Attachment D - VA OIG-18-02127-64 Audit and Evaluation.pdf

REPORT # 18-02127-64 AUDIT MARCH 12, 2019

Office of Audits and Evaluations

DEPARTMENT OF VETERANS AFFAIRS

Federal Information Security Modernization Act Audit for Fiscal Year 2018

In addition to general privacy laws that govern release of medical information, disclosure of certain veteran health or other private information may be prohibited by various federal statutes including, but not limited to, 38 U.S.C. §§ 5701, 5705, and 7332, absent an exemption or other specified circumstances. As mandated by law, the OIG adheres to privacy and confidentiality laws and regulations protecting veteran health or other private information in this report.

Report suspected wrongdoing in VA programs and operations to the VA OIG Hotline:

www.va.gov/oig/hotline

1-800-488-8244

The mission of the Office of Inspector General is to serve veterans and the public by conducting effective oversight of the programs and operations of the Department of Veterans Affairs through independent audits, inspections, reviews, and investigations.

www.va.gov/oig/hotline

VA OIG 18-02127-64 | Page i | March 12, 2019

Federal Information Security Modernization Act Audit for Fiscal Year 2018

From: Assistant Inspector General for Audits and Evaluations

Subj: VA’s Federal Information Security Modernization Act Audit for Fiscal Year 2018

To: Assistant Secretary for Information and Technology

1. Enclosed is the final audit report, Federal Information Security Modernization Act Audit for Fiscal Year 2018. The Office of Inspector General (OIG) contracted with the independent public accounting firm, CliftonLarsonAllen LLP, to assess the Department of Veterans Affairs’ (VA) information security program in accordance with the Federal Information Security Modernization Act (FISMA).

2. To ensure the adequacy and effectiveness of information security controls, FISMA requires agency program officials, Chief Information Officers, and Inspectors General to conduct annual reviews of agencies’ information security programs and report the results to the Department of Homeland Security (DHS). DHS uses these data to assist in its oversight responsibilities and to prepare an annual report to Congress on agency compliance with FISMA.

3. CliftonLarsonAllen LLP is responsible for the findings and recommendations included in this report. Accordingly, the OIG does not express an opinion on VA’s information security program in place during fiscal year (FY) 2018. The OIG’s independent auditors will follow up on the outstanding recommendations and evaluate the adequacy of corrective actions during their FY 2019 FISMA audit.

4. According to findings by CliftonLarsonAllen LLP, VA continues to face significant challenges in complying with the requirements of FISMA due to the nature and maturity of its information security program. In order to better achieve FISMA outcomes, VA needs to focus on several key areas, including specific actions that

· Address security-related issues that contributed to the information technology material weakness reported in the FY 2018 audit of VA’s Consolidated Financial Statements.

· Improve deployment of security patches, system upgrades, and system configurations that will mitigate significant security vulnerabilities and enforce a consistent process across all field offices.

· Improve performance monitoring to ensure controls are operating as intended at all facilities, and communicate identified security deficiencies to the appropriate personnel so they can take corrective actions to mitigate significant security risks.

Department of Veterans Affairs Memorandum

Federal Information Security Modernization Act Audit for Fiscal Year 2018

VA OIG 18-02127-64 | Page ii | March 12, 2019

5. This report provides 28 recommendations for improving VA’s information security program. Twenty-seven recommendations are included in the report body and one recommendation is provided in Appendix A. The recommendation in Appendix A addresses the status of a prior year recommendation and VA’s plans for corrective action. VA successfully closed one recommendation in FY 2018.

Specifically, the OIG closed recommendation FY 2006-09 from a prior year as VA deployed solutions to encrypt sensitive data and resolve clear text protocol vulnerabilities.

6. The Principal Deputy Assistant Secretary for Information and Technology concurred with 25 of 28 recommendations and provided acceptable action plans in response to these recommendations. While the Principal Deputy Assistant Secretary did not concur with three recommendations, the OIG believes these recommendations warrant further attention from VA and will follow up on these issues during the FY 2019 assessment. Further details on OIT’s nonconcurrence, and the OIG’s response, are provided on pages 5 and 13 of this report.

7. The effect of the open recommendations will be considered in the FY 2019 assessment of VA’s information security posture. The OIG remains concerned that continuing delays in implementing effective corrective actions to address these open recommendations could potentially contribute to reporting an information technology material weakness for the FY 2019 audit of VA’s Consolidated Financial Statements.

LARRY M. REINKEMEYER

Assistant Inspector General for Audits and Evaluations

VA OIG 18-02127-64 | Page iii | March 12, 2019

Abbreviations CLA CliftonLarsonAllen LLP

DHS Department of Homeland Security

ECSP Enterprise Cybersecurity Strategy Program

FISMA Federal Information Security Modernization Act

FY Fiscal Year

GRC Governance Risk and Compliance

NIST National Institute of Standards and Technology

OIT Office of Information and Technology

OIG Office of Inspector General

OMB Office of Management and Budget

POA&M Plans of Action and Milestones

SCA Security Controls Assessment

VA Department of Veterans Affairs

VA OIG 18-02127-64 | Page iv | March 12, 2019

CliftonLarsonAllen LLP CLAconnect.com

February 21, 2019

The Honorable Michael J. Missal Inspector General Department of Veterans Affairs 801 I Street, Northwest Washington, DC 20001

Dear Mr. Missal:

CliftonLarsonAllen LLP (CLA) conducted a performance audit of the United States Department of Veterans Affairs’ (VA) compliance with the Federal Information Security Modernization Act of 2014 (FISMA) for the fiscal year ended September 30, 2018. The objective of this audit was to determine the extent to which VA’s information security program and practices comply with FISMA requirements, Department of Homeland Security (DHS) reporting requirements, and applicable Office of Management and Budget (OMB) and National Institute for Standards and Technology (NIST) information security guidelines. The audit included the testing of selected management, technical, and operational controls outlined in NIST’s Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations.

Our audit was performed in accordance with the performance audit standards specified in Government Auditing Standards, issued by the Comptroller General of the United States. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Our procedures were designed to respond to the FISMA-related questions outlined in the OMB template for the Inspectors General and evaluate the VA information security program’s compliance with FISMA and applicable NIST information security guidelines, as defined in our audit program. The audit included the evaluation of 49 selected major applications and general support systems hosted at 25 VA facilities that support the National Cemetery Administration, the Veterans Benefits Administration, and the Veterans Health Administration lines of business.

Audit fieldwork occurred during the period April 2018 through November 2018.

Based on our audit procedures, we conclude that VA continues to face significant challenges meeting the requirements of FISMA. This report provides 28 recommendations to assist VA in strengthening its information security program.

In connection with the audit of VA’s FY 2018 Consolidated Financial Statements, CLA evaluated general computer and application controls for VA’s major financial management systems.

Significant deficiencies identified during CLA’s evaluation are included in this report. In addition to the findings and recommendations in the accompanying report, our conclusions related to VA’s information security program are contained within the OMB FISMA reporting template provided to the OIG in October 2018.

VA OIG 18-02127-64 | Page v | March 12, 2019

CLAconnect.com

This report is intended solely for the information and use of the management of the VA, the VA OIG and the Government Accountability Office and not intended to be and should not be used by anyone other than these specified parties.

Sincerely, Arlington, Virginia

VA OIG 18-02127-64 | Page vi | March 12, 2019

Contents Report Routing Memorandum............................................................................................................i

Abbreviations ................................................................................................................................. iii

Contents ......................................................................................................................................... vi

I. Objective

II. Overview

III. Results and Recommendations

1. Agency-Wide Security Management Program

A. Progress Made While Challenges Remain

B. Risk Management Strategy

C. Plans of Action and Milestones

D. System Security Plans

A. CORRECTIVE ACTIONS RECOMMENDED

2. Identity Management and Access Controls

A. Password Management

B. Access Management

C. Audit Logging and Monitoring

D. Strong Authentication

B. CORRECTIVE ACTIONS RECOMMENDED

VA OIG 18-02127-64 | Page vii | March 12, 2019

3. Configuration Management Controls

A. Unsecure Web Applications and Services

B. Unsecure Database Applications

C. Application and System Software Vulnerabilities

D. Unsecure Network Access Controls

E. Baseline Security Configurations

C. CORRECTIVE ACTIONS RECOMMENDED

4. System Development and Change Management Controls

D. CORRECTIVE ACTION RECOMMENDED

5. Contingency Planning

E. CORRECTIVE ACTIONS RECOMMENDED

6. Incident Response and Monitoring

A. Some Interconnections Not Monitored

B. Network Monitoring Needs Improvement

C. Incident Response Tracking and Reporting

D. CORRECTIVE ACTIONS RECOMMENDED

7. Continuous Monitoring

A. Inconsistent Security Control Assessments

B. System Inventory Processes Need Improvement

VA OIG 18-02127-64 | Page viii | March 12, 2019

E. CORRECTIVE ACTIONS RECOMMENDED

8. Contractor Systems Oversight

F. CORRECTIVE ACTIONS RECOMMENDED

Appendix A: Status of Prior Year Recommendations

Appendix B: Background

Appendix C: Scope and Methodology

1. Site Selections

2. Government Standards

Appendix D: Principal Deputy Assistant Secretary for Information and Technology

Comments

OIT Response: VA non-concurs with this recommendation. VA has aligned CSF and

RMF to provide visibility into cybersecurity risk at the system-level and enterprise-level, which provides VA with the ability to analyze compliance, measure operational risk, and ultimately make risk-based determinations for an information system's Authority to Operate (ATO). Therefore, VA requests this finding be closed by OIG. Additional details regarding compensating activities to address the identified weaknesses have been provided to the IG

Target Completion Date: Completed

Recommendation 2: We recommended the Executive in Charge for Information and

Technology implement mechanisms to ensure sufficient supporting documentation is captured to justify closure of Plans of Action and

Milestones

VA OIG 18-02127-64 | Page ix | March 12, 2019

OIT Response: VA concurs with this recommendation. VA is in the process of developing and implementing enhanced processes for security baseline creation, implementation, testing, and monitoring. Additional details regarding compensating and mitigating activities to address the identified weaknesses have been provided to the IG

Target Completion Date: 03/01/2020

Recommendation 14: We recommended the Executive in Charge for Information and

Technology implement improved network access controls to restrict medical devices from the general network and ensure that databases, file shares, and management devices, are adequately secured prior to connecting to VA’s network

Recommendation 18: We recommended the Executive in Charge for Information and

Technology implement improved processes for ensuring that backup data is adequately secured in accordance with organizational policy

OIT Response: VA non-concurs with this recommendation. VA has implemented measures to safely secure, store, and restore certain legacy backup tapes and request this finding be closed by OIG

Target Completion Date: Completed

Recommendation 19: We recommended the Executive in Charge for Information and

Technology implement improved processes for the review of system outages and disruptions for contingency plan improvements in accordance with defined policy

OIT Response: VA non-concurs with this recommendation. The network and system outages / disruptions identified by OIG were deemed by VA as a minor outage / disruption which would not warrant the initiation of IT Contingency

/ Disaster Recovery (CP / DR) Plans, rather would be remediated via VA’s

VA OIG 18-02127-64 | Page x | March 12, 2019 ticketing system. After review of the list of outages that exceeded the 12-hour Recovery Time Objective (RTO), none of the outages reviewed affected critical systems and many were circuit outages affecting sites over the weekend when closed. However, the RTO is a number that is compared to the Maximum Tolerable Downtime (MTD), the customer states their

MTD is 12 hours and OIT plans longest restoration time as 12 hours. For critical systems an incident call is started, and the customer is informed of the restoration steps. There is no NIST / FISMA requirement to always meet the target RTO and in these cases of non-critical outages, our actual enterprise CPs and DR plan was not utilized, as these were minor in nature.

Moreover, lessons learned were not incorporated as part of the post-outages

/ disruptions follow-up, as the contingency plan was not initiated and would therefore not require an update to address any problems encountered during contingency plan implementation, executing, or testing, nor is incorporating lessons learned a requirement with VA Handbooks 6500/6500.8

Target Completion Date: Completed

Recommendation 20: We recommended the Executive in Charge for Information and technology identify all external network interconnections and implement improved processes for monitoring VA networks, systems, and connections for unauthorized activity

OIT Response: VA concurs with this recommendation. VA is in the process of developing and implementing an enterprise-wide workflow to centralize the oversight and authorizing of MOU/ISA to determine completeness and quality.

Additional details regarding compensating activities to address the identified weaknesses have been provided to the IG

Target Completion Date: In Progress

Recommendation 21: We recommended the Executive in Charge for Information and

Technology implement more effective agency-wide incident response

VA OIG 18-02127-64 | Page xi | March 12, 2019 procedures to ensure timely reporting, updating, and resolution of computer security incidents in accordance with VA standards

OIT Response: VA concurs with this recommendation. VA CSOC continues to develop new processes and tracking of metrics to strengthen the agency-wide incident response process. Additional details regarding compensating activities to address the identified weaknesses have been provided to the IG.

Target Completion Date: 1/25/2019

Recommendation 22: We recommended the Executive in Charge for Information and technology ensures that VA’s Network Security and Operations Center has full access of all security incident data to facilitate an agency-wide awareness of information security events

OIT Response: VA concurs with this recommendation. VA ITOPS and VA CSOC are working toward integrating the VA CSOC Splunk systems and QRADAR systems which will allow for improved visibility and monitoring, investigations, and adversarial hunting across the enterprise

Target Completion Date: 1/25/2019

Recommendation 23: We recommended the Executive in Charge for Information and

Technology implement improved safeguards to identify and prevent unauthorized vulnerability scans on VA networks

OIT Response: VA concurs with this recommendation. ITOPS IO Cybersecurity

Management is in the process of initiating a project to leverage the enterprise

ForeScout infrastructure Threat Protection capabilities to identify unauthorized scanning across the enterprise. Additional details regarding compensating activities to address the identified weaknesses have been provided to the IG

VA OIG 18-02127-64 | Page xii | March 12, 2019

Target Completion Date: 7/29/2019

Recommendation 24: We recommended the Executive in Charge for Information and technology fully develop a comprehensive list of approved and unapproved software and implement continuous monitoring processes to prevent the use of unauthorized software on agency devices

OIT Response: VA concurs with this recommendation. VA is in the process of evaluating enterprise tools to identify and prevent the use of unauthorized software on agency devices. Additional details regarding compensating and mitigating activities to address the identified weaknesses have been provided to the IG.

Target Completion Date: 06/28/2021

Recommendation 25. We recommended the Executive in Charge for Information and

Technology develop a comprehensive inventory process to identify connected hardware, software, and firmware used to support VA programs and operations

OIT Response: VA concurs with this recommendation. VA is in the process of developing enhanced processes to accurately inventory software and hardware across the enterprise. Additional details regarding compensating and mitigating activities to address the identified weaknesses have been provided to the IG.

Target Completion Date: 11/30/2021

Recommendation 26: We recommended the Executive in Charge for Information and technology implement procedures for overseeing contractor-managed cloud-based systems and ensure information security controls adequately protect

VA sensitive systems and data

VA OIG 18-02127-64 | Page xiii | March 12, 2019

OIT Response: VA concurs with this recommendation. VA CSOC Compliance Scanning

Services (CSS) Team monitors contractor-hosting facilities' connections, which fulfills continuous monitoring requirements for VA systems hosted outside the VA network with the use of the internal Tenable Security Center

Console method to communicate with remote scanners established inside business partner networks. This connections monitoring is expected to be expanded to new remote Business Partners. Additional details regarding compensating activities to address the identified weaknesses have been provided to the IG

Target Completion Date: 12/31/2019

Recommendation 27: We recommended the Executive in Charge for Information and

Technology implement mechanisms for updating systems inventory, including contractor-managed systems and interfaces, and provide this information in accordance with Federal reporting requirements

OIT Response: VA concurs with this recommendation. VA is in the process of improving mechanisms for system inventory management across the enterprise.

Additional details regarding compensating and mitigating activities to address the identified weaknesses have been provided to the IG

Target Completion Date: 11/30/2021

OIT Response: VA concurs with this recommendation. VA is in the process of developing and implementing an enterprise-wide onboarding, monitoring and off-boarding solution referred to as the VA Onboarding Solution. Additional details regarding compensating to address the identified weaknesses have been provided to the IG. PSCM has procured Commercial Off-The-Shelf

(COTS) product VA-CABS to serve as a VA-wide personnel security and suitability case management system. VA-CABS was deployed to the

Security and Investigations Center (SIC) in September 2018. PSCM is also currently deploying VA-CABS incrementally across the enterprise. VA-

VA OIG 18-02127-64 | Page xiv | March 12, 2019

CABS will monitor investigations and reinvestigations for timely actions.

Servicing Human Resource Offices (SHRO) will be able to review their employee's investigation status and initiate reinvestigations as necessary.

The SIC will continue to monitor contractors within VA and track their reinvestigation requirements with the Contracting Officer's Representative

(COR). Initial training sessions have been conducted with CORs to obtain end-user insight and feedback on the VA Onboarding solution (which will integrate with VA-CABS) contractor onboarding and off-boarding functionalities. The Pilot has been paused to address process anomalies that were discovered. The Pilot is planning to resume in January 2019, testing the updated functionalities, prior to enterprise-wide release. Additional details regarding activities to address the identified findings have been provided to the IG

Target Completion Date: In Progress

Appendix E: Report Distribution

VA Distribution

Non-VA Distribution

VA OIG 18-02127-64 | Page 1 | March 12, 2019

I. Objective The objective of this audit was to determine the extent to which VA’s information security program and practices comply with Federal Information Security Modernization Act (FISMA) requirements, Department of Homeland Security (DHS) reporting requirements, and applicable Office of Management and Budget (OMB) and National Institute for Standards and Technology (NIST) guidance. The VA Office of Inspector General (OIG) contracted with the independent accounting firm CliftonLarsonAllen LLP (CLA) to perform the FY 2018 FISMA audit.

II. Overview Information security is a high-risk area Government-wide. Congress passed the Federal Information Security Modernization Act of 2014 (Public Law 113-283) in an effort to strengthen Federal information security programs and practices. FISMA provides a comprehensive framework to ensure the effectiveness of security controls over information resources that support Federal operations and assets. We assessed VA’s information security program through inquiries, observations, and tests of selected controls supporting 49 major applications and general support systems at 25 VA facilities. In FY 2018, we identified specific deficiencies in the following areas:

1. Agency-Wide Security Management Program

2. Identity Management and Access Controls

3. Configuration Management Controls

4. System Development/Change Management Controls

5. Contingency Planning

6. Incident Response and Monitoring

7. Continuous Monitoring

8. Contractor Systems Oversight

This report provides 28 recommendations for improving VA’s information security program: 27 recommendations are included in the report body and one recommendation is provided in Appendix A. The appendix addresses the status of prior year recommendations not included in the report body and VA’s plans for corrective action. Some recommendations were modified or not closed because relevant security policies and procedures were not finalized or information security control deficiencies were repeated during the FY 2018 FISMA audit. VA successfully closed one recommendation in FY 2018. The FY 2017 FISMA report provided 29 recommendations for improvement.

VA OIG 18-02127-64 | Page 2 | March 12, 2019

III. Results and Recommendations

1. Agency-Wide Security Management Program

FISMA requires each Federal agency to develop, document, and implement an agency-wide information security and risk management program. VA has made progress developing, documenting, and distributing policies and procedures as part of its program. However, VA still faces challenges implementing components of its agency-wide information security risk management program to meet FISMA requirements. Consequently, this audit identified continuing significant deficiencies related to access controls, configuration management controls, change management controls, and service continuity practices designed to protect mission-critical systems from unauthorized access, alteration, or destruction.

A. Progress Made While Challenges Remain

In FY 2018, the VA’s Acting Chief Information Officer continued the Enterprise Cybersecurity Strategy Program (ECSP) initiative, including the enterprise cybersecurity strategic plan. The plan was designed to help VA achieve transparency and accountability while securing veteran information through teamwork and innovation. The ECSP team’s scope included management of current cybersecurity efforts, as well as the development and review of VA’s operational requirements from desktop to software to network protection. The ECSP team has launched 31 Plans of Action to address previously identified security weaknesses and the IT material weakness. As part of the ongoing ECSP efforts, we noted continued improvements related to:

· Improved security documentation

· Centralization of control functions

· Further maturation of predictive scanning process

· Continued maturation of an IT governance, risk, and compliance tool to improve processes for assessing, authorizing, and monitoring the security posture of VA systems

· Further enhancements and use of the centralized audit log collection and analysis tool

However, the aforementioned controls require time to mature and demonstrate evidence of their effectiveness. Additionally, controls need to be applied in a holistic manner to information systems across VA in order to be considered consistent and fully effective. Accordingly, we continue to see information system security deficiencies similar in type and risk level to our findings in prior years and an overall inconsistent implementation of the security program. Moving forward, VA needs to ensure a proven process is in place across the agency. VA also needs to continue to address deficiencies that exist within access and configuration management controls across all facilities. VA has continued to mature the process related to its RiskVision Governance Risk and Compliance (GRC) tool for the purpose of enterprise wide risk and security management.

However, we continue to identify deficiencies related to overall governance to include risk management processes, plans of action and milestones, and security control assessments (SCAs). Each of these processes is essential for protecting VA’s mission-critical systems through appropriate risk mitigation strategies and is discussed in the following sections.

VA OIG 18-02127-64 | Page 3 | March 12, 2019

B. Risk Management Strategy

VA has not fully implemented components of its agency-wide information security risk management program to meet FISMA requirements. VA has established an enterprise risk management program; however, the policies, procedures, and documentation included in the program were not consistently implemented or applied across all VA systems. For example, Risk Assessments did not always consider all previously known or identified system security risks. Specifically, we identified SCAs where valid weaknesses were not incorporated into overall risk management activities. We also identified issues related to the incomplete reporting of control deficiencies identified during SCAs and noted that four systems were granted Authority to Operate without undergoing a timely assessment of security controls.

NIST Special Publication 800-37, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach, states that an agency’s risk management framework should address risk from an organizational perspective with the development of a comprehensive governance structure and an organization-wide risk management strategy. VA has implemented a risk governance structure, including a Risk Management Governance Board and the GRC tool, to monitor system security risks and implement risk mitigation controls across the enterprise. However, this effort was not consistently implemented enterprise-wide.

C. Plans of Action and Milestones

OMB Memorandum M-02-01, Guidance for Preparing and Submitting Security Plans of Action and Milestones (POA&M), defines management and reporting requirements for agency POA&Ms, to include deficiency descriptions, remediation actions, required resources, and responsible parties. According to VA’s central reporting database, the Department had approximately 11,734 open POA&Ms in FY 2018, as compared with 8,500 open POA&Ms in FY 2017. The increase can be attributed to a change in the way security control assessment results were handled during the year. For instance, in the beginning of the year, control assessment results were screened before entry as POA&Ms; however, by the end of the year, VA was making POA&Ms for all control assessment results, which contributed to the overall increase.

VA has dedicated additional resources to work on closing POA&Ms, but much work remains to remediate the significant number of outstanding security weaknesses. POA&Ms identify what actions must be taken to remediate system security risks and improve VA’s overall information security posture.

VA has made progress in managing POA&Ms across VA facilities and systems. Despite these improvements, we continue to identify deficiencies related to reporting, managing, and closing POA&Ms. For example, we identified: (a) POA&Ms that lacked sufficient documentation to justify closure and action items that missed major milestone dates, (b) POA&Ms that were not updated to accurately reflect their current status, (c) POA&Ms were not consistently updated to consider all known security weaknesses, and (d) security deficiencies for several unrelated controls that were consolidated under one POA&M instead of tracking them separately.

VA OIG 18-02127-64 | Page 4 | March 12, 2019

POA&M deficiencies resulted from a lack of accountability for closing items at a “local” level and a lack of controls to ensure supporting documentation was recorded in the GRC tool. More specifically, unclear responsibility for addressing POA&M records at the local or “regional” level continues to adversely affect remediation efforts across the enterprise. By failing to fully remediate significant system security risks in the near term, VA management cannot ensure that information security controls will adequately protect VA systems throughout their life cycles.

Further, without sufficient documentation in the central database to justify closure of POA&Ms, VA cannot ensure that corresponding security risks have been fully mitigated.

D. System Security Plans

We continue to identify system security plans with inaccurate information regarding operational environments, including system interconnections, control status, and control implementation details that were not supported by evidence. Additionally, while medical devices and special purpose systems were appropriately included within the regional network boundaries, the implementation of specific controls for these devices were not addressed within regional level system security plans.

A. CORRECTIVE ACTIONS RECOMMENDED

1. We recommended the Executive in Charge for Information and Technology consistently implement the agency-wide risk management governance structure, along with mechanisms to identify, monitor, and manage risks across the enterprise. (This is a modified repeat recommendation from prior years.)

2. We recommended the Executive in Charge for Information and Technology implement mechanisms to ensure sufficient supporting documentation is captured to justify closure of Plans of Action and Milestones. (This is a repeat recommendation from prior years.)

3. We recommended the Executive in Charge for Information and Technology implement improved processes to ensure that all identified weaknesses are incorporated into the Governance Risk and Compliance tool in a timely manner, and corresponding Plans of Action and Milestones are developed to track corrective actions and remediation. (This is a repeat recommendation from prior years.)

4. We recommended the Executive in Charge for Information and Technology implement clear roles, responsibilities, and accountability for developing, maintaining, completing, and reporting on Plans of Action and Milestones. (This is a repeat recommendation from prior years.)

5. We recommended the Executive in Charge for Information and Technology develop mechanisms to ensure system security plans reflect current operational environments, include an accurate status of the implementation of system security controls, and all applicable security controls are properly evaluated. (This is a repeat recommendation from prior years.)

6. We recommended the Executive in Charge for Information and Technology implement improved processes for reviewing and updating key security documents such as security

VA OIG 18-02127-64 | Page 5 | March 12, 2019 plans and security control assessments on an annual basis and ensure the information accurately reflects the current environment. (This is a modified repeat recommendation from prior years.)

Management Comments

The Principal Deputy Assistant Secretary for Information and Technology did not concur with Recommendation 1 but concurred with Recommendations 2, 3, 4, 5, and 6. For Recommendation 1, the Principal Deputy Assistant Secretary non-concurred and stated that VA has aligned its risk management framework to provide visibility into cybersecurity risk and ultimately make risk-based determinations for an information system’s Authority to Operate. To address Recommendation 2, VA is tracking the implementation of the new GRC solution, as a project within the Enterprise Cybersecurity Strategy Program that will support remediation of weaknesses identified around the authorization lifecycle. For Recommendation 3, VA is expanding its POA&M efforts to accurately document remediation efforts prior to closure through its GRC tool. In response to Recommendation 4, VA is expanding its POA&M process to consistently detect, evaluate, and monitor the current state of identified security weaknesses.

To address Recommendation 5, VA’s Case Management process will provide a systematic approach for continuous evaluation of system security plans for identification of security controls as they apply to the current operational environment. For Recommendation 6, VA is modifying its procedures for tracking deficient security controls that will provide a detailed view that highlights which security risks have been fully mitigated and which still require remediation.

OIG Response

The Principal Deputy Assistant Secretary’s planned corrective actions are responsive to Recommendations 2, 3, 4, 5, and 6. Regarding VA’s non-concurrence to Recommendation 1, within the report we stated that VA has established an enterprise risk management program;

however, the policies, procedures, and documentation included in the program were not consistently implemented or applied across all VA systems. Specifically, risk assessments did not always consider all previously known or identified system security risks. Additionally, we identified security control assessments where valid weaknesses were not incorporated into overall risk management activities. Accordingly, we stand by our original finding and recommendation. The OIG will monitor VA’s progress and follow up on implementation of the recommendations until all proposed actions are completed. Appendix D provides the full text of the Principal Deputy Assistant Secretary’s comments.

2. Identity Management and Access Controls

We continued to identify significant deficiencies in VA’s identity management and access controls. VA Handbook 6500, Appendix F provides comprehensive guidelines for authenticating users and protecting VA’s critical systems from unauthorized access, alteration, or destruction.

The FISMA audit identified significant information security control deficiencies in the following areas:

· Password Management

· Access Management

VA OIG 18-02127-64 | Page 6 | March 12, 2019

· Audit Logging and Monitoring

· Strong Authentication

A. Password Management

Audit teams continued to identify multiple password management vulnerabilities. For example, we noted weak passwords on major databases, applications, and networking devices at many VA facilities. In addition, password parameter settings for network domains, databases, key financial applications, and servers were not consistently configured to enforce VA’s password policy standards. VA Handbook 6500, Appendix F establishes password management standards for authenticating VA system users.

While some improvements have been made, we continue to identify security weaknesses that were not remediated from prior years. Many of these weaknesses can be attributed to VA’s ineffective enforcement of its agency-wide information security risk management program and ineffective communication from senior management to individual field offices. The use of weak passwords is a well-known security vulnerability that allows malicious users to easily gain unauthorized access into mission-critical systems.

B. Access Management

Reviews of systems and permission settings identified numerous instances of unnecessary system privileges, excessive and unauthorized user accounts, accounts without formal access authorizations, and active accounts for terminated personnel. VA Handbook 6500, Appendix F details access management policies and procedures for VA’s information systems. Additionally, user access requests were not consistently reviewed to eliminate conflicting roles and enforce segregation of duties principles. We also identified inconsistent monitoring of access in production environments for individuals with excessive privileges within certain major applications. This occurred because VA has not implemented effective reviews to monitor for instances of unauthorized system access or excessive permissions. Periodic reviews are critical to restrict legitimate users to specific systems and to prevent unauthorized access by both internal and external users. Unauthorized access to critical systems can leave sensitive data vulnerable to inappropriate modification or destruction.

C. Audit Logging and Monitoring

While VA continues to improve its centralized Security Incident and Event Management processes, we continue to identify deficiencies with how audit logs and security events are managed throughout the enterprise. For example, VA did not consistently review security violations and audit logs supporting mission-critical systems. Specifically, we noted that security logs were not always enabled, effectively managed, aggregated, or proactively reviewed for certain significant systems, such as Veterans Health Information Systems and Technology Architecture, and users with excessive privileges given their job responsibilities. VA Handbook 6500, Appendix F provides high-level policy and procedures for collection and review of system audit logs. Audit log collections and reviews are critical for evaluating security-related activities, such as determining individual accountability, reconstructing security events, detecting

VA OIG 18-02127-64 | Page 7 | March 12, 2019 intruders, and identifying system performance issues. Moreover, we have identified and reported deficiencies with audit logging for more than 10 years in the annual FISMA reports.

D. Strong Authentication

VA has made progress in implementing strong authentication for remote and local network access. However, we noted that two-factor authentication for local network access was not fully implemented across the agency for FY 2018. VA Handbook 6500, Appendix F establishes high-level policy and procedures for managing system connections and authentication standards.

Moving forward, VA needs to fully implement strong authentication for all users before connecting to VA networks.

B. CORRECTIVE ACTIONS RECOMMENDED

7. We recommended the Executive in Charge for Information and Technology implement mechanisms to enforce VA password policies and standards on all operating systems, databases, applications, and network devices. (This is a repeat recommendation from prior years.)

8. We recommended the Executive in Charge for Information and Technology implement periodic reviews to minimize access by system users with incompatible roles, permissions in excess of required functional responsibilities, and unauthorized accounts. (This is a repeat recommendation from prior years.)

9. We recommended the Executive in Charge for Information and Technology enable system audit logs on all critical systems and platforms and conduct centralized reviews of security violations across the enterprise. (This is a repeat recommendation from prior years.)

10. We recommended the Executive in Charge for Information and Technology fully implement two-factor authentication to the extent feasible for all user accounts throughout the agency.

(This is a modified repeat recommendation from prior years.)

Management Comments

The Principal Deputy Assistant Secretary for Information and Technology concurred with Recommendations 7, 8, 9, and 10. For Recommendation 7, the Principal Deputy Assistant Secretary stated that VA is currently taking measures to address the findings regarding service account password configuration and the service account password change process, based on the deployment of a technological solution. To address Recommendation 8, VA is working with the Department of Homeland Security to create a master user record. This record will pull-in data from multiple sources to build an access record for users at the VA network. In addition, VA is working on developing policy for financial applications, outlining annual user account reviews for adding, modifying, and/or deleting user accounts. In response to Recommendation 9, VA will continue to improve system owner accountability and communication with the Cyber Security Operations Center to ensure that audit logging for critical systems is performed. For Recommendation 10, VA is taking necessary mitigations to reduce the risk to the enterprise by implementing compensating controls.

VA OIG 18-02127-64 | Page 8 | March 12, 2019

OIG Response

The Principal Deputy Assistant Secretary’s planned corrective actions are responsive to Recommendations 7, 8, 9, and 10. The OIG will monitor VA’s progress and follow up on implementation of the recommendations until all proposed actions are completed. Appendix D provides the full text of the Principal Deputy Assistant Secretary’s comments.

3. Configuration Management Controls

We continued to identify significant deficiencies in configuration management controls designed to ensure VA’s critical systems have appropriate security baselines, accurate system and software inventories, and up-to-date vulnerability patches. VA Handbook 6500, Appendix F provides high-level policy guidelines regarding mandatory configuration settings for information technology hardware, software, and firmware. However, during our testing, we identified unsecure web application servers, excessive permissions on database platforms, vulnerable third-party applications and operating system software, and a lack of common platform security standards and monitoring across the enterprise.

A. Unsecure Web Applications and Services

Tests of web-based applications identified several instances of VA data facilities hosting unsecure web-based services that could allow malicious users to gain unauthorized access into VA information systems. NIST SP 800-44, Version 2, Guidelines on Securing Public Web Servers, recommends that organizations should implement appropriate security management practices when maintaining and operating a secure web server. Despite these guidelines, VA has not implemented effective controls to identify and remediate security weaknesses on its web applications. VA has mitigated some information system security risks from the internet using network-filtering appliances. However, VA’s internal network remains susceptible to attack from malicious users who could exploit vulnerabilities and gain unauthorized access to VA information systems.

Additionally, we noted that VA was unable to provide an accurate inventory of devices running web applications at local facilities. While VA uses a process to identify web based vulnerabilities, such as Structured Query Language injection attacks on major systems, this process was not applied to all web based systems across the enterprise. Consequently, we continue to identify significant security vulnerabilities on web applications hosted at local facilities.

B. Unsecure Database Applications

While VA has made improvements in correcting database vulnerabilities, our database assessments continue to identify a number of unsecure configuration settings that could allow any database user to gain excessive unauthorized access permissions to critical system information. NIST SP 800-64, Revision 2, Security Considerations in the System Development Life Cycle: Information Security, states that configuration management and control procedures are critical to establishing an initial baseline of hardware, software, and firmware components for the information system. VA has not implemented effective controls to identify and remediate

VA OIG 18-02127-64 | Page 9 | March 12, 2019 security weaknesses on databases hosting mission-critical applications. In addition, key VA financial management systems utilized outdated and unsupported technology that hinders VA’s ability to mitigate against certain information security vulnerabilities.

C. Application and System Software Vulnerabilities

Network vulnerability assessments identified a significant number of outdated operating systems and vulnerable third-party applications that could allow unauthorized access onto mission-critical systems and data. NIST SP 800-40, Revision 3, Guide to Enterprise Patch Management Technologies, states an agency’s patch and vulnerability management program should be integrated with configuration management to ensure efficiency. VA has not implemented effective controls to identify and remediate security weaknesses associated with outdated third-party applications or operating system software.

We also noted that many of VA’s legacy systems have been obsolete for several years and are no longer supported by the vendor. Due to their age, legacy systems are more costly to maintain and difficult to update to meet existing information security requirements. Furthermore, deficiencies in VA’s patch and vulnerability management program could allow malicious users to gain unauthorized access into mission-critical systems and data. By implementing a robust patch and vulnerability management program, VA could more effectively remediate vulnerabilities identified in operating systems, databases, applications, and other network devices.

D. Unsecure Network Access Controls

Network vulnerability assessments identified weak network segmentation controls that could allow unauthorized access into mission-critical systems and data. Consequently, VA needs to strengthen its methodologies for monitoring medical devices and the trusted hosts that connect to them and ensuring they are properly segregated from other networks. Numerous critical and high-risk vulnerabilities, such as excessive system permissions, were identified residing on unpatched systems and unsecure trusted hosts that were connected to VA’s general network.

These insecure hosts were given the ability to access medical devices behind the Medical Device Isolation Architecture.

Although there were improvements in identification of vulnerabilities, VA did not perform comprehensive and credentialed vulnerability scans of all systems connected to VA’s network to mitigate security risks posed by these devices. Thus, VA did not have a complete inventory of existing security vulnerabilities on its networks. In addition, OIT did not manage the configuration and security of certain devices in accordance with VA policy. As a result, our scans identified vulnerabilities that included administrator access to: (1) certain configuration and management consoles for device networking, (2) insecure database configuration privileges, and (3) an unsecured file directory which included potential sensitive patient information.

We noted that several VA organizations shared the same local network at some medical centers and data centers; however, not all systems were under the common control of the local site.

Consequently, some networks not controlled by OIT had significant vulnerabilities that weakened the overall security posture of the local sites. By not implementing effective network segmentation

VA OIG 18-02127-64 | Page 10 | March 12, 2019 controls for major applications and general support systems, VA is placing other critical systems at unnecessary risk of unauthorized access.

E. Baseline Security Configurations

VA developed guidelines to define agency-wide security configuration baselines for its major information system components. FISMA Section 3544 requires each agency to establish minimally acceptable system configuration requirements and ensure compliance. However, we noted that common platform security standards were not consistently implemented or monitored on all VA platforms. Testing also identified numerous network devices that were not configured to a common security configuration standard, resulting in default network services, excessive permissions, weak administrator passwords, or outdated versions of system software.