Justice IG finds IT security vulnerabilities
Despite getting high marks for its compliance with computer security
legislation, the Justice Department had major systemic information
technology vulnerabilities and did not fully implement policies and
procedures meant to increase IT security, according to an audit by the
department’s inspector general.
The IG found vulnerabilities
that require immediate attention, including inadequate access controls
and outdated security patches. The IG determined that Justice lacks
effective methodologies for tracking corrective action, applying
departmentwide fixes and maintaining an inventory of devices connected
to the department’s various IT networks, the Dec. 12 report states.
Portions of the document were redacted.
Justice received an
A-plus for its compliance with the Federal Information Security
Management Act (FISMA) in fiscal 2007 on an annual report card released
by Rep. Tom Davis (R-Va.), ranking member of the House Oversight and
Government Reform Committee. However, the department’s focus on meeting
FISMA requirements might have affected its ability to secure its IT
environment, according to the IG’s report.
For the audit, the
Justice IG used data for calendar year 2007 and the report card issued
in May 2008. In response to a draft of the report, Vance Hitch,
Justice’s chief information officer, said the department has taken a
number of steps to bolster IT security since the audit was conducted,
including creating an IT governance structure to support the security
The IG said the department had documented a
comprehensive IT security program, created an IT oversight council and
implemented a tool to track FISMA compliance, but it still lacked an
effective vulnerability management program.
“We are concerned
that the security of the department’s IT systems may be compromised
because of its inability to consistently and systematically mitigate
identified security vulnerabilities,” the IG wrote.
Justice’s fiscal 2007 FISMA report to the Office of Management and
Budget, the department ran 225 IT systems in fiscal 2007, and all of
them were accredited at the end of the fiscal year, the IG’s report
“Although the department is ensuring that it meets FISMA
requirements, it is still responsible for ensuring the security of the
information contained within its IT systems, even if FISMA does not
require a specific remediation step,” the IG wrote. “We believe that a
structured process for monitoring vulnerability remediation would
improve the accuracy of the department’s assessment of the security
controls environment of its IT systems.”
The IG recommended that the department:
Establish a structured process for monitoring and tracking the
remediation of critical vulnerabilities identified during monthly scans.
• Ensure that the new monitoring processes conduct a detailed review and analysis of critical vulnerabilities.
• Develop a system to monitor the department’s IT environment in real time.
• Take an inventory of networked devices departmentwide.
a written response to the report, Hitch said he agreed with the
recommendations. He also described the steps the department has already
taken or planned to take to address the issues the IG raised.
said Justice will deploy a framework to track vulnerabilities and
corrective actions and will implement a tool for monitoring critical
vulnerabilities, Hitch said.
The new framework, set to be
launched by Jan. 31, 2009, will require security and operations reviews
of new vulnerabilities and regular meetings to discuss them, he said.
also said Justice has had a system that provides real-time monitoring
of its IT security environment since October 2007, and he considers the
IG's recommendation in that area to be addressed.
Finally, Hitch said Justice i
taking an inventory of all the department’s IT assets, which it will complete by Jan. 31.
The IG said that based on Justice’s responses, the report was considered resolved.
Ben Bain is a reporter for Federal Computer Week.