropriate ways agencies can centralize their management of wireless  technologies based on business need, and    criteria for selection of tools and recommendations on appropriate  frequencies of wireless security assessments and recommendations for  when continuous monitoring of wireless networks may be appropriate. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) identify leading practices and  state-of-the-art technologies for deploying and monitoring secure wireless  networks and (2) assess agency efforts to secure wireless networks,  including vulnerability to attack. Based on the initial data collected from scans at the headquarters and field  locations, we chose 5 of the 24 agencies at which to complete additional  detailed wireless security testing, specifically, the Departments of  Agriculture, Commerce, Transportation, and Veterans Affairs, and the  Social Security Administration.
Why GAO Did This Study

Over the past several years, federal agencies have rapidly adopted the use of wireless technologies for their information systems. In a 2005 report, GAO recommended that the Office of Management and Budget (OMB), in its role overseeing governmentwide information security, take several steps to help agencies better secure their wireless networks. GAO was asked to update its prior report by (1) identifying leading practices and state-of-the-art technologies for deploying and monitoring secure wireless networks and (2) assessing agency efforts to secure wireless networks, including their vulnerability to attack. To do so, GAO reviewed publications, guidance, and other documentation and interviewed subject matter experts in wireless security. GAO also analyzed policies and plans and interviewed agency officials on wireless security at 24 major federal agencies and conducted additional detailed testing at these 5 agencies: the Departments of Agriculture, Commerce, Transportation, and Veterans Affairs, and the Social Security Administration.

What GAO Found

GAO identified a range of leading security practices for deploying and monitoring secure wireless networks and technologies that can help secure these networks. The leading practices include the following: (1) comprehensive policies requiring secure encryption and establishing usage restrictions, implementation practices, and access controls; (2) a risk-based approach for wireless deployment and monitoring; (3) a centralized wireless management structure that is integrated with the management of the existing wired network; (4) configuration requirements for wireless networks and devices; (5) incorporation of wireless and mobile device security in training; (6) use of encryption, such as a virtual private network for remote access; (7) continuous monitoring for rogue access points and clients; and (8) regular assessments to ensure wireless networks are secure. Agencies have taken steps to secure their wireless networks, but more can be done to improve security and to limit vulnerability to attack. Specifically, application was inconsistent among the agencies for most of the following leading practices: (1) Most agencies developed policies to support federal guidelines and leading practices, but gaps existed, particularly with respect to dual-connected laptops and mobile devices taken on international travel. (2) All agencies required a risk-based approach for management of wireless technologies. (3) Many agencies used a decentralized structure for management of wireless, limiting the standardization that centralized management can provide. (4) The five agencies where GAO performed detailed testing generally securely configured wireless access points but had numerous weaknesses in laptop and smartphone configurations. (5) Most agencies were missing key elements related to wireless security in their security awareness training. (6) Twenty agencies required encryption, and eight of these agencies specified that a virtual private network must be used; four agencies did not require encryption for remote access. (7) Many agencies had insufficient practices for monitoring or conducting security assessments of their wireless networks. Existing governmentwide guidelines and oversight efforts do not fully address agency implementation of leading wireless security practices. Until agencies take steps to better implement these leading practices, and OMB takes steps to improve governmentwide oversight, wireless networks will remain at an increased vulnerability to attack.