Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
The Department examined each of the three OIG findings and determined the
findings do not reflect a material increase of risk for reasons documented
elsewhere [Footnote in Department response: “Available for auditor
inspection.”]. The Department will continue to assess risk in these areas, and
if a material risk to the security of the Department is found, the Department
will take appropriate steps.
OIG Analysis: OIG considers this recommendation unresolved. During the analysis of
vulnerability scan results analysis, the evaluation determined that a total of 15,288
critical, high, medium, and low patches have not been applied for 16 general support
systems/major applications. Further, there were critical patches that were 7 years
overdue. For the 16 systems tested, the vulnerability scan results analyses displayed a
rising trend of non-remediation of Common Vulnerabilities Exposures (CVE) since 2007,
with some being identified as early as 1999. Thus there are vulnerabilities that have not
been remediated and that can possibly threaten the security posture of the network
infrastructure. (See Appendix E, “Vulnerability Assessments,” Table 4, “Total Number
of Vulnerabilities by CVE and Year.”) This recommendation can be resolved, when the
Department agrees to finalize and implement the elements within the Cyber Security
Architecture draft target architecture and initiatives for end-to–end configuration
management and take immediate action to correct or mitigate the high risk vulnerabilities
identified by the vulnerability scanning.
C. Information Security Training Requirements Were Not Enforced
The Department’s security training program needs to improve processes and procedures
within the general information security awareness and role-based training. OMB 13 mandates
agencies provide periodic computer security awareness to all users as well as specialized training
for individuals who have significant security responsibilities. Training ensures that all users are
knowledgeable of the rules of the system. In the FY 2010 FISMA report, OIG reported that the
Department did not identify employees with significant security responsibilities (SSR).
The FY 2011 evaluation found that the Department had established controls to identify
SSR positions and required role-based training in the IA Training Plan; however, the Department
is not tracking and documenting SSR training attendance. From a sample of 25 full-timeequivalent
(FTE) employees with SSRs, we found 20 employees had not completed role-based
training within the past 3 years.
We also found the following control deficiencies:
� From a sample of 25 newly hired personnel (contractor, FTE, and locally employed
staff), we identified nine users who had not completed the initial PS800 14 training within
10 days of gaining access to the system. The IA Training Plan requires first-time users to
complete the course within 2 weeks of being granted access to the system.
13
OMB Circular A-130, revised app. III, “Security of Federal Automated Information Resources.”
14
The PS800 online user awareness training is required for all network users, domestic and abroad.
13
UNCLASSIFIED