Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
completeness and timeliness discussed previously, the Department concludes that
deficiencies in the traditional POA&M system are not a material risk to the security of
the Department, given iPost as a compensating control.
OIG Analysis: OIG considers this recommendation unresolved. The Department did
not provide evidence during the evaluation that the POA&M process was all inclusive.
The Department POA&M process on ClassNet does not include identified security
vulnerabilities during security testing, OIG audits, or other assessments. Therefore, this
process fails to track Department actions to remediate identified weaknesses.
Additionally weaknesses that are identified in the scanning results are not added to the
POA&M tracking. Although the Department stated that it had started distributing the
quarterly memorandums, it did not take this action within the time period of the FISMA
evaluation. The Department stated that iPost has replaced the traditional POA&M
process. The independent public accountant determined, based on the issues noted with
iPost (detailed in section G), that the system is not mature enough to compensate for the
POA&M process. This recommendation can be resolved when the Department can
document that the POA&M process includes the required elements for tracking, that the
POA&M process accounts for weaknesses identified by all sources (scans, assessments,
and OIG findings), and corrective actions are taken in the accordance with NIST and
OMB requirements.
E. Account Management Processes in Active Directory Need To Be Improved
The Department needs to improve account management processes in Active Directory
(AD) for OpenNet and ClassNet. In FY 2010, OIG reported deficiencies in account
management, and we found that account management deficiencies still existed within AD for
OpenNet and ClassNet.
From a population of approximately128,000 OpenNet AD users’ accounts, we identified
the following deficiencies:
� Approximately 400 guest, test, and temporary accounts were in the AD
accounts. The FAM 19 states, “The data center manager and the system
manager may not maintain permanent user IDs and passwords on AISs for
visitors, vendor service personnel, training, demonstrations, or other
purposes.”
� Approximately 9,000 accounts have not been used (never logged on). The
FAM 20 requires user privileges to be reviewed annually to verify that
privileges are still appropriate.
� Approximately 400 accounts with passwords set not to expire. The FAM 21
requires passwords to be changed at least every 60 days.
19 12 FAM 622.1-3(b), “Password Controls.”
20 12 FAM 622.1-3(i).
21 12 FAM 622.1-3(j).
17
UNCLASSIFIED