Cyber-based threats are evolving and growing and arise from a wide  array of sources. Reports of incidents affecting VA’s systems and information highlight the  serious impact that inadequate information security can have on, among  other things, the confidentiality, integrity, and availability of veterans’  personal information. Previously Identified Information Security Challenges

As we recently testified, VA has faced long-standing challenges in  effectively implementing its information security program. Although VA Has Taken Mitigation Actions, Previously Identified Vulnerabilities Continue to Exist

While VA has taken actions to mitigate previously identified security  vulnerabilities, they were insufficient to ensure that these weaknesses  were fully addressed. Specifically, VA took steps to contain and eradicate  an incident involving intrusion of its network, but these activities were not  fully effective. Finally, weaknesses identified  on VA’s workstations (e.g., laptop computers) had not been corrected in a  timely manner. VA’s NSOC had analyzed the  scope of the incident and documented actions taken in response. However, VA could not provide sufficient documentation to demonstrate  that these actions were effective. For this particular  incident at VA, staff could not locate the associated forensic analysis  report or other key materials. Without  maintaining evidence of incidents, VA cannot demonstrate the  effectiveness of its incident response activities and will be unable to use  these records to assist in handling future incidents or aiding law  enforcement authorities in investigating and prosecuting crimes. Specifically, VA had planned to implement a  solution that would have corrected the weakness in February 2014, but at  the time of our review, the solution had not been implemented. VA did  take other actions to mitigate the weakness—specifically, limiting the use  of the affected system. However, VA’s  policies did not define the authority for NSOC’s access to logs of activity  on VA’s network that are collected at VA’s data centers. As we reported in April 2014, VA’s incident  response policies defined roles and responsibilities but did not include  authorities for the incident response team. VA concurred with this recommendation. Implementing this recommendation should include providing the NSOC  with appropriate authority to review logs of activity on VA’s network. For example, it is performing an analysis to determine how  best to further restrict access to the VA network and is planning to  purchase new incident response tools. However, it has not established a  time frame for completing these actions. VA Did Not Address All Weaknesses Identified in Key Web Applications

NIST guidance and VA policy both require applications to be tested prior  to authorization in order to detect security weaknesses or vulnerabilities. Without plans of action and milestones for  correcting high-risk vulnerabilities, VA has less assurance that these  weaknesses will be corrected in a timely and effective manner. In addition, a 2012 VA memo  requires that critical patches be applied within 30 days. Regarding these missing patches,  they had been available for periods ranging from 4 to 31 months;  there were multiple occurrences of each of the 10 missing patches,  ranging from approximately 9,200 to 286,700; and each patch is intended to mitigate multiple potential known  vulnerabilities, ranging from 5 to 51 vulnerabilities, with an average of  about 30 and a total of 301 vulnerabilities. In May 2013, it established an organization tasked with  overseeing the Service Delivery and Engineering group’s process for  identifying, prioritizing, and remediating vulnerabilities on VA  information systems; ensuring baseline configurations and security standards are updated  as new vulnerabilities are discovered and remediated; ensuring software standards are continually reviewed and updated  and that installed software versions comply with these standards;  identifying, collecting, analyzing, and reporting performance metrics to  measure the effectiveness of the patch and vulnerability management,  baseline configuration maintenance, and software standards  maintenance processes; and proposing changes to improve these processes. This organization has taken initial steps to carry out its responsibilities. In addition, without fully addressing an underlying  vulnerability that allowed a serious intrusion to occur, increased risk exists  that such an incident could recur. Further, limitations in VA’s approach to  identifying and addressing vulnerabilities in key web applications, such as  not developing plans of action and milestones to address identified  vulnerabilities and not scanning all application source code for defects,  put veterans’ sensitive information at greater risk of compromise. Recommendations for Executive Action

To address previously identified security vulnerabilities, we are  recommending that the Secretary of Veterans Affairs take the following  eight actions:
Update the department’s standard operating procedure to require  evidence associated with security incidents to be maintained for at  least 3 years, consistent with NARA guidance. While we  acknowledge that VA has efforts underway to address previously  identified weaknesses, until it comprehensively and effectively addresses  the weaknesses, sensitive personal information entrusted to the  department will be at increased risk of unauthorized access, modification,  disclosure, or loss. Appendix I: Objective, Scope, and Methodology

Our objective was to determine the extent to which selected, previously  identified vulnerabilities continue to exist on Department of Veterans  Affairs (VA) computer systems. To address this objective, we reviewed actions taken to address  vulnerabilities that had been identified by VA’s Network and Security  Operations Center (NSOC). We also reviewed vulnerabilities NSOC had identified in two key VA web  applications.
Why GAO Did This Study

In carrying out its mission to ensure the health, welfare, and dignity of the nation's veterans, VA relies extensively on information technology systems that collect, process, and store veterans' sensitive information. Without adequate safeguards, these systems and information are vulnerable to a wide array of cyber-based threats. Moreover, VA has faced long-standing challenges in adequately securing its systems and information, and reports of recent incidents have highlighted the serious impact of inadequate information security on the confidentiality, integrity, and availability of veterans' personal information.
GAO was asked to review VA's efforts to address information security vulnerabilities. The objective for this work was to determine the extent to which selected, previously identified vulnerabilities continued to exist on VA computer systems. To do this, GAO reviewed VA actions taken to address previously identified vulnerabilities, including a significant network intrusion, vulnerabilities in two key web-based applications, and security weaknesses on devices connected to VA's network. GAO also reviewed the results of VA security testing; interviewed relevant officials and staff; and reviewed policies, procedures, and other documentation.

What GAO Found

While the Department of Veterans Affairs (VA) has taken actions to mitigate previously identified vulnerabilities, it has not fully addressed these weaknesses. For example, VA took actions to contain and eradicate a significant incident detected in 2012 involving a network intrusion, but these actions were not fully effective:
The department's Network and Security Operations Center (NSOC) analyzed the incident and documented actions taken in response. However, VA could not produce a report of its forensic analysis of the incident or the digital evidence collected during this analysis to show that the response had been effective. VA's procedures do not require all evidence related to security incidents to be kept for at least 3 years, as called for by federal guidance. As a result, VA cannot demonstrate the effectiveness of its incident response and may be hindered in assisting in related law enforcement activities.
VA has not addressed an underlying vulnerability that allowed the incident to occur. Specifically, the department has taken some steps to limit access to the affected system, but, at the time of GAO's review, VA had not fully implemented a solution for correcting the associated weakness. Without fully addressing the weakness or applying compensating controls, increased risk exists that such an incident could recur.
Further, VA's policies did not provide the NSOC with sufficient authority to access activity logs on VA's networks, hindering its ability to determine if incidents have been adequately addressed. In an April 2014 report, GAO recommended that VA revise its incident response policies to ensure the incident response team had adequate authority, and VA concurred.
Further, VA's actions to address vulnerabilities identified in two key web applications were insufficient. The NSOC identified vulnerabilities in these applications through testing conducted as part of the system authorization process, but VA did not develop plans of action and milestones for correcting the vulnerabilities, resulting in less assurance that these weaknesses would be corrected in a timely and effective manner.
Finally, vulnerabilities identified in VA's workstations (e.g., laptop computers) had not been corrected. Specifically, 10 critical software patches had been available for periods ranging from 4 to 31 months without being applied to workstations, even though VA policy requires critical patches to be applied within 30 days. There were multiple occurrences of each missing patch, ranging from about 9,200 to 286,700, and each patch was to address an average of 30 security vulnerabilities. VA decided not to apply 3 of the 10 patches until it could test their impact on its applications; however, it did not document compensating controls or plans to migrate to systems that support up-to-date security features. While the department has established an organization to improve its vulnerability remediation, it has yet to identify specific actions and milestones for carrying out related responsibilities. Until VA fully addresses previously identified security weaknesses, its information is at heightened risk of unauthorized access, modification, and disclosure and its systems at risk of disruption.

What GAO Recommends

GAO is making eight recommendations to VA to address identified weaknesses in incident response, web applications, and patch management. In commenting on a draft of this report, VA stated that it concurred with GAO's recommendations.