GAO uncovers wireless holes

The wireless networks that many federal agencies use in their Washington, D.C., offices lack essential safeguards to keep information secure, the Government Accountability Office reported today.

GAO evaluated six unnamed federal agencies in Washington. Investigators detected wireless signals outside each agency’s buildings, which can draw the attention of potential cyberattackers and permit eavesdropping of confidential information. “In one case, we were able to detect an agency’s network while we were testing at another agency several blocks away,” the report stated.

All six agencies had unsecured wireless devices operating on their wireless networks, the report found. Some of the wireless devices were also plugged into agencies’ internal networks.

One unnamed agency had more than 90 laptops hard-wired into its network but also connected to wireless networks. That setup could allow wireless attackers to get access to the internal, hard-line network, the report stated.

All six agencies had unauthorized individual wireless access points running on their machines and ad-hoc networks set up among multiple machines. None of the agencies monitor continuously for unauthorized wireless access.

A Federal Computer Week investigation of federal agencies and vendors last year found wireless vulnerabilities similar to those described in the GAO report.

Security lapses exist despite common knowledge that wireless networks are hard to keep secure, the report stated.

“Without implementing key controls, agencies cannot adequately secure federal wireless networks and, as a result, their information may be at increased risk of unauthorized disclosure, modification, or destruction,” said Gregory Wilshusen, director of information security issues at GAO, in the report.

The report, researched from September 2004 to March 2005, found that of the 24 major federal agencies, nine lack any policy on wireless networks. Two agencies ban all wireless devices and networks.

Thirteen agencies have policies governing the use and operation of wireless networks, the report found. Seven of the 13, however, have not developed policies on what kind of information employees and contractors may safely transmit wirelessly.

Of those 13 agencies with wireless policies, 12 extend the policies to contractors, according to the report. But 18 agencies do not provide training to secure wireless networks to either their staff members or contractors.

Most agencies don’t monitor wireless signals to make sure that their employees comply with requirements, the report found. They also do not prevent the leakage of signals outside facilities, or detected unauthorized wireless access.

The agencies have not yet established important protections for their wireless networks, the report found. That includes policies on use, security configuration requirements, continuous and comprehensive monitoring of wireless signals, and training employees and contractors in the agencies' wireless policies.

The federal government must protect against wireless attacks against its networks, physical hijacking of its wireless devices, and preventing unsanctioned networks from infiltrating its facilities, the report stated.

The report recommended that the White House’s Office of Management and Budget require all federal agencies to improve the security of their wireless networks. Agencies must also integrate wireless security into their information security programs as ordered under FISMA.

In the report, OMB concurred with the GAO’s findings. OMB officials said that the National Institute of Standards and Technology is updating its guidance for wireless technology and will send the revisions for comment in August.

OMB officials said it is up to agencies to meet FISMA requirements for information security. OMB officials also told the GAO that they would consider including wireless security as a metric in performance reviews of agencies’ information security programs.