Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
among the IT investments. Ultimately, inadequate oversight increases the risk of
unapproved investments being funded.
Although this report contains 19 recommendations to the Department, we believe the
most significant security deficiencies are the findings related to risk management strategy and
security authorizations (Finding A), security configuration management (Finding B), POA&Ms
(Finding D), and the continuous monitoring program (Finding G).
We reviewed the Department’s remedial actions taken to address the 2010 reported
information security program control weaknesses identified in the FY 2010 FISMA report
Review of the Information Security Program at the Department of State (AUD/IT-11-07,
November 2010). (The statuses of the recommendations from the FY 2010 review of the
information security program are in Appendix B.) Since FY 2010, the Department has taken
actions to improve management controls to include the following:
� Updated and verified the FISMA systems inventory list to the Information
Technology Asset Baseline (ITAB) to ensure that all information technology (IT)
systems are accurately accounted for.
� Defined and identified personnel who have significant security responsibilities in its
Information Assurance (IA) Training Plan.
� Ensured that personally identifiable information (PII) data incidents are reported to
the U.S. Computer Emergency Response Team within the required 1-hour timeframe.
� Updated its contracts to include Department of State Acquisition Regulations
information security language.
Management Comments. In its November 2, 2011, response to the draft report (see
Appendix J), the Department stated that it “disagrees” on whether continuous monitoring, as
currently conducted, produces a lower risk than a traditional C&A program, and on the relative
importance of completeness and compliance vs. timeliness and risk-based prioritization.” The
Department further stated, “Having carefully considered these factors, the Department is
convinced its continuous monitoring program, which is 300 times more timely than traditional
three-year reauthorizations, produces significantly lower security risk [Department footnote
states: “Neither produce zero risk, and achieving zero risk in not foreseeable.”] on its networks.”
Although OIG agrees that the continuous monitoring concept, if properly implemented
and documented, allows for more rapid identification of security weaknesses, OIG is unable to
provide an opinion on the effectiveness of the continuous monitoring strategy because the
Bureau of Information Resource Management (IRM) did not provide a strategy, but the concept
of continuous monitoring is designed to provide results in a more timely fashion. The collective
weaknesses in the information security program, including IRM’s lack of strategies for risk
management and continuous monitoring, leave a weakness in the approach to assessing risk and
taking actions to correct identified vulnerabilities. Furthermore, IRM’s approach cannot
establish responsibility and accountability for information systems security controls and leaves a
vacuum between the current state of information security controls and any planned
5
UNCLASSIFIED