[ISN] Homeland Security IG raps Secret Service's network security

[InfoSec News]

http://www.gcn.com/vol1_no1/daily-updates/37409-1.html

By Alice Lipowicz 
Contributing Staff Writer
10/25/05 

The Secret Service is falling short in its efforts to protect 
sensitive online data about its operations and in securing its IT 
networks, according to two new reports from Homeland Security 
Department inspector general Richard L. Skinner. 

The IG's audit found inadequacies in the security controls for 
sensitive data about protective operations contained in the Secret 
Service Web System (SSWeb). 

A redacted copy [1] of the audit is available on the IG's Web site. 

Vulnerabilities were discovered in access controls, configuration 
management procedures and continuity-of-operations safeguards, the 
report said. In some cases, default passwords were not changed at the 
time new software was installed. 

"Due to these database security exposures, there is an increased risk 
that unauthorized individuals could gain access to critical Secret 
Service database resources and compromise the confidentiality, 
integrity and availability of sensitive SSWeb data," the report said. 
"Further[more], the Secret Service may not be able to recover SSWeb 
following a disaster". Skinner recommended that the Secret Service 
ensure adequate controls for user access, review systems to facilitate 
the detection of inappropriate access, complete a configuration 
management plan and develop an IT contingency plan. 

The Secret Service generally agreed with the findings. 

In a second report, the IG examined the Secret Service's security 
controls for selected wire-based, sensitive but unclassified networks 
and judged them to be ineffective. 

"The Secret Service has not developed adequate policies and procedures 
or fully implemented processes that address security testing, 
monitoring network activities with audit trails and configuration and 
patch management," according to this second report [2]. 

As a result, there is increased risk for unauthorized access to the 
service's sensitive resources and data, the IG wrote. 

In a third report [3] released today, the IG reviewed Customs and
Border Protection agency policies and procedures to secure its
networks and concluded that they were inadequate with respect to
security testing, monitoring network activities with audit trails and
patch management.  In addition, controls are lacking "to ensure that
data residing on and traveling through its network resources is
properly protected," the report said.

-=-

Alice Lipowicz is a staff writer for Government Computer News. sister 
publication Washington Technology. 


[1] http://www.dhs.gov/interweb/assetlibrary/OIGr_05-37_Sep05.pdf
[2] http://www.dhs.gov/interweb/assetlibrary/OIGr_05-38_Sep05.pdf
[3] http://www.dhs.gov/interweb/assetlibrary/OIGr_05-37_Sep05.pdf