EPA writes an in-house FISMA tool

Faced with the task of complying with the Federal Information Security Management Act, the Environmental Protection Agency developed a tool to automate the evaluation and reporting processes. And that's good news for other agencies, too.'FISMA reporting has become less onerous at our agency than at many,' Mark Day, director of EPA's Office of Technology Operations and Planning, said at a recent event near Washington.The EPA tool, Assert, is a software product that assembles IT system data, answers standardized questions and generates reports. The goal is to make FISMA a security tool rather than a paperwork exercise.'We've tried to take the focus off the reporting and put it on implementation,' said Marian Cody, associate director of OTOP's technical information security staff.Assert has helped EPA boost its grade on the House Government Reform Committee's annual IT security report card to a B. EPA thinks it has invented a pretty good wheel in Assert, and that there is no reason for every agency to reinvent it.'We all go through the same process every year, and we learn things,' Cody said.EPA wants to share what it has learned by offering Assert to other agencies, either under a software license or as a managed service, to help with regulatory compliance. It has responded to the Office of Management and Budget's request for information from agencies wanting to provide services under a proposed IT security line of business and already is providing Assert to a handful of other organizations, including the General Services Administration and the Social Security Administration.EPA also is encouraging vendors to integrate commercial scanning and assessment tools into Assert to provide the data needed to produce reports. BindView Corp. of Houston is one of the first companies to partner with EPA in the program. It is enabling its bv-Control suite to directly feed Assert, and will help in marketing Assert to federal users. BindView's bv-Control is a configuration management portfolio that performs security audits, identifies vulnerabilities, deploys patches and more.Assert works because it focuses on process rather than technology, said John J. Balena, BindView's director of public sector sales. 'It is a governance and management problem,' he said.Assert is based on a FISMA self-assessment questionnaire developed by the National Institute of Standards and Technology. Agencies must answer more than 250 questions about each of its IT systems each quarter, then produce and track a plan of action and milestones for correcting weaknesses. The task of answering questions and compiling reports has been measured in man-days for each system, and often overshadows the job of improving security.'It is painful in the extreme,' Cody said. 'We've been able to reduce that painful process to about two or three hours a year for the system and application owners.'Although EPA is not a particularly large agency, it has 18,000 personnel at 195 sites around the country and overseas, and it maintains large volumes of confidential data. It is a law enforcement agency with armed agents, it holds trade secrets and proprietary information from many companies, and its rulings and policies affect the business decisions of industries around the world.A Government Accountability Office review of IT security performance provided the stimulus for the Assert project, Day said. 'GAO exposed our weaknesses to us, and we took it seriously. We were an F agency and we deserved it at that point.'Added Cody, 'We were black and blue.'EPA spent about a year developing Assert and has been using it for three years at a total cost of about $100,000. Much of that was up-front cost incurred during the development phase, Day said.'Today, it's pretty low cost, and I couldn't spend the equivalent dollars on brute force and get any results,' he said.Providing services and software to other agencies will help drive costs down even more.Assert is built on an Oracle database and has a Web interface. It does not scan systems or do discovery, but provides a way for system owners to evaluate themselves against NIST standards. The data it uses for evaluation can come from third-party products such as bv-Control, which has an agentless scanning tool that gives administrators a snapshot of a system's operating systems, applications and other components. Once it has the data, it can produce the necessary reports for in-house management and regulatory compliance.Automatically generating the reports is not only easier, it is also more accurate, Cody said.'We do not re-enter data,' she said. 'When we do a report, we're pushing buttons.' It is an easy process for the user, but 'it took a long time to figure out the algorithms under the reports.'Assert also does not push fixes and patches out to systems, but it can create plans of action for correcting problems. Because every action taken is recorded in the database, it also provides an auditable trail for reviewers.Assert now is in version 4, and a new feature is being added to automate the process of categorizing system security levels under Federal Information Processing Standard 199.EPA expects to see continued improvements in Assert, Cody said.'In the coming years I'd like to see the FISMA report reduced to a series of about 10 questions,' she said. 'The FISMA report shouldn't be a[n] end in itself.'Day said when EPA did its first IT security self-assessment, just 34 percent of its systems were FISMA compliant. Today that figure has come up to 96 percent and the agency has received a B on the congressional IT security scorecard. He said he'd like to stay at a B, or maybe a B+.'We're not at A,' he said. 'I'm terrified of even getting an A from Congress. I don't want the hackers to know I've got an A and I don't want management to think everything is fixed and get complacent.'