NASA info security controls are broken, GAO concludes

Key information technology systems at NASA have weaknesses in several critical areas that could lead to those systems being compromised, according to the Government Accountability Office.

Although controls are being implemented as part of a risk-based information security program, required under the Federal Information Security Management Act, controls were not always adequate or consistently enforced, resulting in security gaps in physical and logical perimeters and leaving vulnerabilities in networks and systems.

“A key reason for these weaknesses was that NASA had not yet fully implemented key elements of its information security program,” GAO said in its report, NASA Needs to Remedy Vulnerabilities in Key Networks. “As a result, highly sensitive personal, scientific, and other data were at an increased risk of unauthorized use, modification, or disclosure.”

The space agency agreed with GAO's recommendations for strengthening and completely implementing security controls.

“Many of the recommendations are currently being implemented as part of an ongoing strategic effort to improve information technology management and IT security program deficiencies previously identified through several NASA internal assessments,” deputy administrator Lori B. Garver wrote.

IT security concerns are not limited to NASA. Agencies across government as well as individuals and private sector organizations across the world have been subjected to a growing number of attacks and intrusions by criminal organizations and, it is believed, by other nations as well. Threats are expected only to become more serious.

“This concern is well-founded for a number of reasons, including the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, the steady advance in the sophistication and effectiveness of attack technology, and the dire warnings of new and more destructive attacks to come,” GAO said.

NASA has not ignored its security, but just $15 million — slightly less than 1 percent the agency’s $1.6 billion IT budget — was spent on security in fiscal 2009. In 2007 and 2008, NASA reported 839 cases of malicious code, 209 cases of unauthorized access and 72 denial-of-service attacks to the U.S. Computer Emergency Readiness Team. In February this year, 82 internal devices were found infected with the Seneka Rootkit that had been communicating with malicious servers since January. By March, three NASA centers were infected.

GAO examined information security at NASA headquarters in Washington, as well as at the Goddard Space Flight Center in Greenbelt, Md.; the Jet Propulsion Laboratory in Pasadena, Calif.; the Marshall Space Flight Center in Huntsville, Ala.; and the Ames Research Center in Moffett Field. Calif. Although the space agency has implemented many information security controls, GAO found that some weaknesses persisted.

Among the weaknesses were that the centers did not consistently implement effective electronic access controls. Two centers did not requiring strong passwords and password files were unencrypted. Three centers did not adequately restrict user access to the least privileges needed to perform a mission, allowing unnecessary remote access, shared accounts and group user identifications. Network encryption sometimes used weak algorithms, some network management connections were left unencrypted, and desktops and laptops were not fully encrypted.

Vulnerability scanning was not comprehensive, source code was not being reviewed for vulnerabilities, and not all systems were protected by intrusion detection systems, according to the report. Patch and configuration management also was not up to date. “As a result, NASA may not detect certain vulnerabilities or unauthorized activities, leaving the network at increased risk of compromise or disruption,” GAO said.

System and physical network perimeters also were not adequately protected. Boundary protection between sensitive networks was not adequate, and some centers did not have host-based firewalls and some firewalls could be bypassed. Three centers had e-mail servers that allowed spoofed e-mails to deliver dangerous attachments. Physical access controls were in place at sensitive facilities, but were not properly used.

“Retractable bollards that protect delivery doors, generators, and fuel tanks at the data and communication centers were not operable and were in the ‘open’ retracted position,” GAO found.

Problems were traced to weaknesses in the NASA security program. GAO found that the agency did not always fully assess information security risks and had not fully developed and documented security policies and procedures. Some key information was not included in security plans, comprehensive tests and evaluation of its information system controls had not been conducted and plans to remedy known weaknesses were not being tracked. There also was inadequate planning for service disruptions and for detecting, reporting and responding to security incidents.

GAO recommended that NASA:

• Develop and implement comprehensive and physical risk assessments that include mission-related systems and applications and known vulnerabilities identified.
• Develop and implement security policies and procedures for malware, incident handling roles and responsibilities, and physical environmental protection.
• Include key elements for system security plans such as information from risk assessments and signed system interconnection security agreements.
• Conduct comprehensive security testing and evaluation of all relevant security controls, including management, operational and technical controls.
• Develop remedial plans to address deficiencies and ensure that IT system items are tracked and reported to the agency CIO in a timely manner so that corrective actions can be taken.
• Update contingency plans to include key information, including contact information and approvals, and identify geographically diverse backup sites that are unlikely to be affected by the same disaster event.
• Implement an adequate incident detection program to include a consistent definition of an incident, incident roles and responsibilities, along with resources to operate the program.

GAO made an additional 179 recommendations separately with limited distribution.