Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
J. Oversight of Contractor Systems and Extensions Needs Improvement
The Department had not implemented an effective program for the oversight of
contractor systems and contractor extensions (remote network connections to Department
systems). Although the Department established initial contract agreements and conducted initial
risk assessments for contractor extensions, we noted several deficiencies. For example, COCO
systems did not have security-related documentation. The FAM 43 and NIST SP 800-47 44 require
that the Department document the interconnection agreements between the network and the
contractor with language similar to that contained in a memorandum of understanding (MOU)
and an interconnection security agreement (ISA). The agreement must be submitted to IRM/IA.
Specifically, for COCO systems, IRM/IA did not provide documentation for the
following:
� For all five COCO systems, a contractor agreement and system security
documentation were lacking for the State Assistance Management System
(SAMS); the Consular Visa System (CVS); the Antiterrorism Assistance
(ATA) Student Database; the Foreign Service Office Tester (FSOT) system,
and the Gateway to State (GTS). The Department relies on a decentralized
security program whereby system owners/bureaus are responsible for
overseeing COCO systems that provide services to a bureau.
� Of five COCO systems, ATOs were not made available for review for four
systems (SAMS, CVS, ATA database, and FSOT). According to OMB, 45
the Department must assess security controls in accordance with NIST
guidelines for contractor systems that collect, process, maintain, and house
Government information.
The list of OpenNet extensions does not contain a complete inventory of workstations at
other Government agencies. For example, OpenNet terminals (workstations) were observed by
an OIG audit team at International Boundary and Water Commission (IBWC) and Broadcasting
Board of Governors (BBG) offices. These connections are not on the list of OpenNet extensions.
The Department tracks only OpenNet extensions at contractor sites and vendors and does not
include other third parties, such as Government agencies.
We also found that the Department did not have an effective mechanism in place to
identify the total number of contractors’ personnel who had access to and privileges within the
Department’s network, applications, databases, and data. OMB Memorandum M-11-33 states:
“Agencies must develop policies for information security oversight of contractors and other users
with privileged access to Federal data. Agencies must also review the security of other users
with privileged access to Federal data and systems.”
43 5 FAM 1065.3-1, “Requests for Interagency and Non-Department Connectivity.”
44 NIST SP 800-47, Security Guide for Interconnecting Information Technology Systems,, Aug 2002.
45 OMB Memorandum M-10-15, FY 2010 Reporting Instructions for the Federal Information Security Management
Act and Agency Privacy Management.
29
UNCLASSIFIED