GAO: FBI networks remain at risk

By Wilson P. Dizard III

| May 25, 2007

A GAO audit has warned that despite measures the FBI has implemented to tighten IT security, its critical networks for exchanging law enforcement data remain at risk.

"Taken collectively, these weaknesses place sensitive information transmitted on the network at risk of unauthorized disclosure or modification, and could result in a disruption of service, increasing the bureau's vulnerability to insider threats," according to GAO.The FBI's alleged IT security failures recall the dismal history of the Robert Hansen espionage case, in which a tech-savvy double agent within the bureau's counterintelligence office sold key secrets to the Soviet Union and later to Russia.Hansen's treachery relied in large part on backward and inconsistent FBI technology security. It led to the exposure of federal espionage operations that were both very expensive and very promising, as well as the unmasking of agents working overseas who were executed.The auditors recognized that the FBI has adopted an information security program that covers the entire agency and includes an organization to monitor and protect its systems from external attacks and insider misuse, according to the report.However, the FBI's security measures that protect its network suffer from an outdated risk assessment; incomplete plans, testing and training; slow remediation of problems; and poor continuity-of-operations measures, the report said."Without a fully implemented program, certain security controls will likely remain inadequate or inconsistently applied," the auditors wrote. , .

The FBI has failed to fully implement its IT security program and as a result its critical networks for exchanging law enforcement information remain vulnerable to misuse or interruption, the Government Accountability Office said in a report issued today.

Bureau officials provided a written response incorporated in the GAO report that accepted many of the report's recommendations but rejected the congressional audit agency's characterization of the associated risks. The FBI cited the various measures it has implemented over the past five years to tighten and monitor network and IT security, such as the establishment of a 24-hour security watch center.

The GAO technical review stated, "Certain information security controls over the critical internal network reviewed were ineffective in protecting the confidentiality, integrity and availability of information and information resources."

FBI CIO Zalmai Azmi responded to the GAO report in a letter that cited the bureau's recent progress in the IT security field.

He added that since the FBI activated the Information Assurance Section of its Security Division in April 2002, that organization has brought the bureau from the status of having only 8 percent of its IT systems accredited to having 100 percent of its systems accredited, as required by the Federal Information Security Management Act.

Azmi added that the bureau's Enterprise Security Operations Center works with the agency's Counterintelligence and Criminal Divisions to investigate internal threats.

The audit agency provided a separate classified report in addition to its public report, which is titled "Information Security: FBI Needs to Address Weaknesses in Critical Network."

The GAO auditors found that the bureau failed to consistently:

Configure network devices and services to prevent unauthorized insider access and ensure system integrity;
Identify and authenticate users to prevent unauthorized access;
Enforce the principle of least privilege to ensure that authorized access was necessary and appropriate;
Apply strong encryption techniques to protect sensitive data on its networks;
Log, audit or monitor security-related events;
Protect the physical security of its network; and
Patch key servers and workstations in a timely manner.

Wilson P. Dizard III writes for Government Computer Newsan 1105 Government Information Group publication

NEXT STORY: TechTeam to buy NewVectors