FCC initiated the ESN project in order to continue its response  to the incident, mitigate the risk to its information resources from the  malicious software, reduce the risk of a successful future attack, and  address weaknesses in its security controls and network architecture. FCC Did Not Effectively Implement Appropriate Information Security Controls in the Initial Components of Enhanced Secured Network Project

FCC did not effectively implement appropriate information security  controls in the initial components of the ESN project. As a result, FCC limited the  effectiveness of its security enhancements and its sensitive information  remained at unnecessary risk of inadvertent or deliberate misuse,  improper disclosure, or destruction. As a result of these and other deficiencies, FCC faces an unnecessary  risk that individuals could gain unauthorized access to its sensitive  systems and information. FCC Did Not Fully Implement Key Risk Management Activities in Developing and Deploying the Initial Components of the Enhanced Secured Network Project

The information security weaknesses in the initial portions of the project  occurred, in part, because FCC had not fully performed key information  security activities during the development and deployment of these initial  components. While we agree that the security threat  makes implementation urgent, using an iterative methodology would not  negate the need to perform security risk management activities called for  by federal guidelines and the commission’s policies. FCC Has Not Consistently Implemented Key Procedures for Managing the Enhanced Secured Network Project

Given the significance of the ESN project to FCC’s information security, it  is important that the project be managed effectively to ensure that the  project succeeds in its goal of addressing weaknesses in FCC’s security  controls and network architecture. Cost estimation. FCC did not  establish a reliable schedule for the ESN project. Specifically:
Sequencing all activities. Maintaining a baseline schedule. Additionally, the prime contractor did  not document plans for how project risks would be addressed. Although the commission reported that the  project is within cost and on schedule, the lack of a reliable life cycle cost  estimate and project schedule, inconsistent management of project risks,  and inconsistent oversight may leave FCC management and Congress  without sufficient awareness of the total life-cycle costs for developing  and deploying the ESN, sufficient assurance that the commission will be  able to successfully complete the project by its scheduled completion  date, and adequate understanding of potential obstacles to the success of  the project. Unless FCC more effectively  implements its IT security policies, improves its project management  practices, and conducts regular oversight in accordance with commission  policies, unnecessary risk exists that the ESN project may not succeed in  its purpose of effectively protecting the commission’s systems and  information. Recommendations for Executive Action

To help strengthen IT and project management controls over the ESN  project, we recommend that the Chairman of the FCC take the following  seven actions:
Perform key security risk management activities for the ESN project  including selecting and documenting the security controls, assessing  the implementation of the controls, and authorizing the system to  operate. In a separate report with limited distribution, we are also making 26  recommendations associated with 21 findings to resolve technical  information security weaknesses related to access controls and  configuration management of the ESN. Appendix I: Objectives, Scope, and Methodology

Our objectives were to assess the extent to which the Federal  Communications Commission (FCC) has (1) effectively implemented  appropriate information security controls for the initial components of its  Enhanced Secured Network (ESN) project; and (2) implemented  appropriate procedures to manage and oversee its ESN project. We  also compared documentation of ESN project activities and plans to these  requirements and practices, and interviewed commission officials about  FCC’s policies and ESN’s information security practices.
Why GAO Did This Study

In September 2011, FCC discovered that it had experienced a security breach on its computer network, which potentially allowed sensitive information to be compromised. The commission initiated the ESN project to implement enhanced security controls and an improved network architecture to defend against cyber attacks and reduce the risk of a successful future attack. GAO was asked to assess the extent to which FCC has (1) effectively implemented appropriate information security controls for the initial components of the ESN project, and (2) implemented appropriate procedures to manage and oversee its ESN project. To do so, GAO determined the effectiveness of ESN security controls by evaluating control configurations and identifying management controls; and determined how FCC applied them to the ESN project by analyzing documentation and interviewing commission officials.

What GAO Found

The Federal Communications Commission (FCC) did not effectively implement appropriate information security controls in the initial components of the Enhanced Secured Network (ESN) project. Although FCC took steps to enhance its ability to control and monitor its network for security threats, weaknesses identified in the commission's deployment of components of the ESN project as of August 2012 resulted in unnecessary risk that sensitive information could be disclosed, modified, or obtained without authorization. This occurred, in part, because FCC did not fully implement key information security activities during the development and deployment of the initial components of the project. While FCC policy is to integrate security risk management into system life-cycle management activities, the commission instead deployed the initial components of the ESN project without, among other things, first selecting and documenting the security controls, assessing the controls, or authorizing the system to operate. As a result of these deficiencies, FCC's information remained at unnecessary risk of inadvertent or deliberate misuse, improper disclosure, or destruction. Further, addressing these deficiencies could require costly and timeconsuming rework.
FCC's efforts to effectively manage the ESN project were hindered by its inconsistent implementation of procedures for estimating costs, developing and maintaining an integrated schedule, managing project risks, and conducting oversight. If not addressed, these weaknesses could pose challenges for the commission to achieve the project's goal of improved security. Specifically, FCC
had not developed a reliable life cycle cost estimate for ESN that includes all implementation costs;
did not, in its project schedule, adequately identify the sequence in which activities must occur, ensure that detailed activities were traceable to higherlevel activities, or establish a baseline schedule;
documented and managed some risks to project success, but its prime contractor did not identify any project risks until after the deployment of the initial components of the ESN project had begun; and
had not included the ESN project in its processes for conducting regular oversight of information technology projects.
According to FCC officials, a key reason that they had not fully applied their policies or widely accepted best practices for security risk management and project management is because the ESN project was an emergency project and, therefore, needed to be initiated quickly. However, while GAO agrees that the security threat makes implementation urgent, it does not negate the need to perform key security risk management activities. Unless FCC more effectively implements its IT security policies and improves its project management practices and effectively applies them to the ESN project, unnecessary risk exists that the project may not succeed in its purpose of effectively protecting the commission's systems and information.

What GAO Recommends

GAO is making seven recommendations to the FCC to implement management controls to help ensure that ESN meets its objective of securing FCC's systems and information. In commenting on a draft of this report, FCC concurred with the recommendations. In a separate report with limited distribution, GAO is also making 26 recommendations to resolve technical information security weaknesses related to access controls and configuration management of the ESN.