WIXLIB

A. Standard Accounting, Budgeting, andReporting System SecurityManagementControls over SABRS security management and operations wereineffective because the CIO did not assign clear security responsibilities tothe Program Management Office (PMO). Specifically: the SABRS security management structure did not ensureproper segregation of duties and security responsibilities; the CIO did not clearly delegate the authority and duty toresponsible parties to develop approved policies andprocedures for SABRS IT security operations; the CIO did not clearly assign an office the responsibility forthe IT security and control requirements; and software waivers and license agreements were not maintainedto assure personnel that only authorized software was loadedon computers which can be used to access SABRS.Ineffective controls over SABRS security management and operationsincrease the vulnerability of SABRS IT resources and are detrimental toan effective information security program.Proper Segregation of Duties and ResponsibilityThe SABRS security management structure lacks proper segregation of duties andsecurity responsibilities. The CIO did not ensure that the Terminal Area SecurityOfficer (TASO) duties were independent from operations. The CIO did notinclude clear security responsibilities in the PMO personnel job expectations.TASO Segregation of Duties. TASOs create and assign user IDs and set userprivileges for SABRS. TASOs report to DFAS operations instead of to a separateDFAS office. The current reporting hierarchy has TASOs reporting to DFASoperations instead of to a separate function outside of operations. DFASattempted to segregate duties when it moved PMO reporting to the CIO, but theTASOs, who had reported to the PMO, remained in DFAS operations. Thisstructure allows security controls to be circumvented to provide certain servicesto customers, including to USMC. For example, TASOs can grant access rights4

to personnel that allow them to bypass or change security controls. NIST advisesthat computer security embedded in operations lacks independence, has minimalauthority, receives little management attention, and has few resources.Assigned Security Responsibilities. We reviewed the performance plans for thePMO personnel to determine each employee’s specific security responsibilities.The performance plans for PMO personnel did not have security responsibilitiesincluded as part of their job expectations from the CIO. According to NIST, theassignment of security responsibilities should be in writing to ensure that asystem’s application has adequate security. It would be appropriate to useperformance plans to formally communicate the security responsibilities to PMOpersonnel.Security Policies and ProceduresControls over SABRS security management and operations are ineffectivebecause the CIO did not clearly delegate the authority and duty to responsibleparties to develop approved policies and procedures for SABRS IT securityoperations. Policies and procedures did not exist or were not formally approvedfor access authorizations, periodic reviews of access authorizations, and dataencryption. Management’s requirements or actual intent is not known and cannotbe enforced if the policies and procedures have not been formally approved.Access Authorizations. The PMO, as a component of the CIO, provided deskprocedures, but not formal policies, for granting system access authorizations.The desk procedures were not properly approved by DFAS management.According to NIST, approved policies are needed to provide sufficientinformation or direction to be used in establishing an access control list. Inaddition, the Government Accountability Office Federal Information SystemControls Audit Manual states management is responsible for developing thedetailed policies, procedures, and practices to fit an agency’s operations.Management should also ensure these policies are built into and are an integralpart of IT security operations. Documented and approved access control policieswill make these operations substantially easier to follow and will improve systemaccess control.Periodic Reviews of Access Authorizations. The PMO, as a component of theCIO, provided desk procedures, but not formal policies, for periodic reviews ofaccess authorizations. The desk procedures were not properly approved by DFASmanagement, and they did not provide for periodic review of access rights foreach user. According to NIST, it is necessary to periodically review useraccounts on a system to ensure proper authorizations and manage system access.Application managers (and data owners, if different) should review all access5

levels of all application users every month and sign a formal access approval list,which will provide a written record of the approvals. The PMO is often the onlyindividual in a position to know current access requirements.Informal policies and procedures lack the weight of authority provided by thewritten approval of a senior management official, the CIO. Managementofficials’ approval provides clear evidence to employees and contractors thatmanagement is in agreement with the stated policies and procedures and thatadherence is required.Effective administration of users' access is essential to maintaining systemsecurity. User account management focuses on identification, authentication, andaccess authorizations. This process should include periodic verification of useraccounts and access authorizations. User accounts must also be timely changedfor modification or removal of access and associated issues for employees whoare reassigned, promoted, terminated, or who retire.Data Encryption. The PMO, as a component of the CIO, could not identify itsdata encryption procedures. PMO personnel stated encryption is not under theirdirect control so they do not believe they need to know this information.According to NIST, an organization should use encryption to protect theconfidentiality of remote access sessions. During our audit, NIST was updated(December 2006); however, the requirement to use encryption did not change andstill applies. The requirements for encryption and remote access policies arecritical because they address the security of data transmission. The PMO hasprimary responsibility for the security of SABRS. It should be aware of theencryption used for their application.SABRS Security and Control RequirementsControls over SABRS security management and operations are ineffectivebecause the CIO did not clearly assign responsibility for the IT security andcontrol requirements. Specifically, the SABRS security environment did notinclude: a complete risk assessment; an adequate security plan, also called a System Security AuthorizationAgreement; identification of information and resources critical to the operations ofSABRS in its contingency plan;6

implementation of intrusion detection and incident responseprocedures; and assurance that users completed required security awareness training.Risk Assessments. The PMO, as a component of the CIO, did not complete arequired risk assessment because the CIO did not clearly assign securityresponsibilities to the PMO. Although the PMO identified some potential risks, itdid not perform a risk assessment of natural threats or rank the probability ofidentified threats occurring, as required by NIST, OMB, and DoD Instructions.“Department of Defense Information Technology Security Certification andAccreditation Process (DITSCAP) Application Manual,” July 31, 2000, states:The SSAA 1 should clearly state the nature of the threat that is expectedand wherever possible, the expected frequency of occurrence. Genericthreat information is available but it must be adapted to clearly state theexpected threats to be encountered by the system. DITSCAP alsorequires the risk analysis to identify appropriate cost-effectivecountermeasures to mitigate the risk.The PMO did not adequately complete the risk assessment and, therefore, did notinclude appropriate countermeasures in its security plan. DoD Instruction 8500.2requires agencies to ensure that DoD Component-owned or controlled DoDinformation systems are assessed for information assurance vulnerabilities on aregular basis, and that appropriate information assurance solutions areimplemented to eliminate or otherwise mitigate identified vulnerabilities.Without adequate risk assessments and appropriate countermeasures, the SABRSapplication could be at risk for a security event (for example, flood, loss of power,or intrusion) to occur that cannot be promptly mitigated. Ultimately, SABRScould be unable to perform its mission of financial accounting and reporting forthe USMC.Security Plans. Although the PMO prepared a security plan for SABRS, it didnot conform to NIST, OMB, and DITSCAP standards. Of the 65 sections in the2003 security plan, 26 sections did not comply with standards; of 65 sections forthe 2006 security plan, 27 did not comply with standards. Specific areas ofnoncompliance are listed in Appendix B. In addition, the 2003 security plan wasout of date. A major modification to SABRS was completed in October 2005, butthe PMO waited until May 2006 to update the security plan. This met the 3-yearminimum update, but it did not meet the NIST requirement to update the securityplan when a major modification was completed on the system. Managementauthorizes a system to process information or to operate based on the security1The SSAA (System Security Authorization Agreement) is the Security Plan.7

plan when completing the certification and authorization process. Authorizing asystem to process information provides an important quality control, and, byauthorizing processing in a system, the manager accepts its associated risks.Because the security plan for SABRS was not up to date, management may beunaware of the risks they are accepting within SABRS when certification andauthorization is completed.Contingency Planning. The SABRS contingency plan did not define theinformation resources criticality in accordance with NIST guidance and DoDInstruction 8500.2. Both standards require the identification of mission andbusiness essential functions for priority restoration planning along with all assetssupporting mission or business essential functions.The PMO provided the contingency plan and results of testing performed. Thecriticality of data and business essential functions were not identified as part ofthe plan. Contingency plan testing identified the users’ inability to obtain remoteaccess to the contingency site. Remotely accessing the contingency site could becritical during an emergency or system disruption.Intrusion Detection and Incident Response Procedures. The PMO, as acomponent of the CIO, provided policies and procedures to employees forreporting intrusions; however, the policies and procedures did not address howmonitoring within SABRS detects security violations. NIST recommends abaseline level of logging and auditing on all systems. That is, all systems shouldhave a minimum level of recording and reviewing of all system activity.Furthermore, NIST recommends all critical systems have a higher baseline level.The logs frequently provide value during incident analysis, particularly if auditingis enabled. The PMO did not have procedures established for monitoring,through logging and auditing, for SABRS to detect security violations.SABRS is considered a major application, and according to DoDInstruction 8500.2 major applications require intrusion detection systems. TheDoD Instruction requires an incident response plan that identifies the responsibleComputer Network Defense Service Provider, defines reportable incidents,outlines a standard operating procedure for incident response, identifies usertraining, and establishes an incident response team. The plan should be exercisedat least annually. The PMO did not have an intrusion detection system as part ofan incident response plan.Application-level audit trails should record user activities, such as opening andclosing data files; reading, editing, and deleting records or fields; and printingreports. Without this security control, security violations could occur withinSABRS that would not be detected, investigated, or corrected.8

Security Awareness Training. The PMO did not verify that all SABRS usersattended the required annual computer security awareness training. FISMArequires each agency to develop, document, and implement an agency-wideinformation security program that includes security awareness training. Thistraining applies to all personnel, contractors and other users of informationsystems that support the operations and assets of the agency. Additionally, DoDand OMB require employees receive mandatory periodic training. NISTstandards, which are directed by OMB and are considered best practices, requireannual training for all users.An effective IT security program requires significant attention be given totraining IT users on security policy, procedures, and techniques. We compared anincomplete list of SABRS users to a list of employees who attended annual ITsecurity training and determined that 2,946 of 3,148 SABRS users were notidentified as having completed the required training. Because the PMO did notverify that SABRS users completed the required IT security training, SABRS isvulnerable to greater security risk.Software Waivers or License AgreementsDFAS Technology Services Organization, as a component of the CIO, did notmaintain waivers or license agreements for selected software loaded on theircomputers. The CIO did not clearly assign those security responsibilities to theTechnology Services Organization. Waivers or license agreements authorize thesoftware for use. Unauthorized software could degrade SABRS processing.DFAS Technology Services Organization was unable to provide waivers orlicense agreements for 8 of 12 auditor sampled software programs. DFASInstructions require that only software that is part of the DFAS standard suite ofsoftware may be loaded onto a Government computer. All other software must beapproved for installation in writing by the DFAS Technology ServicesOrganization. The DFAS CIO should require that the Technology ServicesOrganization maintain software waivers and license agreements. These waiversand license agreements provide assurance that only authorized software isoperating on DFAS computers.9

Recommendations, Management Comments, and AuditResponseA.1 We recommend the Chief Information Officer, Defense Finance andAccounting Service:a. Separate the Terminal Area Security Officer functions fromDefense Finance and Accounting Service Operations to ensure segregation ofduties.Management Comments. The Director, Information and Technology, DFAS 2nonconcurred. He stated that TASOs 3 assist in implementing informationassurance provisions for local users and systems so they have to be physicallylocated in the same work area or organization as the users. He added that systemaccess procedures involve multiple roles and people, all of which provide anappropriate measure of segregation of duties.Audit Response. The Director, Information and Technology, DFASnonconcurred and the comments were nonresponsive. We recommended that theTASO functions be separated from operations to ensure segregation of duties.We do not agree that DFAS provides the appropriate measure of segregation ofduties between TASOs and operations. TASO functions should not be embeddedin DFAS Operation’s chain of command regardless of where the TASOs arephysically located.We request that the Director, Information and Technology, DFAS provide thecorrective actions taken to segregate TASO functions from operations and theassociated implementation dates.b. Develop performance plans that:(1) Incorporate security duties as performance measurementsfor personnel with security responsibilities, including but not limited to theProgram Management Office, and(2) Management can use to evaluate personnel and hold themaccountable for security operations.Management Comments. The Director, Information and Technology, DFASconcurred. He explained that the requirement to develop performance plans thatincorporate security duties as performance measurements for personnel withsecurity responsibilities will be added to the DFAS Information AssuranceWorkforce Improvement Program. The estimated completion date for this actionis September 30, 2008.2Defense Finance and Accounting Service (DFAS).3Terminal Area Security Officer (TASO).10

Audit Response. Comments from the Director, Information and Technology,DFAS are responsive and no additional comments are required.c. Identify and clearly delegate to specific offices the responsibility forestablishing and executing policy and procedural authorities over StandardAccounting, Budgeting, and Reporting System information technologysecurity operations.Management Comments. The Director, Information and Technology, DFASconcurred. The Director, Information and Technology, DFAS stated that heupdated DFAS 8500.1-R, Information Assurance, November 2007. This updatedpolicy assigns clear security responsibilities to program managers, systemmanagers, system information assurance managers, site information assurancemanagers, and other security officials.Audit Response. Comments from the Director, Information and Technology,DFAS are responsive and no additional comments are required.d. Direct applicable offices to create, document, implement, andapprove policies and procedures in accordance with National Institute ofStandards and Technology, DoD, and Government Accountability Officeguidance to address: access authorizations, periodic reviews of access authorizations, data encryption, and detecting and investigating security violations and activities.Management Comments. The Director, Information and Technology, DFASconcurred.The Director, Information and Technology, DFAS described the procedures thatDFAS uses for access authorizations and periodic review of access authorizations.He explained that an automated process identifies monthly ACIDs 4 that haveSABRS 5 access. A systems task documents the validation, showing accessidentifications and entries that were removed. He added that the SABRS PMO 6 isnotified of the monthly validation. He also stated that all ACIDs are reviewedwhen DFAS receives a request for SABRS access.For data encryption, the Director, Information and

Jun 06, 2008 · Officers Act of 1990, as amended, requires the United States Marine Corps (USMC) complete stand-alone General Fund and Working Capital Fund financial statements. The Defense Finance and Accounting Service (DFAS) Kansas City is responsible for reporting the USMC financi