Although iPost Does Not Provide a Complete View of Information Security Risks, It Helps to Prioritize Vulnerability Mitigation Efforts

The iPost risk scoring program identifies and prioritizes several but not all  areas affecting information security risk to State’s IT infrastructure. Specifically, the scope of the iPost risk scoring program:    addresses Windows hosts but not other IT assets on the OpenNet  network, such as routers and switches;  covers a set of 10 scoring components that includes several but not  all information system controls that are intended to reduce risk; and    assigns a score for each identified security weakness, but the extent  to which the score reflects risk factors such as the impact and  likelihood of threat occurrence that are specific to State’s computing  environment could not be demonstrated. As a result, the iPost risk scoring program helps to identify, monitor, and  prioritize mitigation of vulnerabilities and weaknesses for the areas it  covers, but it does not provide a complete view of the information security  risks to the department. 3. State Uses iPost to Identify, Prioritize, and Implement Improvements on Windows Hosts

State officials surveyed responded that they used iPost to (1) identify,  prioritize, and fix security weaknesses and vulnerabilities on Windows  devices and (2) implement other security improvements at their sites. 1). 2). For example, more than half of the  40 respondents said that assigning a numeric score to each vulnerability  identified and each component was very or moderately helpful in their  efforts to prioritize vulnerability mitigation. 4). 5). State has developed and implemented several controls that are intended  to ensure the timeliness, accuracy, and completeness of iPost data. For  example, State has employed the use of automated tools to collect  monitoring data that are integrated into iPost. State also has used data collection schedules that support the  frequent collection of monitoring data. Notwithstanding these controls, the timeliness, accuracy, and  completeness of iPost data were not always assured. For example,  several instances where iPost data were not updated as frequently as  scheduled, inconsistent, or incomplete are illustrated below. Consequently, iPost users may make risk  management decisions based on inaccurate or incomplete data. iPost Provides Many Benefits, but Also Poses Challenges

State’s implementation of iPost has resulted in improvements to the  department’s information security by providing extensive and timely  information on vulnerabilities and weaknesses on Windows servers and  workstations, while also creating an environment where officials are  motivated to fix vulnerabilities based on department priorities. However,  State has faced, and will continue to face, challenges in implementing  iPost. These challenges include overcoming limitations and technical  issues with data collection tools, identifying and notifying individuals with  responsibility for site-level security, implementing configuration  management, and adopting a continuous monitoring strategy for moving  forward in incorporating additional functionality into iPost. Recommendations for Executive Action

To improve implementation of iPost at State, we recommend that the  Secretary of State direct the Chief Information Officer to take the following  seven actions:  Incorporate the results of iPost’s monitoring of controls into key  security documents such as the OpenNet security plan, security  assessment report, and plan of action and milestones. The  department also concurred with two of our recommendations, partially  concurred with two, and did not concur with three. As we noted in the report, the department relies on users to report when  inaccurate and incomplete iPost data and scoring is identified, so that it  may be investigated and corrected as appropriate—even though there is  no list in iPost showing who is responsible for a particular operational unit. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to determine (1) the extent to which the  Department of State (State) has identified and prioritized risk to the  department in its risk scoring program; (2) how agency officials use iPost  information to implement security improvements; (3) the controls for  ensuring the timeliness, accuracy, and completeness of iPost information;  and (4) the benefits and challenges associated with implementing iPost.
Why GAO Did This Study

The Department of State (State) has implemented a custom application called iPost and a risk scoring program that is intended to provide continuous monitoring capabilities of information security risk to elements of its information technology (IT) infrastructure. Continuous monitoring can facilitate nearer real-time risk management and represents a significant change in the way information security activities have been conducted in the past. GAO was asked to determine (1) the extent to which State has identified and prioritized risk to the department in its risk scoring program; (2) how agency officials use iPost information to implement security improvements; (3) the controls for ensuring the timeliness, accuracy, and completeness of iPost information; and (4) the benefits and challenges associated with implementing iPost. To do this, GAO analyzed program documentation and compared it to relevant standards, interviewed and surveyed department officials, and performed analyses on iPost data.

What GAO Found

State has developed and implemented a risk scoring program that identifies and prioritizes several but not all areas affecting information security risk. Specifically, the scope of iPost's risk scoring program (1) addresses Windows hosts but not other IT assets on its major unclassified network; (2) covers a set of 10 scoring components that includes many, but not all, information system controls that are intended to reduce risk; and (3) assigns a score for each identified security weakness, although State could not demonstrate the extent to which scores are based on risk factors such as threat, impact, or likelihood of occurrence that are specific to its computing environment. As a result, the iPost risk scoring program helps to identify, monitor, and prioritize the mitigation of vulnerabilities and weaknesses for the areas it covers, but it does not provide a complete view of the information security risks to the department. State officials reported they used iPost to (1) identify, prioritize, and fix Windows vulnerabilities that were reported in iPost and (2) to implement other security improvements at their sites. For example, more than half of the 40 survey respondents said that assigning a numeric score to each vulnerability identified and each component was very or moderately helpful in their efforts to prioritize vulnerability mitigation. State has implemented several controls aimed at ensuring the timeliness, accuracy, and completeness of iPost information. For example, State employed the use of automated tools and collection schedules that support the frequent collection of monitoring data, which helps to ensure the timeliness of iPost data. State also relies on users to report when inaccurate and incomplete iPost data and scoring are identified, so they may be investigated and corrected as appropriate. Notwithstanding these controls, the timeliness, accuracy, and completeness of iPost data were not always assured. For example, several instances existed where iPost data were not updated as frequently as scheduled, inconsistent, or incomplete. As a result, State may not have reasonable assurance that data within iPost are accurate and complete with which to make risk management decisions. iPost provides many benefits but also poses challenges for the department. iPost has resulted in improvements to the department's information security by providing more extensive and timely information on vulnerabilities, while also creating an environment where officials are motivated to fix vulnerabilities based on department priorities. However, State has faced, and will continue to face, challenges with the implementation of iPost. These include (1) overcoming limitations and technical issues with data collection tools, (2) identifying and notifying individuals with responsibility for site-level security, (3) implementing configuration management for iPost, (4) adopting a strategy for continuous monitoring of controls, and (5) managing stakeholder expectations for continuous monitoring activities.

What GAO Recommends

GAO recommends the Secretary of State direct the Chief Information Officer to take a number of actions aimed at improving implementation of iPost. State agreed with two of GAO's recommendations, partially agreed with two, and disagreed with three. GAO continues to believe that its recommendations are valid and appropriate.