Security weaknesses 'pervade' EPA systems, audit finds

The lack of a comprehensive cybersecurity strategy has left the Environmental Protection Agency without adequate information security, according to an audit by the Government Accountability Office.

“Although EPA has taken steps to safeguard the information and systems that support its mission, security control weaknesses pervade its systems and networks, thereby jeopardizing the agency’s ability to sufficiently protect the confidentiality, integrity, and availability of its information and systems,” the GAO said its report.

The shortcomings include inadequate access control for systems and data, as well as inconsistent physical security, inadequate configuration management and inadequate security configuration.

Related stories:

Bosses and CISOs: What we've got here is failure to communicate

IRS systems leave taxpayer data at risk, audit finds

“A key reason for these weaknesses is that EPA has not yet fully implemented its agencywide information security program to ensure that controls are appropriately designed and operating effectively,” GAO concluded.

A comprehensive, agencywide plan for IT security is one of the requirements of the Federal Information Security Management Act. Although the agency has developed policies, they have not been finalized. “Until EPA has finalized and implemented its security policies and procedures, the agency cannot be sure that its information security requirements are being applied consistently and effectively across the agency,” GAO said.

GAO provided a lengthy list of recommendations for improving its security status, which the agency has agreed to implement.

EPA is a relatively small agency with a budget of $8.6 billion in fiscal 2011, but it operates nationally with 10 regions that connect to an EPA private network. The Washington headquarters houses its Office of Technology Operations and a National Computer Center is located in Research Triangle Park in North Carolina. It is supported by 117 agency-operated IT systems and another dozen systems operated by contractors. The agency plans to move its e-mail and collaboration services to a commercial cloud provider by 2015 as part of the government’s Cloud First initiative.

But cybersecurity remains a challenge for the agency at a time when federal systems are under increasing pressure from hackers, criminals and nation states, GAO said.

“Protection of mission-critical and sensitive information technology (IT) resources on information systems remains an ongoing challenge for EPA as federal agencies experience evolving and growing cyber attacks,” the report said.

The bulk of the problems detailed in the audit were in the area of access control, which keeps unauthorized visitors out of agency IT resources and defines the resources that authorized persons are allowed to have access to. Although the agency has established network boundaries to secure connectivity into and out of its networks, restrictions are not adequately enforced.

EPA has developed an interim security policy for identification and authentication of persons accessing its systems, but it has not been fully implemented. Routing protocols on some network devices are not authenticated and requirements for strong passwords are not enforced. Two-factor authentication for remote access is not always required.

Once users are inside the system, there is a lack of controls on what resources they are authorized to access. “Although EPA has established an access control methodology based on least privilege and need-to-know principles, it did not always limit user access rights and permissions to only those necessary to perform official duties,” GAO said. Auditors found unused accounts from former employees and inadequate restrictions on accounts.

Other problems included inadequate encryption on some sensitive data such as stored passwords and encryption keys, inadequate monitoring of network activity and inadequate security configurations and management.

“Some EPA information systems and network devices were running outdated software that was no longer supported by the manufacturer, resulting in EPA being unable to effectively patch them for vulnerabilities,” GAO found. “In addition, newly released security patches, service packs, and hot fixes had not been installed in a timely manner, and several critical systems had not been patched or were out of date, and some had known vulnerabilities.”

Among the dozen recommendations included in the report are:

• Update and enforce configuration management procedures.

• Finalize and enforce interim information security policies and draft procedures and update them to reflect current policies and procedures.

• Develop and finalize role-based security training procedures.

• Test security controls at least annually.

• Implement an agencywide, uniform method for approving contingency plans, with procedures to annually test their viability.

• Implement procedures to verify the accuracy of system inventory information.

GAO also made 94 additional detailed recommendations in a separate report with limited distribution.