FCC improved its security after breach, but did it move too fast?
Connecting state and local government leaders
After a September 2011 data breach, FCC rushed to enhance security, but ignored security management practices and created unnecessary risks in its IT systems, GAO says.
When the Federal Communications Commission discovered it had an IT security breach in 2011, it embarked on an emergency response to correct the problem with an Enhanced Secured Network.
But now the Government Accountability Office says that in its rush to implement the network, the commission created unnecessary risks in the system.
The ESN was born when outside consultants discovered a security breach in September 2011 during an upgrade of the FCC’s security monitoring system. The initial response was to identify and remove infected workstations and to find the underlying problems that allowed the breach, which also spurred a broader emergency response plan that became the ESN project.
In November the FCC received approval from the Office of Management and Budget to use $10 million in previously de-obligated funds. Congress signed off on the program in December.
But in its report, GAO said, “The FCC did not effectively implement appropriate information security controls in the initial components of the ESN project. “This occurred, in part, because FCC did not fully implement key information security activities during the development and deployment of the initial components of the project.”
The commission countered that even with cutting corners, “today, the FCC’s network is stronger, better, and more secure than it was before the commission started these upgrade efforts.”
The ESN has evolved as the project nears completion, and the FCC said in its written response that it has revisited the work and completed basic project and security management tasks that had been bypassed during the initial emergency response phase.
The commission’s strategy was to be agile in its response, wrote FCC Managing Director David Robbins. “The FCC monitored its risks and held regular management meetings to ensure that the project stayed on time, on budget and on plan for the deliverables,” he wrote.
The ESN project was scheduled to run from February 2012 through January 2013 and included two major efforts:
- Enhanced security controls through changes to the network architecture and by implementing new capabilities, including additional intrusion detection tools, network firewalls, and audit and monitoring tools.
- A sustainable cyber threat analysis and mitigation program that will include risk management guidelines for assessing threats and mitigation strategies. This would allow the determination of the criticality of assets, assessing the likelihood of threats to these assets, and identifying actions to reduce those risks and mitigate the consequences of an attack.
The program ran parallel with ongoing security initiatives, but because of the emergency nature, “it was designed to avoid an increased in security risks posed by delays in implementation while keeping the FCC fully operational.”
The initial components were installed in July 2012 and ESN has been brought in under budget and with only minor schedule deviations, the commission said.
The current target date for completion is Feb. 25, and network security has improved through the project. The FCC says that the GAO report reflects a time when the FCC faced “an unusual level of urgency,” and progress has been made since then.
“The FCC’s overall network security is in a better place now as a result of the ESN project,” and IT management has improved, Robbins wrote in his response.
“While GAO agrees that the security threat makes implementation urgent, it does not negate the need to perform key security risk management activities,” the watchdog agency said in its report.
GAO criticized the FCC process because initial ESN components were deployed without a full system life-cycle management program in place and without first selecting and documenting necessary security controls. Established procedures for cost estimates, scheduling and oversight also were not fully employed.
The GAO report recommended a number of steps to correct those failings, which the FCC said have been implemented or are under way.