DOD Highlights Initiatives, But Also Reports Weaknesses

DOD has undertaken several initiatives to improve its information  security, including the development of an overall IA strategy and the  issuance of information security policy and guidance. However,  information that DOD’s CIO and IG submitted for fiscal year 2002 GISRA  reporting showed that a number of challenges remain for the department  in implementing both its policies and procedures and the statutory  information security requirements. These challenges are indicated by the  material weaknesses DOD reported related to its IA capabilities and its  performance data, which showed that further efforts are needed to  implement key requirements. DOD Efforts to Improve Information Security

Overall, the DOD CIO reported in its fiscal year 2002 GISRA report that the  department has an aggressive IA posture and highlighted several initiatives  to improve its IA program. The actions DOD identified to address the eight deficiencies  are:    completing the implementation of the Information Assurance Vulnerability  Alert process to all services and agencies;   ensuring that effective computer security policies and procedures are  distributed in a timely manner; improving DOD business processes to ensure that all systems are  protected;   decreasing the time necessary for correction of reported weaknesses;    ensuring that computer security policies are enforced and security  capabilities are tested regularly;   ensuring that training is conducted for all network personnel (this  includes awareness training for all personnel to specific network defense  training for system and network administrators); increasing access security through the use of electronic tokens; and increasing security through certificates (for authentication and  nonrepudiation). Currently, DOD reports that it has made progress in addressing many of  these challenges. In January 1998, DOD announced its plans for DIAP—a program intended  to promote integrated, comprehensive, and consistent IA practices across  the department. Despite such steps, OMB reported in its fiscal year  2002 report to the Congress that the overall results of the Defense audit  community’s assessment of the DOD fiscal year 2001 GISRA reporting  reinforced the position that DOD does not have mechanisms in place for  comprehensively measuring compliance with federal and Defense  information security policies and ensuring that those policies are  consistently practiced throughout the department. However, as its fiscal year 2002 GISRA reporting showed, further effort is  needed to fully implement statutory information security requirements  departmentwide and to expand future FISMA reporting to all systems.
Why GAO Did This Study

The Department of Defense (DOD) faces many risks in its use of globally networked computer systems to perform operational missions--such as identifying and tracking enemy targets--and daily management functions--such as paying soldiers and managing supplies. Weaknesses in these systems, if present, could give hackers and other unauthorized users the opportunity to modify, steal, inappropriately disclose, and destroy sensitive military data. GAO was asked, among other things, to discuss DOD's efforts to protect its information systems and networks from cyber attack, focusing on its reported progress in implementing statutory information security requirements.

What GAO Found

In its fiscal year 2002 report on efforts to implement information security requirements under Government Information Security Reform law, DOD reported that it has an aggressive information assurance program and highlighted several initiatives to improve it. These initiatives included developing an overall strategy and issuing numerous departmentwide information security policy documents. DOD's reporting highlighted other accomplishments, but acknowledged that a number of challenges remain for the department in implementing both its policies and procedures and statutory information security requirements. DOD reported several material control weaknesses, which included needing to decrease the time necessary for correcting reported weaknesses and ensuring that computer security policies are enforced and security capabilities are tested regularly. Further, performance data DOD reported for a sample of its systems showed that further efforts are needed to fully implement key information security requirements, such as testing systems' security controls, throughout the department. Although DOD has undertaken its Defense-wide Information Assurance Program to promote integrated, comprehensive, and consistent practices across the department and has recently issued both policy guidance and implementation instructions, it does not have mechanisms in place for comprehensively measuring compliance with federal and Defense information security policies and ensuring that those policies are consistently practiced throughout DOD.