Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
Management Response: The Department stated that it “agrees there is a potential risk”
with user accounts and that it will, begin “scoring stale accounts in iPost.” The
Department further stated that it will, in December 2011, “conduct a more complete
assessment of this problem and determine what prioritized mitigation actions are justified
by the current level of risk.”
The Department also stated that based on “a preliminary investigation of the accounts
identified as deficient by the OIG using a random sample of accounts in each of the
remaining categories,” it found that OIG “had overestimated the level of deficiency by a
large percentage.”
OIG Analysis: OIG considers this recommendation resolved, pending further action.
OIG has determined that accounts such as group mailboxes accounts and service accounts
that have not been used and are active are vulnerable to insider exploitation. The
Department should also consider the weaknesses identified in the user accounts analyses
when performing its own analyses. Because the Department has agreed to conduct a
more complete assessment of this problem, this recommendation can be closed when
OIG reviews and accepts documentation showing that the Department is properly
maintaining the Active Directory.
F. The User Provisioning Process for Creating, Modifying, and Disabling
Users’ Accounts Requires Significant Improvement
The Department’s user provisioning process for creating, modifying, and disabling users’
accounts is not in compliance with the FAM. The FAM 27 requires ISSOs to maintain all
password/receipt acknowledgement forms to comply with NIST SP 800-53. 28 The FAM 29 also
states the data center manager and the system manager, in conjunction with the ISSO, must
revoke user access privileges for employees and contractors who are transferred or terminated.
We found control deficiencies within the Department’s user provisioning process as follows:
� Two of 25 ClassNet Domain Administrators accounts did not have
corresponding individual user accounts, which results in no individual
accountability of actions for Domain Administrators.
� Of 894 separated FTE accounts, 294 accounts were not terminated or
deactivated in a timely manner. In addition, of the 294 accounts that were
terminated, 104 had a remote access security token.
� All 25 new user accounts created within the past fiscal year did not have
documentation (Password/Receipt Form) available for audit.
� All seven network administrator accounts created within the past fiscal year
did not have documentation available for audit.
27
12 FAM 622.5, “Log and Record Keeping.”
28
NIST SP 800-53, rev. 3, Aug. 2009, Recommended Security Controls for Federal Information Systems and
Organizations.
29
12 FAM 621.3-3, “System Access.”
19
UNCLASSIFIED