The orders further describe different levels of physical protection for  sensitive and classified assets, depending on the risk they would pose if  they were lost, stolen, or otherwise compromised. In addition, two DOE organizations are required to periodically review  physical and cyber security at LANL. NNSA’s Los Alamos Site Office is  required to conduct security surveys annually. While Physical Security at Los Alamos National Laboratory Has Improved, Management Approaches to Sustain Security Improvements Are in the Early Stages of Development or Contain Weaknesses

Physical security at LANL is in a period of significant improvement, and  LANL is implementing over two dozen initiatives to reduce, consolidate,  and better protect its classified assets, as well as reduce the physical  footprint of the laboratory by closing unneeded facilities. We found that DOE’s Office of Independent Oversight and the Los Alamos  Site Office identified significant physical security problems at LANL that  the laboratory had not fully addressed. In addition, external security evaluations had repeatedly identified  concerns about the adequacy of LANL’s assessments of its own security  performance. LANL officials identified three management approaches that they asserted  would sustain security improvements over the long term. We made three recommendations to the Secretary of Energy and the  Administrator of NNSA that, if effectively implemented, will improve  physical security at LANL and help ensure that improvements LANL has  achieved are sustained over the long term. Preliminary Observations on Physical Security at Lawrence Livermore National Laboratory

In June 2008, the Committee requested that we review the security status  at Livermore. During our visit to  the laboratory 2 weeks ago, Livermore officials told us they are finalizing  corrective action plans to address deficiencies in their performance  assurance and self-assessment programs and have already conducted a  significant number of performance assurance tests with the protective  force and on equipment since the completion of the Office of Independent  Oversight’s 2008 evaluation. NNSA and the Livermore Site Office have not always provided effective  security oversight. Six months before the Office of Independent  Oversight’s 2008 evaluation, the 2007 Livermore Site Office’s annual  security survey gave the laboratory a 100-percent satisfactory rating on its  security performance, the highest possible rating. Though our observations are preliminary, Livermore appears to be  experiencing difficulties similar to LANL’s in sustaining physical security  performance. Los Alamos National Laboratory Has Implemented Measures to Enhance Cyber Security on Its Unclassified Network, but Weaknesses Remain

LANL has implemented measures to enhance its cyber security, but  weaknesses remain in protecting the confidentiality, integrity, and  availability of information on its unclassified network. However, LANL has vulnerabilities in  several critical areas, including (1) identifying and authenticating users of  the network, (2) encrypting sensitive information, (3) monitoring and  auditing compliance with security policies, (4) controlling and  documenting changes to a computer system’s hardware and software, and  (5) restricting physical access to computing resources. A key reason for the information security weaknesses we identified is that  LANL has not yet fully implemented an information security program to  ensure that controls are effectively established and maintained. Although LANL cyber security officials told us that funding has been  inadequate to address some of their security concerns, NNSA officials  raised questions about the basis for LANL’s funding request for cyber  security. NNSA’s Chief Information Officer told us that LANL has not  adequately justified requests for additional funds to address the  laboratory’s stated shortfalls. To help strengthen information security controls over LANL’s unclassified  network, we made a series of recommendations to the Secretary of Energy  and the Administrator of NNSA, 11 of which focus on improving LANL’s  information security program and determining resource requirements for  the unclassified network. For example, we recommended that the  Secretary of Energy and the NNSA Administrator require the Director of  LANL to, among other things, (1) ensure that the risk assessment for the  unclassified network evaluates all known vulnerabilities and is revised  periodically and (2) strengthen policies with a view toward further  reducing, as appropriate, foreign nationals’ access to the unclassified  network, particularly those from countries identified as sensitive by DOE.
Why GAO Did This Study

Los Alamos National Laboratory (LANL) is one of three National Nuclear Security Administration (NNSA) laboratories that designs and develops nuclear weapons for the U.S. stockpile. LANL employees rely on sensitive and classified information and assets that are protected at different levels, depending on the risks posed if they were lost, stolen, or otherwise compromised. However, LANL has experienced several significant security breaches during the past decade. This testimony provides GAO's (1) views on physical security at LANL, as discussed in Los Alamos National Laboratory: Long-Term Strategies Needed to Improve Security and Management Oversight, GAO-08-694 (June 13, 2008); (2) preliminary observations on physical security at Lawrence Livermore National Laboratory; and (3) views on cyber security at LANL as discussed in Information Security: Actions Needed to Better Protect Los Alamos National Laboratory's Unclassified Computer Network, GAO-08-1001 (Sept. 9, 2008). To conduct this work, GAO analyzed data, reviewed policies and procedures, interviewed laboratory officials, and conducted site visits to the two laboratories.

What GAO Found

Physical security at LANL is in a period of significant improvement, and LANL is implementing over two dozen initiatives to better protect its classified assets. However, while LANL's current initiatives address many physical security problems previously identified in external security evaluations, other significant security problems have received insufficient attention. In addition, the management approaches that LANL and NNSA intend to use to sustain security improvements over the long term are in the early stages of development or contain weaknesses. Furthermore, LANL's ability to sustain its improved physical security posture is unproven because (1) the laboratory appears not to have done so after a significant security incident in 2004, with another significant security breach in 2006, and (2) NNSA's Los Alamos Site Office--which is responsible for overseeing security at LANL--may not have enough staff or the proper training to execute a fully effective security oversight program. GAO's report made recommendations to help further improve physical security at LANL and ensure that these improvements are sustained over the long term. As a result of poor performance on an April 2008 physical security evaluation conducted by the Department of Energy's (DOE) Office of Independent Oversight, GAO is reviewing physical security at Lawrence Livermore National Laboratory (Livermore). GAO's preliminary observations are that Livermore appears to experience difficulties similar to LANL's in sustaining security performance. Furthermore, it appears that NNSA has not always provided effective oversight of Livermore. Specifically, an NNSA security survey conducted only 6 months prior to the April 2008 DOE evaluation gave Livermore the highest possible rating on its security program's performance. These results differ markedly from those documented by DOE's Office of Independent Oversight. LANL has implemented measures to enhance cyber security, but weaknesses remain in protecting information on its unclassified network. This network possesses sensitive information such as unclassified controlled nuclear information, export control information, and personally identifiable information about LANL employees. GAO found vulnerabilities in critical areas, including (1) identifying and authenticating users, (2) encrypting sensitive information, and (3) monitoring and auditing security policy compliance. A key reason for these information security weaknesses is that the laboratory has not fully implemented an information security program to ensure that controls are effectively established and maintained. Furthermore, deficiencies in LANL's policies and procedures raise additional concern, particularly with respect to foreign nationals' accessing the network from the laboratory and remotely. Finally, LANL cyber security officials told GAO that funding to address some of their security concerns with the laboratory's unclassified network has been inadequate. However, NNSA officials asserted that LANL had not adequately justified its requests for additional funds. GAO made 52 recommendations to help strengthen LANL's information security program and controls over the unclassified network.