	Background

The Census Bureau’s mission is to collect and provide comprehensive  data about the nation’s people and economy. Control Weaknesses Threaten Information and Systems that Support Census Bureau Mission

Although the Census Bureau has taken steps to safeguard the  information and systems that support its mission, security control  weaknesses pervaded its systems and networks, thereby jeopardizing the  bureau’s ability to sufficiently protect the confidentiality, integrity, and  availability of its information and systems. As a result, the bureau  has limited assurance that its information and information systems are  being adequately protected against unauthorized access, use, disclosure,  modification, disruption, or loss. However, the bureau did not sufficiently control connectivity to key  network devices and servers. Typically, this requires that  the key be encrypted using some form of activation data such as a  password. Although the Census Bureau had established an access control  requirement based on least privilege and need-to-know principles, the  bureau did not always limit user access rights and permissions to only  those necessary to perform official duties. These controls include policies, procedures, and techniques  to (1) manage and implement system configurations, and (2) establish  plans for contingencies if normal operations are disrupted. However, the bureau did not always  implement configuration management controls. For example, the bureau provided evidence that it had  taken steps to actively mitigate disruptions to its primary data center  through the implementation of emergency power, fire suppression, and  flood mitigation measures. Additionally, the bureau stored backup copies  of data for its critical systems off site at a secured location. However, the  Census Bureau did not satisfy many of the other practices for contingency  planning. Without an effective and complete contingency plan, an  agency’s likelihood of recovering important systems in a timely manner is  diminished. A key reason for the weaknesses in controls over the Census Bureau’s  information and information systems is that it has not yet implemented all  elements of its agencywide information security program to ensure that  controls are effectively established and maintained. Until the bureau  addresses identified control weaknesses and fully implements its  information security program, it will have limited assurance that its  information and information systems are adequately protected against  unauthorized access, disclosure, modification, or loss. 13. In a separate report with limited distribution, we are making 102  recommendations to address the technical weaknesses related to access  controls, configuration management, and contingency planning that we  identified. In  its comments, the Census Bureau expressed broad agreement with the  overall theme of the report but did not directly comment on the  recommendations. However, it raised  concerns about four specific aspects of the summary of findings which  GAO addressed as appropriate. Appendix I: Objective, Scope, and Methodology

The objective of our review was to determine whether the Census Bureau  effectively implemented appropriate information security controls to  protect the confidentiality, integrity, and availability of the information and  systems that support its mission. reviewed network access paths to determine if boundaries had been  adequately protected; reviewed the complexity and expiration of password settings to  determine if password management was being enforced; analyzed users’ system authorizations to determine whether they had  more permissions than necessary to perform their assigned functions; observed configurations for providing secure data transmissions  across the network to determine whether sensitive data were being  encrypted; reviewed software security settings to determine if modifications of  sensitive or critical system resources had been monitored and logged; reviewed the Census Bureau’s implementation of continuous  monitoring and use of automated tools to determine the extent to  which it uses these tools to manage IT assets and monitor the  security configurations and vulnerabilities for its IT assets; observed physical access controls to determine if computer facilities  and resources were being protected from espionage, sabotage,  damage, and theft; examined configuration settings and access controls for routers,  network management servers, switches, and firewalls;  inspected key servers and workstations to determine if critical patches  had been installed and/or were up to date; and examined polices, and procedures, and implementation of controls  related to segregation of duties. Using the requirements identified by the Federal Information Security  Management Act of 2002, which establishes key elements for an effective  agencywide information security program, and associated NIST  guidelines and bureau requirements, we evaluated the Census Bureau’s  information security program by: analyzing processes and documentation that were part of the  bureau’s new risk management framework implementation to  determine the extent to which it accurately characterized information  security risks; analyzing bureau policies, procedures, practices, and standards to  determine their effectiveness in providing guidance to personnel  responsible for securing information and information systems,  including areas such as segregation of duties; examining the security awareness training process for employees and  contractors to determine whether they had received training according  to federal requirements; examining training records for personnel who have significant  responsibilities to determine whether they had received training  commensurate with those responsibilities; and reviewing bureau policies and procedures and a selection of  information security incidents to determine the extent to which bureau  incident handling practices complied with applicable NIST guidelines  and federal requirements.
Why GAO Did This Study

The Census Bureau is responsible for collecting and providing data about the people and economy of the United States. The bureau has long used some form of automation to tabulate the data it collects. Critical to the bureaus ability to perform these duties are its information systems and the protection of the information they contain. A data breach could result in the publics loss of confidence in the bureaus and could affect its ability to collect census data.
Because of the importance of protecting information and systems at the bureau, GAO was asked to determine whether the agency has effectively implemented appropriate information security controls to protect the confidentiality, integrity, and availability of the information and systems that support its mission. To do this, GAO tested security controls over the bureaus key networks and systems; reviewed policies, plans, and reports; and interviewed officials at bureau headquarters and field offices.

What GAO Found

Although the Census Bureau has taken steps to safeguard the information and systems that support its mission, it has not effectively implemented appropriate information security controls to protect those systems. Many of the deficiencies relate to the security controls used to regulate who or what can access the bureau's systems (access controls). For example, the bureau did not adequately: control connectivity to key network devices and servers; identify and authenticate users; limit user access rights and permissions to only those necessary to perform official duties; encrypt data in transmission and at rest; monitor its systems and network; or ensure appropriate physical security controls were in place. Without adequate controls over access to its systems, the bureau cannot be sure that its information and systems are protected from intrusion.
In addition to access controls, implementing other important security controls including policies, procedures, and techniques to implement system configurations and plan for and manage unplanned events (contingency planning) helps to ensure the confidentiality, integrity, and availability of information and systems. While the Census Bureau had documented policies and procedures for managing and implementing configuration management controls, key communication systems were not securely configured and did not have proper encryption. Further, while the bureau has taken steps to implement guidance for contingency planning such as developing plans for mitigating disruptions to its primary data center through the use of emergency power, fire suppression, and storing backup copies of data for its critical systems offsite at a secured location, it only partially satisfied other requirements for contingency planning such as distributing the plan to key personnel and identifying potential weaknesses during disaster testing. Without an effective and complete contingency plan, an agency's likelihood of recovering its information and systems in a timely manner is diminished.
An underlying reason for these weaknesses is that the Census Bureau has not fully implemented a comprehensive information security program to ensure that controls are effectively established and maintained. Specifically, the Census Bureau had begun implementing a new risk management framework with a goal of better management visibility of information security risks, but the framework did not fully document identified information security risks. Also, the bureau had not updated certain security management program policies, adequately enforced user requirements for security and awareness training, and implemented policies and procedures for incident response. Until the bureau implements a complete and comprehensive security program, it will have limited assurance that its information and systems are being adequately protected against unauthorized access, use, disclosure, modification, disruption, or loss.

What GAO Recommends

GAO is making 13 recommendations to the Census Bureau to enhance its agencywide information security program and, in a separate report with limited distribution, making an additional 102 recommendations. In written comments, the Department of Commerce expressed broad agreement with the overall theme of the report and said it would work to identify the best way to address our recommendations, but did not directly comment on the recommendations. It raised concerns about specific aspects of the reported findings which GAO addressed as appropriate.