To execute its mission responsibilities, FBI relies extensively on  information technology. Certain Controls over FBI’s Network Were Ineffective

Weaknesses existed in certain access controls and other controls intended  to protect the confidentiality, integrity, and availability of the law  enforcement and investigative information transmitted by a critical  internal network. FBI used various devices to secure its network; however, it did not  consistently configure network devices and services to prevent  unauthorized access to, and ensure the integrity of, the network. FBI established the Enterprise Security Operations Center (ESOC) to  monitor and protect the bureau’s information systems from external  attacks and insider misuse, and to serve as the central point of contact for  near real-time security monitoring. The bureau’s patch management for the network was ineffective. Information Security Program

Weaknesses in access controls and patch management existed, in part,  because FBI had not yet effectively or fully implemented key security  activities associated with its agencywide information security program for  the critical internal network reviewed. Although FBI has developed an  information security program, shortcomings exist with certain key  elements. FISMA requires agencies to implement an agencywide information  security program that includes    periodic assessments of the risk and the magnitude of harm that could  result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information and information systems;   policies and procedures that (1) are based on risk assessments, (2) cost- effectively reduce risks, (3) ensure that information security is addressed  throughout the life cycle of each system, and (4) ensure compliance with  applicable requirements;   plans for providing adequate information security for networks, facilities,    security awareness training to inform personnel—including contractors  and other users of information systems—of information security risks and  of their responsibilities in complying with agency policies and procedures;   at least annual testing and evaluation of the effectiveness of information  security policies, procedures, and practices relating to management,  operational, and technical controls of every major information system that  is identified in the agencies’ inventories;    a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in their information security  policies, procedures, or practices; and   plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency. However, FBI did not fully or effectively implement many of these  activities for the critical internal network reviewed. Risk Assessments

Identifying and assessing information security risks are essential steps in  determining what controls are required. These weaknesses leave the bureau vulnerable to insider  threats. Correct identified weaknesses in a timely manner. Other shortcomings included an  incomplete security plan, incomplete specialized training, insufficient  testing, untimely remediation of weaknesses and inadequate service  continuity planning. Although positive efforts have been made, until FBI  fully and effectively implements key activities of the information security  program associated with its network, security controls will likely remain  inadequate or inconsistently applied, and the bureau will have limited  assurance that sensitive data will be adequately protected against  unauthorized disclosure or modification, or that network services will not  be interrupted.
Why GAO Did This Study

The Federal Bureau of Investigation (FBI) relies on a critical network to electronically communicate, capture, exchange, and access law enforcement and investigative information. Misuse or interruption of this critical network, or disclosure of the information traversing it, would impair FBI's ability to fulfill its missions. Effective information security controls are essential for ensuring that information technology resources and information are adequately protected from inadvertent or deliberate misuse, fraudulent use, disclosure, modification, or destruction. GAO was asked to assess information security controls for one of FBI's critical networks. To assess controls, GAO conducted a vulnerability assessment of the internal network and evaluated the bureau's information security program associated with the network operating environment. This report summarizes weaknesses in information security controls in one of FBI's critical networks.

What GAO Found

Certain information security controls over the critical internal network reviewed were ineffective in protecting the confidentiality, integrity, and availability of information and information resources. Specifically, FBI did not consistently (1) configure network devices and services to prevent unauthorized insider access and ensure system integrity; (2) identify and authenticate users to prevent unauthorized access; (3) enforce the principle of least privilege to ensure that authorized access was necessary and appropriate; (4) apply strong encryption techniques to protect sensitive data on its networks; (5) log, audit, or monitor security-related events; (6) protect the physical security of its network; and (7) patch key servers and workstations in a timely manner. Taken collectively, these weaknesses place sensitive information transmitted on the network at risk of unauthorized disclosure or modification, and could result in a disruption of service, increasing the bureau's vulnerability to insider threats. These weaknesses existed, in part, because FBI had not fully implemented key information security program activities for the critical network reviewed. FBI has developed an agencywide information security program, which includes an organization to monitor and protect the bureau's information systems from external attacks and insider misuse and to serve as the central focal point of contact for near-real-time security monitoring. However, shortcomings exist with certain program elements for the network, including an outdated risk assessment, incomplete security plan, incomplete specialized security training, insufficient testing, untimely remediation of weaknesses, and inadequate service continuity planning. Without a fully implemented program, certain security controls will likely remain inadequate or inconsistently applied.