Objectives, Scope, and Methodology

Our objectives were to (1) determine how susceptible the State Department’s automated information systems are to unauthorized access, (2) identify what the State Department is doing to address information security issues, and (3) determine what additional actions may be needed. To determine how susceptible State’s systems are to unauthorized access, we tested the department’s technical and physical controls for ensuring that data, systems, and facilities were protected from unauthorized access. State Lacks a Comprehensive Information Security Program

Our tests were successful primarily because State’s computer security program is not comprehensive enough to effectively manage the risks to which its systems and networks are exposed. For example, the department does not have the information it needs to effectively manage its risks—it does not fully appreciate the sensitivity of its information, the vulnerabilities of its systems, or the costs of countermeasures. Moreover, top managers at State have not demonstrated that they are committed to strengthening security over the systems that they rely on for nearly every aspect of State’s operations. Ability to monitor and evaluate the effectiveness of policy and other controls. State has no information security plan. Greater Internet Connectivity Poses Additional Risks

Internet security was the only area in which we found that State’s controls were currently adequate. Recognizing this, State conducted an analysis of the risks involved with increasing Internet use. However, the department has not yet decided to what extent it will accept and/or address these new risks. These steps include ensuring that top managers are fully aware of the need to protect State’s computer resources, establishing a strong central management focal point to remedy the diluted and fragmented security management structure, and addressing the risks of additional external connectivity before expanding its Internet usage. Establish a central information security unit and assign it responsibility for facilitating, coordinating, and overseeing the department’s information security activities. Establish and implement key controls to help the department protect its information systems and information, including periodic penetration testing to identify vulnerabilities in State’s assessments of the department’s ability to (1) react to intrusion and attacks on its information systems, (2) respond quickly and effectively to security incidents, (3) help contain and repair any damage caused, and (4) prevent future damage, and central reporting and tracking of information security incidents to ensure that knowledge of these problems can be shared across the department and with other federal agencies. If State expands Internet connectivity without effectively mitigating the significant additional risks that entails, it will increase its already serious vulnerabilities to individuals or organizations seeking to damage State’s operations, commit terrorism, or obtain financial gain.
Why GAO Did This Study

Pursuant to a congressional request, GAO reviewed: (1) how susceptible the Department of State's unclassified automated information systems are to unauthorized access; (2) what State is doing to address information security issues; and (3) what additional actions may be needed to address the computer security problem.

What GAO Found

GAO noted that: (1) State's information systems and the information contained within them are vulnerable to access, change, disclosure, disruption or even denial of service by unauthorized individuals; (2) GAO conducted penetration tests to determine how susceptible State's systems are to unauthorized access and found that it was able to access sensitive information; (3) moreover, GAO's penetration of State's computer resources went largely undetected, further underscoring the department's serious vulnerability; (4) the results of GAO's tests show that individuals or organizations seeking to damage State operations, commit terrorism, or obtain financial gain could possibly exploit the department's information security weaknesses; (5) although State has some projects under way to improve security of its information systems and help protect sensitive information, it does not have a security program that allows State officials to comprehensively manage the risks associated with the department's operations; (6) State lacks a central focal point for overseeing and coordinating security activities; (7) State does not routinely perform risk assessments to protect its sensitive information based on its sensitivity, criticality, and value; (8) the department's primary information security policy document is incomplete; (9) the department lacks key controls for monitoring and evaluating the effectiveness of its security programs and it has not established a robust incident response capability; (10) State needs to greatly accelerate its efforts and address these serious information security weaknesses; (11) however, to date, its top managers have not demonstrated that they are committed to doing so; (12) Internet security was the only area in which GAO found that State's controls were currently adequate; (13) however, plans to expand its Internet usage will create new security risks; (14) State conducted an analysis of the risks involved with using the Internet more extensively, but has not yet decided how to address the security risks of additional external connectivity to the concerns this review has raised; and (15) if State increases its Internet use before instituting a comprehensive security program and addresses the additional vulnerabilities unique to the Internet, it will unnecessarily increase the risks of unauthorized access to its systems and information.