NARA Relies on Information Systems to Accomplish Its Mission

NARA depends on a number of key information systems to conduct its  daily business functions and support its mission. For example, it has developed a policy for granting or  denying access rights to its resources, employs mechanisms to prevent  and respond to security breaches, and makes use of encryption  technologies to protect sensitive data. NARA had not securely configured several of its systems. Media can include magnetic tapes, optical disks (such as  compact disks), and hard drives. NIST recommends that  organizations test sanitization equipment and procedures to verify correct  performance. However, NARA has not always ensured that equipment used for removing  sensitive information was tested annually. NARA conducted the appropriate background investigations for the  employees and contractors we reviewed. Incompatible Duties Were Not Always Effectively Segregated

Segregation of duties refers to the policies, procedures, and organizational  structures that help ensure that no single individual can independently  control all key aspects of a process or computer-related operation and  thereby gain unauthorized access to assets or records. NARA did not always implement effective segregation of duties controls. NARA Has Not Fully Implemented All Elements of Its Information Security Program

A key reason for the weaknesses in information security controls intended  to protect NARA’s systems is that the agency has not yet fully  implemented its agencywide information security program to ensure that  controls are effectively established and maintained. FISMA requires each  agency to develop, document, and implement an information security  program that, among other things, includes    periodic assessments of the risk and the magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems;   policies and procedures that (1) are based on risk assessments, (2) cost- effectively reduce risks, (3) ensure that information security is addressed  throughout the life cycle of each system, and (4) ensure compliance with  applicable requirements;   plans for providing adequate information security for networks, facilities,    security awareness training to inform personnel of information security  risks and of their responsibilities for complying with agency policies and  procedures, as well as training personnel with significant security  responsibilities for information security;    periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, which is to be performed with a  frequency depending on risk, but no less than annually, and which  includes testing the management, operational, and technical controls for  every system identified in the agency’s required inventory of major  information systems;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in its information security  policies, procedures, or practices;   procedures for detecting, reporting, and responding to security incidents;    plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. However, NARA did not always include required controls in its system  security plans. 2). For example, a POA&M for a system designed  to receive, preserve, and provide access to electronic records is dated  December 2008. However, NARA was not able to locate all of its weekly reports  for incidents and did not consistently apply its criteria for incident  categorization. III), the Archivist of the United States stated that he was pleased with the  positive recognition of NARA’s efforts and that he generally concurred  with our recommendations. In addition, the Archivist in his comments disagreed with three of the  report’s findings. Thus, we continue to believe our finding is valid. Appendix I: Objective, Scope, and Methodology

The objective of our review was to determine whether the National  Archives and Records Administration (NARA) has effectively implemented  appropriate information security controls to protect the confidentiality,  integrity, and availability of the information and systems that support its  mission. Using our Federal Information System Controls  Audit Manual which contains guidance for reviewing information system  controls that affect the confidentiality, integrity, and availability of  computerized information; National Security Agency guidance; National  Institute of Standards and Technology (NIST) standards and guidance; and  NARA’s policies, procedures, practices, and standards, we evaluated these  controls by  reviewing network access paths to determine if boundaries were  adequately protected; reviewing the complexity and expiration of password settings to  determine if password management was enforced;   analyzing users’ system authorizations to determine whether they had  more permission than necessary to perform their assigned functions;   observing methods for providing secure data transmissions across the  network to determine whether sensitive data were being encrypted; reviewing software security settings to determine if modifications of  sensitive or critical system resources were monitored and logged;   observing physical access controls over unclassified and classified areas  to determine if computer facilities and resources were being protected  from espionage, sabotage, damage, and theft;   examining configuration settings and access controls for routers, network  management servers, switches, and firewalls;  inspecting key servers and workstations to determine if critical patches  had been installed and/or were up to date; reviewing media handling policy, procedures, and equipment to determine  if sensitive data were cleared from digital media before media were  disposed of or reused; reviewing nondisclosure agreements at select locations to determine if  they are required for personnel with access to sensitive information; and    examining access roles and responsibilities to determine whether  incompatible functions were segregated among different individuals.
Why GAO Did This Study

The National Archives and Records Administration (NARA) is responsible for preserving access to government documents and other records of historical significance and overseeing records management throughout the federal government. NARA relies on the use of information systems to receive, process, store, and track government records. As such, NARA is tasked with preserving and maintaining access to increasing volumes of electronic records. GAO was asked to determine whether NARA has effectively implemented appropriate information security controls to protect the confidentiality, integrity, and availability of the information and systems that support its mission. To do this, GAO tested security controls over NARA's key networks and systems; reviewed policies, plans, and reports; and interviewed officials at nine sites.

What GAO Found

NARA has not effectively implemented information security controls to sufficiently protect the confidentiality, integrity, and availability of the information and systems that support its mission. Although it has developed a policy for granting or denying access rights to its resources, employed mechanisms to prevent and respond to security breaches, and made use of encryption technologies to protect sensitive data, significant weaknesses pervade its systems. NARA did not fully implement access controls, which are designed to prevent, limit, and detect unauthorized access to computing resources, programs, information, and facilities. Specifically, the agency did not always (1) protect the boundaries of its networks by, for example, ensuring that all incoming traffic was inspected by a firewall; (2) enforce strong policies for identifying and authenticating users by, for example, requiring the use of complex (i.e., not easily guessed) passwords; (3) limit users' access to systems to what was required for them to perform their official duties; (4) ensure that sensitive information, such as passwords for system administration, was encrypted so as not to be easily readable by potentially malicious individuals; (5) keep logs of network activity or monitor all parts of its networks for possible security incidents; and (6) implement physical controls on access to its systems and information, such as securing perimeter and exterior doors and controlling visitor access to computing facilities. In addition to weaknesses in access controls, NARA had mixed results in implementing other security controls. For example: (1) NARA did not always ensure equipment used for sanitization (i.e., wiping clean of data) and disposal of media (e.g., hard drives) was tested to verify correct performance. (2) NARA conducted appropriate background investigations for employees and contractors to ensure sufficient clearance requirements have been met before permitting access to information and information systems. (3) NARA did not consistently segregate duties among various personnel to ensure that no one person or group can independently control all key aspects of a process or operation. The identified weaknesses can be attributed to NARA not fully implementing key elements of its information security program. Specifically, the agency did not adequately assess risks facing its systems, consistently prepare and document security plans for its information systems, effectively ensure that all personnel were given relevant security training, effectively test systems' security controls, consistently track security incidents, and develop contingency plans for all its systems. Collectively, these weaknesses could place sensitive information, such as records containing personally identifiable information, at increased and unnecessary risk of unauthorized access, disclosure, modification, or loss.

What GAO Recommends

GAO is making 11 recommendations to the Archivist of the United States to implement elements of NARA's information security program. In commenting on a draft of this report, the Archivist generally concurred with GAO's recommendations but disagreed with some of the report's findings. GAO continues to believe that the findings are valid.