[ISN] IG finds FEMA disaster relief databases not secured

[InfoSec News]

Forwarded from: William Knowles <erehwon at c4i.org>

http://www.gcn.com/vol1_no1/daily-updates/37525-1.html

By Alice Lipowicz 
Contributing Staff Writer
11/08/05 

The Federal Emergency Management Agency is not adequately protecting 
its core databases containing sensitive disaster relief information, 
according to a new report from Homeland Security Department inspector 
general Richard L. Skinner. 

A redacted copy [1] of the report was posted at the inspector
general's Web site today.

FEMA - which comprises the bulk of DHS' Emergency Preparedness and 
Response directorate - has made some improvements in its IT security, 
including establishing a process to manage change and a contingency 
plan, the report said. 

However, FEMA has not implemented effective access controls and 
continuity of operations safeguards, nor has it conducted contingency 
plan training or testing. 

The inadequacies were found in information security controls for the 
National Emergency Management Information System (NEMIS), FEMA's core 
database system for managing disaster relief funding and resources. 

"Due to these database security exposures, there is an increased risk 
that unauthorized individuals could gain access to critical EP&R 
[Emergency Preparedness and Response] database resources and 
compromise the confidentiality, integrity and availability of 
sensitive NEMIS data," Skinner wrote in the report. "In addition, EP&R 
may not be able to recover NEMIS following a disaster." 

FEMA officials agreed with most of the audit findings and were taking 
corrective action, according to the report. However, 56 deficiencies 
remained unaddressed, Skinner wrote in a summary. 

In addition, FEMA has not fully aligned its IT security program with 
the department's policies and practices, the report said. Security 
controls have not been tested in more than a year, a contingency plan 
has not been tested, security control costs have not been integrated 
into the lifecycle of the system, and system and database 
administrators have not received specialized security training, 
according to the report. 

NEMIS was developed by Anteon International Corp. of Fairfax, Va., and 
became operational in 1998. The system replaced FEMA's legacy IT 
infrastructure with a fully integrated architecture consisting of more 
than 31 networked servers installed nationwide, according to a fact 
sheet posted on Anteon's Web site. 

CIS database security also lacking 

Separately, the DHS inspector general released another report [2]
stating that the Citizenship and Immigration Services agency has not
developed adequate database security controls for its Central Index
System, including access controls, configuration management procedures
and continuity of operations safeguards.

The Central Index System was established in 1985 to assist in 
enforcing immigration laws. It contains biographical and status 
information on about 55 million people, including permanent residents, 
naturalized citizens, apprehended aliens and others. 

-=-

Alice Lipowicz is a staff writer for Government Computer News' sister 
publication, Washington Technology. 

[1] http://www.dhs.gov/interweb/assetlibrary/OIGr_05-43_Sep05.pdf
[2] http://www.dhs.gov/interweb/assetlibrary/OIGr_05-42_Sep05.pdf



*====================================================================*
"Communications are the nervous system of the entire SAC organization,
and their protection is therefore, of the greatest importance. I like
to say that without communications, all I control is my desk, and that
is not a very lethal weapon."      ---      General T.S. Power U.S.A.F
----------------------------------------------------------------------
erehwon at c4i.org                            http://www.c4i.org/erehwon/
*====================================================================*