Incidents Place Sensitive Information at Risk

Since May 2006, federal agencies have reported a spate of security  incidents that put sensitive data at risk. Personally identifiable  information about millions of Americans has been lost, stolen, or  improperly disclosed, thereby exposing those individuals to loss of  privacy, identity theft, and financial crimes. Agencies have  experienced a wide range of incidents involving data loss or theft,  computer intrusions, and privacy breaches, underscoring the need  for improved security practices. Most agencies did not implement controls to sufficiently prevent,  limit, or detect access to computer networks, systems, or  information. For example, agencies did not consistently (1) identify  and authenticate users to prevent unauthorized access, (2) enforce  the principle of least privilege to ensure that authorized access was  necessary and appropriate, (3) establish sufficient boundary  protection mechanisms, (4) apply encryption to protect sensitive  data on networks and portable devices, and (5) log, audit, and  monitor security-relevant events. Agencies also lacked effective  controls to restrict physical access to information assets. Agencies did not always configure network devices and services to  prevent unauthorized access and ensure system integrity, such as  patching key servers and workstations in a timely manner; assign  incompatible duties to different individuals or groups so that one  individual does not control all aspects of a process or transaction;  and maintain or test continuity of operations plans for key  information systems. Agencywide Security Programs Were Not Fully Implemented

An underlying cause for information security weaknesses identified  at federal agencies is that they have not yet fully or effectively  implemented all the FISMA-required elements for an agencywide  information security program. However, IGs at several agencies sometimes disagreed  with the information reported by the agency and have identified  weaknesses in the processes used to implement these and other  security program activities. Opportunities Exist to Enhance Reporting and Independent Evaluations

Periodic reporting of performance measures for FISMA  requirements and related analysis provides valuable information on  the status and progress of agency efforts to implement effective  security management programs; however, opportunities exist to  enhance reporting under FISMA and the independent evaluations  completed by IGs. In summary, as illustrated by recent incidents at federal agencies,  significant weaknesses in information security controls threaten the  confidentiality, integrity, and availability of critical information and  information systems used to support the operations, assets, and  personnel of federal agencies. Almost all major agencies exhibit  weaknesses in one or more areas of information security controls. Despite these persistent weaknesses, agencies have continued to  report steady progress in implementing certain information security  requirements. However, IGs sometimes disagreed with the agency’s  reported information and identified weaknesses in the processes  used to implement these and other security program activities.
Why GAO Did This Study

For many years, GAO has reported that weaknesses in information security are a widespread problem with potentially devastating consequences--such as intrusions by malicious users, compromised networks, and the theft of personally identifiable information--and has identified information security as a governmentwide high-risk issue. Concerned by reports of significant vulnerabilities in federal computer systems, Congress passed the Federal Information Security Management Act of 2002 (FISMA), which permanently authorized and strengthened the information security program, evaluation, and reporting requirements for federal agencies. In this testimony, GAO discusses security incidents reported at federal agencies, the continued weaknesses in information security controls at major federal agencies, agencies' progress in performing key control activities, and opportunities to enhance FISMA reporting and independent evaluations. To address these objectives, GAO analyzed agency, inspectors general (IG), and GAO issued and draft reports on information security.

What GAO Found

Federal agencies have recently reported a spate of security incidents that put sensitive data at risk. Personally identifiable information about millions of Americans has been lost, stolen, or improperly disclosed, thereby exposing those individuals to loss of privacy, identity theft, and financial crimes. The wide range of incidents involving data loss or theft, computer intrusions, and privacy breaches underscore the need for improved security practices. As illustrated by these security incidents, significant weaknesses in information security controls threaten the confidentiality, integrity, and availability of critical information and information systems used to support the operations, assets, and personnel of federal agencies. Almost all of the major federal agencies had weaknesses in one or more areas of information security controls. Most agencies did not implement controls to sufficiently prevent, limit, or detect access to computer networks, systems, or information. For example, agencies did not consistently identify and authenticate users to prevent unauthorized access, apply encryption to protect sensitive data on networks and portable devices, and restrict physical access to information assets. In addition, agencies did not always manage the configuration of network devices to prevent unauthorized access and ensure system integrity, such as patching key servers and workstations in a timely manner; assign incompatible duties to different individuals or groups so that one individual does not control all aspects of a process or transaction; and maintain or test continuity of operations plans for key information systems. An underlying cause for these weaknesses is that agencies have not fully or effectively implemented agencywide information security programs. Nevertheless, federal agencies have continued to report steady progress in implementing certain information security requirements. However, IGs at several agencies sometimes disagreed with the agency's reported information and identified weaknesses in the processes used to implement these and other security program activities. Further, opportunities exist to enhance reporting under FISMA and the independent evaluations completed by IGs.