Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
� Approximately 300 Install Accounts were within AD accounts. The FAM 22
requires the removal of non-permanent (that is, visitor and training) user
accounts and passwords.
From a population of approximately 36,000 ClassNet AD accounts, we identified the
following discrepancies:
� Approximately 200 guest, test, and temporary accounts were in the AD
accounts. The FAM 23 states, “The data center manager and the system
manager may not maintain permanent user IDs and passwords on AISs for
visitors, vendor service personnel, training, demonstrations, or other
purposes.”
� Approximately 4,000 accounts have not been used (never logged on). The
FAM 24 requires user privileges to be reviewed annually to verify that
privileges are still appropriate.
� Approximately 900 accounts with passwords set not to expire. The FAM 25
requires passwords to be changed at least every 60 days.
� Approximately 200 Install Accounts were within AD accounts. The FAM 26
requires the removal of non-permanent (that is, visitor and training) user
accounts and passwords.
Each bureau and post is responsible for user account management, such as adding new
users and removing or modifying existing users’ accounts. Additionally, the Department had not
developed and implemented processes and procedures to ensure that bureaus and posts
performed an annual review and recertification of users’ privileges. Inadequate account and
identity management controls increase the risk that temporary and active accounts may be
accessed and used by Department and contractor personnel to perform unauthorized activities,
such as modifying or improperly releasing sensitive Department information or accessing and
modifying operating system software.
Recommendation 8. We recommend that the Chief Information Officer (CIO) develop
and implement Department of State processes and procedures to resolve weaknesses in
user accounts to ensure that unnecessary network user accounts are promptly removed by
the bureaus and posts. Further, the CIO should develop and implement procedures to
ensure that bureaus and organizational unit administrators annually review and recertify
access privileges of users so that the number of guest, test, and temporary accounts are
managed effectively as required by the Foreign Affairs Manual 12 FAM 622 and 12
FAM 629.
22 12 FAM 629.2-2(c), “Administrative Security – Password Controls.”
23 12 FAM 632.1-4(d), “Password Controls.”
24 12 FAM 622.1-3(i).
25 12 FAM 622.1-3(j).
26 12 FAM 629.2-2(c), “Administrative Security – Password Controls.”
18
UNCLASSIFIED