LANL Has Information Security Controls in Place to Protect Its Unclassified Network, but Weaknesses Remain

LANL has implemented measures to enhance its information security, but  weaknesses remain. In particular, LANL has implemented a network  security system that can detect potential intrusions on the network. However, LANL has vulnerabilities in several critical areas, including (1)  identifying and authenticating users, (2) encrypting sensitive information,  (3) monitoring and auditing compliance with security policies, (4)  controlling and documenting changes to a computer system’s hardware  and software, and (5) restricting physical access to computing resources. However,  strong authentication was not always used. Once a user successfully  accessed the network, the user could create a separate login password  that would allow alternative access to sensitive information on the  unclassified network. Furthermore, LANL neither uses encryption to protect certain network  management connections, nor requires encryption for authentication to  certain internal services. However, it did not fully characterize risks to the network. Policies and procedures. DOE’s Office of Independent Oversight and LASO Have Also Raised Concerns about Foreign Nationals’ Access to LANL’s Unclassified Network

DOE’s Office of Independent Oversight and LASO also reported that LANL  had not fully implemented DOE policies and procedures for protecting  sensitive but unclassified information from foreign nationals who have  access to information technology resources. Of the 688 foreign nationals, 301 (or 44 percent) were  from countries classified as sensitive by DOE. In addition, a significant number of foreign nationals from sensitive  countries have been authorized remote access to LANL’s unclassified  network. In response,  NNSA’s Chief Information Officer told us that LANL has not adequately  justified its request for additional funds to address the laboratory’s stated  shortfalls. NNSA is now implementing a more systematic approach for  developing information security budgets at LANL. LANL Officials Assert That Resources Are Inadequate to Protect the Unclassified Network

LANL spent approximately $51.4 million from fiscal years 2001 through  2007 to protect and maintain the unclassified network. Moreover, there was risk that  LANL could not ensure that media (e.g., disks) containing sensitive  unclassified information would be properly sanitized or destroyed. While the laboratory has taken steps to protect sensitive  information, a number of weaknesses in security controls raise concerns. Recommendations for Executive Action

To improve LANL’s information security program for its unclassified  network, we recommend that the Secretary of Energy and the  Administrator of NNSA require the Director of Los Alamos National  Laboratory to take the following eight actions:    Ensure that the risk assessment for the unclassified network evaluates all  known vulnerabilities and is revised periodically;   Strengthen policies with a view toward further reducing, as appropriate,  foreign nationals’—particularly those from countries identified by DOE as  sensitive—access to the unclassified network;   Ensure that the new set of cyber security policies and procedures  applicable to the unclassified network are comprehensive, including  centralized configuration management for all types of systems, and  contain specific instructions on how to implement federal requirements  and guidance;   Ensure that the network security plan for the unclassified network is  revised to document security controls using federal guidance and that this  plan also includes or references key security activities, such as risk  assessment development and the evaluation of security test results;    Strengthen the security test and evaluation process for the unclassified  network by expanding technical testing to cover new areas that might be  vulnerable, such as those disclosed in our report, and ensure that testing  adequately considers federal guidance for evaluating security controls and  determining their effectiveness;   Ensure that milestones in corrective action plans are met or that new  milestones are established to remediate security weaknesses for the  unclassified network in a timely manner. NNSA did not specifically comment on our recommendations. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) assess the effectiveness of the  security controls the Los Alamos National Laboratory (LANL) has  implemented to protect information transmitted over its unclassified  computer network; (2) assess whether LANL had fully implemented an  information security program to ensure that controls were established and  maintained for its unclassified computer network; and (3) examine the  expenditure of funds used to protect LANL’s unclassified network from  fiscal years 2001 through 2007.
Why GAO Did This Study

The Los Alamos National Laboratory (LANL), which is operated by the National Nuclear Security Administration (NNSA), has experienced security lapses protecting information on its unclassified computer network. The unclassified network contains sensitive information. GAO (1) assessed the effectiveness of the security controls LANL has in place to protect information transmitted over its unclassified computer network, (2) assessed whether LANL had implemented an information security program for its unclassified network, and (3) examined expenditures to protect LANL's unclassified network from fiscal years 2001 through 2007. To carry out its work, GAO examined security policies and procedures and reviewed the laboratory's access controls for protecting information on the unclassified network.

What GAO Found

LANL has implemented measures to enhance its information security, but weaknesses remain in protecting the confidentiality, integrity, and availability of information on its unclassified network. LANL has implemented a network security system that is capable of detecting potential intrusions. However, GAO found vulnerabilities in several critical areas, including (1) identifying and authenticating users, (2) encrypting sensitive information, and (3) monitoring and auditing compliance with security policies. For example, LANL had implemented strong authentication measures for accessing the network. However, once gaining this access, a user could create a simple password that would allow alternative access to certain sensitive information. Furthermore, LANL did not use encryption for authentication to certain internal services, which increased the risk that sensitive information transmitted over the unclassified network could be compromised. A key reason for the information security weaknesses is that the laboratory has not implemented an information security program to ensure that controls are effectively established and maintained. For example, LANL did not adequately assess information security risks or develop effective policies and procedures to govern the security of its computing environment. LANL's most recent risk assessment for the unclassified network generally identified and analyzed vulnerabilities, but did not account for risks identified by internal vulnerability testing. Deficiencies in LANL's policies and procedures have been the subject of reports by the Department of Energy's (DOE) Office of Independent Oversight and the Los Alamos Site Office, including foreign nationals' access to the unclassified network. GAO found that, as of May 2008, 301 (or 44 percent) of 688 foreign nationals, who had access to the unclassified network, were from countries classified as sensitive by DOE, such as China, India, and Russia. In addition, a significant number of foreign nationals from sensitive countries were authorized remote access to LANL's unclassified network. The number of foreign nationals with access has raised concerns among laboratory and NNSA officials because of the sensitive information contained on the unclassified network. In response, the laboratory has taken some measures to limit foreign nationals' access. From fiscal years 2001 through 2007, LANL spent approximately $51.4 million to protect its unclassified network. LANL cyber security officials told us that funding has been inadequate to address some of their security concerns. Specifically, there was a risk that unclassified network users would no longer receive cyber security training and that the laboratory would not be able to ensure that data containing sensitive unclassified information would be properly sanitized or destroyed. However, NNSA officials asserted that LANL has not adequately justified its requests for additional funds. NNSA is in the process of implementing a more systematic approach for developing budgets for cyber security activities across the nuclear weapons complex, including LANL.