Evaluation of Department of State Information Security Program ...

UNCLASSIFIED
Table of Contents
EXECUTIVE SUMMARY ..............................................................................................1
BACKGROUND ............................................................................................................6
RESULTS OF REVIEW .................................................................................................7
A. RISK MANAGEMENT FRAMEWORK NEEDS IMPROVEMENT .....................7
B. SECURITY CONFIGURATION MANAGEMENT NEEDS IMPROVEMENT .....11
C. INFORMATION SECURITY TRAINING REQUIREMENTS WERE NOT
ENFORCED ................................................................................................13
D. PLANS OF ACTION AND MILESTONES ARE NOT EFFECTIVE ..................15
E. ACCOUNT MANAGEMENT PROCESSES IN ACTIVE DIRECTORY NEED TO
BE IMPROVED...........................................................................................17
F. THE USER PROVISIONING PROCESS FOR CREATING, MODIFYING, AND
DISABLING USERS’ ACCOUNTS REQUIRES SIGNIFICANT
IMPROVEMENT .........................................................................................19
G. CONTINUOUS MONITORING PROGRAM NEEDS TO BE IMPROVED.........21
H. THE CONTINUITY OF OPERATIONS PROGRAM
NEEDS TO BE IMPROVED..........................................................................24
I. INFORMATION SYSTEM CONTINGENCY PLANS
NEEDS TO BE IMPROVED .........................................................................26
J. OVERSIGHT OF CONTRACTOR SYSTEMS AND EXTENSIONS NEEDS
IMPROVEMENT .........................................................................................29
K. CAPITAL PLANNING REQUIRES IMPROVEMENT .....................................31
LIST OF CURRENT YEAR RECOMMENDATIONS ......................................................36
APPENDIX A. OBJECTIVES, SCOPE, AND METHODOLOGY.....................................41
APPENDIX B. FOLLOWUP OF RECOMMENDATIONS FROM THE FY 2010 FISMA
REPORT.....................................................................................................44
APPENDIX C. SYSTEMS WITH INVALID AUTHORITY TO OPERATE ......................47
APPENDIX D. SYSTEMS WITH OUTDATED SECURITY BASELINE CONTROLS .......48
APPENDIX E. VULNERABILITY ASSESSMENT .........................................................50
UNCLASSIFIED