The scope of the program includes the pre-entry, entry, status  management, and exit of foreign national travelers who enter and leave  the United States at 285 air, land, and sea ports of entry, and the provision  of new analytical capabilities across the overall process. Significant Weaknesses Place US- VISIT Data at Risk

Although CBP has implemented information security controls that are  designed to safeguard US-VISIT data, its systems supporting US-VISIT  have significant weaknesses in access controls and other controls  designed to protect the confidentiality, integrity, and availability of its  sensitive and personal information. CBP did not sufficiently limit access to US-VISIT information and  information systems. However, DHS did not ensure that controls adequately protected external  and internal boundaries. However, CBP did not effectively implement physical security at several  locations. DHS did not consistently apply encryption to protect sensitive data  traversing the communication network. CBP did not provide adequate logging or user accountability for the  mainframe, workstations, or servers. CBP did not always ensure that responsibilities for systems development  and system operations or production were sufficiently segregated. However, CBP did not consistently maintain secure configurations on the  mainframe, applications servers, and workstations we reviewed at the data  center and ports of entry. These  weaknesses increase the risk that unauthorized individuals could read,  copy, delete, add, and modify sensitive information—including personally  identifiable information—on systems supporting the US-VISIT program. They make it possible for intruders, as well as government and contractor  employees, to bypass or disable computer access controls and undertake a  wide variety of inappropriate or malicious acts. These risks are not confined to US-VISIT information. The CBP mainframe  and network resources that support US-VISIT also support other programs  and systems. As a result, the vulnerabilities identified in this report could  expose the information and information systems of the other programs to  the same increased risks. Information Security Program Is Not Fully Implemented

A key reason for these weaknesses is that, although CBP has made  important progress in implementing the department’s information security  program, it has not effectively or fully implemented key program activities  for systems supporting the US-VISIT program. Conclusions

CBP systems supporting the US-VISIT program were riddled with  significant information security control weaknesses that place sensitive  information—including personally identifiable information—at increased  risk of unauthorized and possibly undetected disclosure and modification,  misuse, and destruction, and place program operations at increased risk of  disruption. Weaknesses existed in all control areas and computing device  types reviewed. Deficiencies in identification and authentication controls,  authorization controls, boundary protection measures, physical security,  use of cryptography, audit and monitoring practices, segregation of duties,  and configuration assurance controls exposed CBP’s mainframe  computer, network infrastructure, servers, and workstations to insider and  external threats. Until DHS and CBP act to mitigate the weaknesses in  CBP systems supporting the US-VISIT program and CBP effectively and  fully implements its information security program, limited assurance  exists that sensitive information will be sufficiently safeguarded against  unauthorized disclosure, modification, and destruction, and that the US- VISIT program will achieve its goals. Recommendations for Executive Action

To help the Department effectively and fully implement information  security program activities for CBP systems supporting the US-VISIT  program, we are recommending that the Secretary of Homeland Security  direct the Commissioner, U.S. Customs and Border Protection to  1.  fully characterize risks in risk assessments for systems supporting US- 2.  update the interconnection security agreements in the TECS security  3.  enhance the procedures and documentation for testing and evaluating  the effectiveness of security controls;  4.  ensure remedial action plans address all significant security  vulnerabilities, accurately report status of remedial actions, and  identify necessary resources for completing actions;  5.  fully develop and implement policies and tools for the timely detection  and handling of security incidents; and  6.  update and complete privacy documents for systems supporting the  US-VISIT program.
Why GAO Did This Study

Intended to enhance the security of U.S. citizens and visitors, United States Visitor and Immigrant Status Indicator Technology (US-VISIT) program encompasses the pre-entry, entry, status management, and exit of foreign national travelers who enter and leave the United States at 285 air, sea, and land ports of entry. GAO was asked to determine whether Department of Homeland Security (DHS) has implemented appropriate controls to protect the confidentiality, integrity, and availability of the information and systems used to support the US-VISIT program. To do this, GAO examined the controls over the systems operated by Customs and Border Protection (CBP) that support the US-VISIT program.

What GAO Found

The systems supporting the US-VISIT program have significant information security control weaknesses that place sensitive and personally identifiable information at increased risk of unauthorized and possibly undetected disclosure and modification, misuse, and destruction. Weaknesses existed in all control areas and computing device types reviewed. Deficiencies in access controls and other system controls exposed mainframe computer, network infrastructure, servers, and workstations to insider and external threats. For example, CBP did not implement controls to effectively prevent, limit, and detect access to computer networks, systems, and information. To illustrate, it did not (1) adequately identify and authenticate users in systems supporting US-VISIT; (2) sufficiently limit access to US-VISIT information and information systems; (3) ensure that controls adequately protected external and internal network boundaries; (4) effectively implement physical security at several locations; (5) consistently encrypt sensitive data traversing the communication network; and (6) provide adequate logging or user accountability for the mainframe, workstations, or servers. In addition, CBP did not always ensure that responsibilities for systems development and system production were sufficiently segregated and did not consistently maintain secure configurations on the application servers and workstations at a key data center and ports of entry. These weaknesses collectively increase the risk that unauthorized individuals could read, copy, delete, add, and modify sensitive information, including personally identifiable information, and disrupt the operations of the US-VISIT program. They make it possible for intruders, as well as government and contractor employees, to bypass or disable computer access controls and undertake a wide variety of inappropriate or malicious acts. These risks are not confined to US-VISIT information. The CBP mainframe and network resources that support US-VISIT also support other programs and systems. As a result, the vulnerabilities identified in this report could expose the information and information systems of the other programs to the same increased risks. A key reason for these weaknesses is that, although CBP has made important progress in implementing elements of the department's information security program, it did not effectively or fully implement essential program activities. For example, CBP did not fully characterize the risks facing critical systems, update interconnection security agreements in security plans, sufficiently test and evaluate security controls, incorporate required elements in remedial action plans, adequately implement incident detection and handling procedures, and consistently address privacy issues. Until DHS and CBP act to mitigate the weaknesses in CBP systems supporting the US-VISIT program and CBP effectively and fully implements its information security program, limited assurance exists that the US-VISIT program will achieve its goal of enhancing the security of U.S. citizens and its visitors.