A Review of FBI Security Programs

compromised insider is deterred by the risk of detection or actually thwarted by a security
layer, the Defense-in-Depth approach restricts a compromised insider’s unauthorized access
to data.
In the course of our review, we identified a wide range of problems affecting the
FBI’s computer systems and INFOSEC programs, which we will briefly summarize, saving
a detailed discussion for the appendices.
• The Bureau has failed to develop an effective strategy to identify and
protect critical information. The FBI has not defined its security
environment and therefore lacks the analytical framework necessary to
address insider threats.
• Classified information has been moved into systems not properly
accredited for its protection.
• Until recently, the Bureau had not begun to certify and accredit most
of its computer systems, including many classified systems. The
current approach to certification is inadequate.
• Inadequate physical protections place electronically stored information
at risk of compromise.
• The FBI lacks adequate, documented INFOSEC policies.
• The Bureau’s approach to system design has been deficient. It has
failed to ascertain the security requirements of the “owners” of
information on its systems and identify the threats and vulnerabilities
that must be countered.
• Classified information stored on some of the FBI’s most widely utilized
systems is not adequately protected because computer users lack
sufficient guidance about critical security features.
• The FBI has failed to limit user access to systems and databases that
employees need to perform their jobs.
• Many key INFOSEC positions remain unfilled, and, when they have
-36-