NASA’s mission is to pioneer the future of space  exploration, scientific discovery, and aeronautics research. Control Weaknesses Jeopardize NASA Systems and Networks

Although NASA had implemented many information security controls to  protect networks supporting its missions, weaknesses existed in several  critical areas. Specifically, the centers did not consistently implement  effective electronic access controls, including user accounts and  passwords, access rights and permissions, encryption of sensitive data,  protection of information system boundaries, audit and monitoring of  security-relevant events, and physical security to prevent, limit, and detect  access to their networks and systems. NASA did not adequately identify and authenticate users in systems and  networks supporting mission directorates. These controls include policies, procedures, and control techniques to (1)  appropriately segregate incompatible duties and (2) manage system  configurations and implement patches. FISMA requires agencies to develop,  document, and implement an information security program that, among  other things, includes    periodic assessments of the risk and magnitude of harm that could result  from the unauthorized access, use, disclosure, disruption, modification, or  destruction of information and information systems;    policies and procedures that (1) are based on risk assessments, (2) cost  effectively reduce information security risks to an acceptable level, (3)  ensure that information security is addressed throughout the life cycle of  each system, and (4) ensure compliance with applicable requirements;   plans for providing adequate information security for networks, facilities,    periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, to be performed with a frequency  depending on risk, but no less than annually, and that includes testing of  management, operational, and technical controls for every system  identified in the agency’s required inventory of major information systems;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in its information security  policies, procedures, or practices;   plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency; and   procedures for detecting, reporting, and responding to security incidents. For  example, NASA had not always (1) fully assessed information security  risks; (2) fully developed and documented security policies and  procedures; (3) included key information in security plans; (4) conducted  comprehensive tests and evaluation of its information system controls; (5)  tracked the status of plans to remedy known weaknesses; (6) planned for  contingencies and disruptions in service; (7) maintained capabilities to  detect, report, and respond to security incidents; and (8) incorporated  important security requirements in its contract with JPL. Despite Actions to Address Security Incidents, NASA Remains Vulnerable

NASA has experienced numerous cyber attacks on its networks and  systems in recent years. Significantly, these were not isolated   incidents since NASA reported 209 incidents of unauthorized access to US- CERT during fiscal years 2007 and 2008. In addition, the SOC was established in 2008 to enhance  prevention and provide early detection of security incidents and  coordinate agency-level information related to NASA’s security posture. The control vulnerabilities and program  shortfalls that we identified collectively increase the risk of unauthorized  access to NASA’s sensitive information, as well as inadvertent or  deliberate disruption of its system operations and services. They make it  possible for intruders, as well as government and contractor employees, to  bypass or disable computer access controls and undertake a wide variety  of inappropriate or malicious acts. As a result, increased and unnecessary  risk exists that sensitive information will be subject to unauthorized  disclosure, modification, and destruction and that mission operations  could be disrupted. A key reason  for these vulnerabilities is that NASA has not yet fully implemented its  information security program to ensure that controls are appropriately  designed and operating effectively. GAO staff who made major contributions to this  report are listed in appendix V.

Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) determine the effectiveness of the  National Aeronautics and Space Administration’s (NASA) information  security controls in protecting the confidentiality, integrity, and  availability of its networks supporting mission directorates and (2) assess  the vulnerabilities identified during the audit in the context of NASA’s  prior security incidents and corrective actions.
Why GAO Did This Study

The National Aeronautics and Space Administration (NASA) relies extensively on information systems and networks to pioneer space exploration, scientific discovery, and aeronautics research. Many of these systems and networks are interconnected through the Internet, and may be targeted by evolving and growing cyber threats from a variety of sources. GAO was directed to (1) determine whether NASA has implemented appropriate controls to protect the confidentiality, integrity, and availability of the information and systems used to support NASA's mission directorates and (2) assess NASA's vulnerabilities in the context of prior incidents and corrective actions. To do this, GAO examined network and system controls in place at three centers; analyzed agency information security policies, plans, and reports; and interviewed agency officials.

What GAO Found

Although NASA has made important progress in implementing security controls and aspects of its information security program, it has not always implemented appropriate controls to sufficiently protect the confidentiality, integrity, and availability of the information and systems supporting its mission directorates. Specifically, NASA did not consistently implement effective controls to prevent, limit, and detect unauthorized access to its networks and systems. For example, it did not always sufficiently (1) identify and authenticate users, (2) restrict user access to systems, (3) encrypt network services and data, (4) protect network boundaries, (5) audit and monitor computer-related events, and (6) physically protect its information technology resources. In addition, weaknesses existed in other controls to appropriately segregate incompatible duties and manage system configurations and implement patches. A key reason for these weaknesses is that NASA has not yet fully implemented key activities of its information security program to ensure that controls are appropriately designed and operating effectively. Specifically, it has not always (1) fully assessed information security risks; (2) fully developed and documented security policies and procedures; (3) included key information in security plans; (4) conducted comprehensive tests and evaluation of its information system controls; (5) tracked the status of plans to remedy known weaknesses; (6) planned for contingencies and disruptions in service; (7) maintained capabilities to detect, report, and respond to security incidents; and (8) incorporated important security requirements in its contract with the Jet Propulsion Laboratory. Despite actions to address prior security incidents, NASA remains vulnerable to similar incidents. NASA networks and systems have been successfully targeted by cyber attacks. During fiscal years 2007 and 2008, NASA reported 1,120 security incidents that have resulted in the installation of malicious software on its systems and unauthorized access to sensitive information. To address these incidents, NASA established a Security Operations Center in 2008 to enhance prevention and provide early detection of security incidents and coordinate agency-level information related to its security posture. Nevertheless, the control vulnerabilities and program shortfalls, which GAO identified, collectively increase the risk of unauthorized access to NASA's sensitive information, as well as inadvertent or deliberate disruption of its system operations and services. They make it possible for intruders, as well as government and contractor employees, to bypass or disable computer access controls and undertake a wide variety of inappropriate or malicious acts. As a result, increased and unnecessary risk exists that sensitive information is subject to unauthorized disclosure, modification, and destruction and that mission operations could be disrupted.