Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
G. Continuous Monitoring Program Needs To Be Improved
The Department had partially implemented a continuous monitoring program at the
organization level and the system level in accordance with OMB 30 and NIST SP 800-37. 31
However, the Department had not taken action to resolve the continuous monitoring control
deficiencies identified in the FY 2010 FISMA report Review of the Information Security
Program at the Department of State. We evaluated the Department’s implementation of these
continuous monitoring components and found deficiencies. (The deficiencies are detailed in
Appendix H.) Therefore, the continuous monitoring program is only partially implemented.
At the organizational level, the ISSC had not developed a formal continuous monitoring
strategy that addresses framing risk, assessing risk, responding to risk, and monitoring risk in
accordance with NIST SP 800-39. Department officials stated that the Department is
implementing continuous monitoring strategy at a cost-effective, risk-based level of detail and
will submit the strategy to the ISSC for approval.
At the system level, the Department uses the iPost system as its principal system for
implementing continuous monitoring organization-wide. For example, the Department performs
vulnerability assessment scanning every 36 hours. However, this system has not been fully
implemented. The following conditions were reported in the FY FISMA 2010 report on the
Department’s information security program:
� The scanning tools do not assess Oracle, the Department’s most common
database system, and UNIX security configurations for configuration
control weaknesses, which could adversely impact application access
controls.
� Scanning results for routers, firewalls, and Demilitarized Zone servers were
not available in iPost; therefore, these results were not used in risk scoring.
We found that the Department had not documented an enterprise-wide continuous
monitoring program strategy within its System Security Plans (SSP) to assist system owners in
evaluating various control deficiencies. The evaluation identified 11 of 30 systems in which the
system security plan lacked a continuous monitoring strategy for the system. The strategy was
not updated because the System Security Officer (SSO) did not update the SSPs in accordance
with NIST SP 800-53, Revision 3 and NIST SP 800-37. Specifically, NIST SP 800-37 requires
30 OMB M-11-33 states, “Agencies should develop an enterprise-wide strategy for monitoring security controls on
an ongoing basis. A robust and effective continuous monitoring program will ensure important procedures included
in an agency's security authorization package (e.g., as described in system security plans, security assessment
reports, and POA&Ms) are updated as appropriate and contain the necessary information for authorizing officials to
make credible risk-based decisions regarding the security state of the information system on an ongoing basis. This
will help make the security authorization process more dynamic and responsive to today's federal missions and
rapidly changing conditions. NIST SPs 800-37, Revision 1; NIST SP 800-53, Revision 3; and NIST SP 800-53A
Revision 1, provide guidance on continuous monitoring programs.”
31 The security documentation needed for continuous monitoring, which includes security impact analyses, security
control assessments reports, plans of action and milestones, and authorization documentation, is described in NIST
800-37, rev.1, Guide for Applying the Risk Management Framework to Federal Information Systems (Feb. 2010),
app. G, “Continuous Monitoring–Managing and Tracking the Security State of Information Systems.”
21
UNCLASSIFIED