The Assistant Administrator of the Office of  Environmental Information serves as the Chief Information Officer for  EPA. Control Weaknesses Threaten Information and Systems Supporting EPA’s Mission

Although EPA has taken steps to safeguard the information and systems  that support its mission, security control weaknesses pervade its systems  and networks, thereby jeopardizing the agency’s ability to sufficiently  protect the confidentiality, integrity, and availability of its information and  systems. As a result, EPA has limited assurance that its information and  information systems are being adequately protected against unauthorized  access, use, disclosure, modification, disruption, or loss. Agencies accomplish this objective by designing and implementing  controls that are intended to prevent, limit, and detect unauthorized  access to computing resources, programs, information, and facilities. Although EPA has established an access control methodology based on  least privilege and need-to-know principles, it did not always limit user  access rights and permissions to only those necessary to perform official  duties. EPA did not always effectively encrypt certain sensitive information. For  example, EPA did not always encrypt private keys stored on certain  servers and had used a weak password encryption feature on network  devices. We have not yet verified this information. EPA Did Not Effectively Implement Other Controls

In addition to access controls, other important controls should be in place  to ensure the confidentiality, integrity, and availability of an agency’s  information. Despite these efforts, EPA had not always implemented configuration  management controls. EPA has conducted the appropriate background investigations for all 14  employees and contractors reviewed. EPA Has Not Fully Documented and Implemented Components of Its Information Security Program

A key reason for the weaknesses in controls over EPA’s information and  information systems is that it has not yet fully implemented its agencywide  information security program to ensure that controls were effectively  established and maintained. FISMA requires each agency to develop,  document, and implement an information security program that, among  other things, includes policies and procedures that (1) are based on risk assessments, (2)  cost-effectively reduce risks, (3) ensure that information security is  addressed throughout the life cycle of each system, and (4) ensure  compliance with applicable requirements; plans for providing adequate information security for networks,  facilities, and systems;  security awareness training to inform personnel of information security  risks and their responsibilities in complying with agency policies and  procedures, and information security training for personnel with  significant security responsibilities for information security; periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices, to be performed with a  frequency depending on risk, but no less than annually, and that  includes testing of management, operational, and technical controls  for every system identified in the agency’s required inventory of major  information systems; a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in its information security  policies, procedures, or practices; and plans and procedures to ensure continuity of operations for  information systems that support operations and assets of the agency. However, until EPA fully implements these controls, it will have  limited assurance that its information and information systems are being  adequately protected against unauthorized access, disclosure,  modification, and loss. Update system security plans to reflect current policies and  procedures. In a separate report with limited distribution, we are also making 94  detailed recommendations to correct weaknesses in access controls and  in other information security controls. Agency Comments and Our Evaluation

In providing written comments on a draft of this report (reprinted in app. Appendix I: Objective, Scope, and Methodology

The objective of our review was to determine whether the Environmental  Protection Agency (EPA) had effectively implemented appropriate  information security controls to protect the confidentiality, integrity, and  availability of the information and systems that support its mission. Using the requirements identified by the Federal Information Security  Management Act of 2002 (FISMA), which establishes key elements for an  effective agencywide information security program, and associated NIST  guidelines and EPA requirements, we evaluated EPA systems and  networks by analyzing EPA policies, procedures, practices, and standards to  determine their effectiveness in providing guidance to personnel  responsible for securing information and information systems; analyzed security plans for six systems to determine if those plans  had been documented and updated according to federal guidance; examined the security awareness training process for employees and  contractors to determine whether they had received training according  to federal requirements; examined training records for personnel who have significant  responsibilities to determine whether they had received training  commensurate with those responsibilities; analyzed EPA’s procedures and results for testing and evaluating  security controls to determine whether management, operational, and  technical controls for six systems had been sufficiently tested at least  annually and based on risk;  reviewed EPA’s implementation of continuous monitoring and use of  automated tools to determine the extent to which it uses these tools to  manage IT assets and monitor the security configurations and  vulnerabilities for its IT assets; evaluated EPA’s process to correct weaknesses and determine  whether remedial action plans complied with federal guidance; and examined contingency plans for six systems to determine whether  those plans had been developed and tested.
Why GAO Did This Study

EPA is responsible for protecting human health and the environment by implementing and enforcing the laws and regulations intended to improve the quality of the nations air, water, and lands. The agencys policies and programs affect virtually all segments of the economy, society, and government. In addition, it relies extensively on networked computer systems to collect a wealth of environmental data and to disseminate much of this information while also protecting other forms of sensitive or confidential information.
Because of the importance of the security of EPAs information systems, GAO was asked to determine whether the agency has effectively implemented appropriate information security controls to protect the confidentiality, integrity, and availability of the information and systems that support its mission. To do this, GAO tested security controls over EPAs key networks and systems; reviewed policies, plans, and reports; and interviewed officials at EPA headquarters and two field offices.

What GAO Found

Although the Environmental Protection Agency (EPA) has taken steps to safeguard the information and systems that support its mission, security control weaknesses pervaded its systems and networks, thereby jeopardizing the agencys ability to sufficiently protect the confidentiality, integrity, and availability of its information and systems. The agency did not fully implement access controls, which are designed to prevent, limit, and detect unauthorized access to computing resources, programs, information, and facilities. Specifically, the agency did not always (1) enforce strong policies for identifying and authenticating users by, for example, requiring the use of complex (i.e., not easily guessed) passwords; (2) limit users access to systems to what was required for them to perform their official duties; (3) ensure that sensitive information, such as passwords for system administration, was encrypted so as not to be easily readable by unauthorized individuals; (4) keep logs of network activity or monitor key parts of its networks for possible security incidents; and (5) control physical access to its systems and information, such as controlling visitor access to computing equipment. In addition to weaknesses in access controls, EPA had mixed results in implementing other security controls. For example, EPA conducted appropriate background investigations for employees and contractors to ensure sufficient clearance requirements had been met before permitting access to information and information systems. However,
EPA had not always securely configured network devices and updated operating system and database software with patches to protect against known vulnerabilities.
EPA had not always ensured equipment used for sanitization and disposal of media was tested to verify correct performance.
An underlying reason for the control weaknesses is that EPA has not fully implemented a comprehensive information security program. Although EPA has established a framework for its security program, the agency has not yet fully implemented all elements of its program. Specifically, it did not always finalize policies and procedures to guide staff in effectively implementing controls; ensure that all personnel were given relevant security training to understand their roles and responsibilities; update system security plans to reflect current agency security control requirements; assess management, operational, and technical controls for agency systems at least annually and based on risk; and implement a corrective action process to track and manage all weaknesses when remedial actions were necessary. Sustained management oversight and monitoring are necessary for EPA to implement these key information security practices and controls. Until EPA fully implements a comprehensive security program, it will have limited assurance that its information and information systems are adequately protected against unauthorized access, use, disclosure, modification, disruption, or loss.

What GAO Recommends

GAO is making 12 recommendations to the Administrator of EPA to fully implement elements of EPAs comprehensive information security program. In commenting on a draft of this report, EPAs Assistant Administrator generally agreed with GAOs recommendations. Two of GAOs recommendations were revised to incorporate EPAs comments. In a separate report with limited distribution, GAO is also making 94 recommendations to EPA to enhance access and other information security controls over its systems.