U.S. OFFICE OF PERSONNEL MANAGEMENT OFFICE OF THE INSPECTOR GENERAL OFFICE OF AUDITS Final Audit Report Subject: AUDIT OF THE INFORMATION TECHNOLOGY SECURITY CONTROLS OF THE U.S. OFFICE OF PERSONNEL MANAGEMENT’S INVESTIGATIONS, TRACKING, ASSIGNING AND EXPEDITING SYSTEM FY 2014 Report No. 4A-IS-00-14-017 April 3, 2014 --CAUTION-- This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available under the Freedom of Information Act and made available to the public on the OIG webpage, caution needs to be exercised before releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy. Audit Report U.S. OFFICE OF PERSONNEL MANAGEMENT ------------------------------------------------------------- AUDIT OF THE INFORMATION TECHNOLOGY SECURITY CONTROLS OF THE U.S. OFFICE OF PERSONNEL MANAGEMENT’S INVESTIGATIONS, TRACKING, ASSIGNING AND EXPEDITING SYSTEM FY 2014 -------------------------------- WASHINGTON, D.C. Report No. 4A-IS-00-14-017 Date: 04/03/14 Michael R. Esser Assistant Inspector General for Audits --CAUTION-- This audit report has been distributed to Federal officials who are responsible for the administration of the audited program. This audit report may contain proprietary data which is protected by Federal law (18 U.S.C. 1905). Therefore, while this audit report is available under the Freedom of Information Act and made available to the public on the OIG webpage, caution needs to be exercised before releasing the report to the general public as it may contain proprietary information that was redacted from the publicly distributed copy. Executive Summary U.S. OFFICE OF PERSONNEL MANAGEMENT ------------------------------------------------------------- AUDIT OF THE INFORMATION TECHNOLOGY SECURITY CONTROLS OF THE U.S. OFFICE OF PERSONNEL MANAGEMENT’S INVESTIGATIONS, TRACKING, ASSIGNING AND EXPEDITING SYSTEM FY 2014 -------------------------------- WASHINGTON, D.C. Report No. 4A-IS-00-14-017 Date: 04/03/14 This final audit report discusses the results of our audit of the information technology security controls of the U.S. Office of Personnel Management’s (OPM) Investigations, Tracking, Assigning and Expediting (iTRAX) System. Our conclusions are detailed in the “Results” section of this report. Security Assessment and Authorization (SA&A) An SA&A of iTRAX was completed in October 2013. We reviewed the authorization package for all required elements of an SA&A, and determined that the package contained all necessary documentation. Federal Information Processing Standards (FIPS) 199 Analysis The security categorization of iTRAX appears to be consistent with FIPS 199 and National Institute of Standards and Technology (NIST) Special Publication (SP) 800-60 requirements, and we agree with the categorization of “high.” System Security Plan (SSP) The iTRAX SSP contains the critical elements required by NIST SP 800-18 Revision 1. i Security Assessment Plan and Report A security control assessment plan and report were completed in June and October 2013 for iTRAX as a part of the system’s SA&A. Security Control Self-Assessment Federal Investigative Services ensures that annual security control self-assessments are conducted in accordance with OPM policy. Contingency Planning and Contingency Plan Testing A contingency plan was developed for iTRAX that is in compliance with NIST SP 800-34 Revision 1 and is tested annually. Privacy Impact Assessment (PIA) A privacy threshold analysis was conducted for iTRAX and indicated that a PIA was required. A PIA was conducted in June 2013. Plan of Action and Milestones (POA&M) Process The iTRAX POA&M follows the format of the OPM POA&M guide, and has been routinely submitted to the OCIO for evaluation. NIST SP 800-53 Revision 3 Evaluation We evaluated the degree to which a subset of the IT security controls outlined in NIST SP 800- 53 Revision 3 was implemented for iTRAX. We determined that several controls could be improved. ii Contents Page Executive Summary ......................................................................................................................... i Introduction ......................................................................................................................................1 Background ......................................................................................................................................1 Objectives ........................................................................................................................................1 Scope and Methodology ..................................................................................................................2 Compliance with Laws and Regulations..........................................................................................3 Results ..............................................................................................................................................4 I. Security Assessment and Authorization ................................................................................4 II. FIPS 199 Analysis .................................................................................................................4 III. System Security Plan ............................................................................................................4 IV. Security Assessment Plan and Report ...................................................................................5 V. Security Control Self-Assessment .........................................................................................5 VI. Contingency Planning and Contingency Plan Testing ...........................................................6 VII. Privacy Impact Assessment ...................................................................................................6 VIII. Plan of Action and Milestones Process ..................................................................................7 IX. NIST SP 800-53 Revision 3 Evaluation ................................................................................7 Major Contributors to this Report ..................................................................................................11 Appendix: Federal Investigative Services’ February 19, 2014 response to the draft audit report, issued January 28, 2014 Introduction On December 17, 2002, President Bush signed into law the E-Government Act (P.L. 107-347), which includes Title III, the Federal Information Security Management Act (FISMA). It requires (1) annual agency program reviews, (2) annual Inspector General (IG) evaluations, (3) agency reporting to the Office of Management and Budget (OMB) the results of IG evaluations for unclassified systems, and (4) an annual OMB report to Congress summarizing the material received from agencies. In accordance with FISMA, we audited the information technology (IT) security controls related to the Office of Personnel Management’s (OPM) Investigations, Tracking, Assigning and Expediting (iTRAX) System. Background iTRAX is one of OPM’s critical IT systems. As such, FISMA requires that the Office of the Inspector General (OIG) perform an audit of IT security controls of this system, as well as all of the agency’s critical systems, on a rotating basis. The iTRAX web-based application is designed to support delivery of services to the Federal Investigative Service (FIS), which is responsible for delivery of investigative products and services that ensure federal agencies have the data needed on which to base determinations of eligibility for a security clearance or suitability for employment in sensitive positions. The system is operated and hosted by an OPM contractor, CACI, on behalf of FIS. This was our first audit of the security controls surrounding iTRAX. We discussed the results of our audit with FIS representatives at an exit conference. Objectives Our objective was to perform an evaluation of the security controls for iTRAX to ensure that FIS officials have managed the implementation of IT security policies and procedures in accordance with standards established by FISMA, the National Institute of Standards and Technology (NIST), the Federal Information System Controls Audit Manual (FISCAM) and OPM’s Office of the Chief Information Officer (OCIO). OPM’s IT security policies require owners of all major information systems to complete a series of steps to (1) certify that their system’s information is adequately protected and (2) authorize the system for operations. The audit objective was accomplished by reviewing the degree to which a variety of security program elements have been implemented for iTRAX, including: • Security Assessment and Authorization; • FIPS 199 Analysis; • Risk Assessment; • System Security Plan; • Security Assessment Plan and Report; • Security Control Self-Assessment; • Contingency Planning and Contingency Plan Testing; • Privacy Impact Assessment; 1 • Plan of Action and Milestones Process; and • NIST Special Publication (SP) 800-53 Revision 3 Security Controls. Scope and Methodology This performance audit was conducted in accordance with Government Auditing Standards, issued by the Comptroller General of the United States. Accordingly, the audit included an evaluation of related policies and procedures, compliance tests, and other auditing procedures that we considered necessary. The audit covered FISMA compliance efforts of FIS officials responsible for iTRAX, including IT security controls in place as of December 2013. We considered the iTRAX internal control structure in planning our audit procedures. These procedures were mainly substantive in nature, although we did gain an understanding of management procedures and controls to the extent necessary to achieve our audit objectives. To accomplish our objective, we interviewed representatives of OPM’s FIS and CACI employees with iTRAX security responsibilities. We reviewed relevant OPM IT policies and procedures, federal laws, OMB policies and guidance, and NIST guidance. As appropriate, we conducted compliance tests to determine the extent to which established controls and procedures are functioning as required. Details of the security controls protecting the confidentiality, integrity, and availability of iTRAX are located in the “Results” section of this report. Since our audit would not necessarily disclose all significant matters in the internal control structure, we do not express an opinion on the iTRAX system of internal controls taken as a whole. The criteria used in conducting this audit include: • OPM Information Security Privacy and Policy Handbook; • OMB Circular A-130, Appendix III, Security of Federal Automated Information Resources; • E-Government Act of 2002 (P.L. 107-347), Title III, Federal Information Security Management Act of 2002; • The Federal Information System Controls Audit Manual; • NIST SP 800-12, An Introduction to Computer Security; • NIST SP 800-18 Revision 1, Guide for Developing Security Plans for Federal Information Systems; • NIST SP 800-30 Revision 1, Guide for Conducting Risk Assessments; • NIST SP 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems; • NIST SP 800-37 Revision 1, Guide for Applying Management Framework to Federal Information Systems; • NIST SP 800-53 Revision 3, Recommended Security Controls for Federal Information Systems and Organizations; • NIST SP 800-60 Volume II, Guide for Mapping Types of Information and Information Systems to Security Categories; • NIST SP 800-84, Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities; 2 • Federal Information Processing Standards Publication 199, Standards for Security Categorization of Federal Information and Information Systems; and • Other criteria as appropriate. In conducting the audit, we relied to varying degrees on computer-generated data. Due to time constraints, we did not verify the reliability of the data generated by the various information systems involved. However, nothing came to our attention during our audit testing utilizing the computer-generated data to cause us to doubt its reliability. We believe that the data was sufficient to achieve the audit objectives. Except as noted above, the audit was conducted in accordance with generally accepted government auditing standards issued by the Comptroller General of the United States. The audit was performed by the OPM Office of the Inspector General, as established by the Inspector General Act of 1978, as amended. The audit was conducted from November 2013 through January 2014 in CACI’s Chantilly, Virginia facility and OPM’s Washington, D.C. office. This was our first audit of the security controls surrounding iTRAX. Compliance with Laws and Regulations In conducting the audit, we performed tests to determine whether FIS management of iTRAX is consistent with applicable standards. Nothing came to our attention during this review to indicate that FIS is in violation of relevant laws and regulations. 3 Results I. Security Assessment and Authorization A Security Assessment and Authorization (SA&A) of iTRAX was completed in October 2013. OPM’s Chief Information Security Officer reviewed the iTRAX SA&A package and signed the system’s authorization letter on October 28, 2013. The system’s authorizing official signed the letter and authorized the continued operation of the system on October 30, 2013. NIST SP 800-37 Revision 1 “Guide for Applying Management Framework to Federal Information Systems,” provides guidance to federal agencies in meeting security accreditation requirements. The iTRAX SA&A appears to have been conducted in compliance with NIST requirements. II. FIPS 199 Analysis Federal Information Processing Standards (FIPS) Publication 199, Standards for Security Categorization of Federal Information and Information Systems, requires federal agencies to categorize all federal information and information systems in order to provide appropriate levels of information security according to a range of risk levels. NIST SP 800-60 Volume II, Guide for Mapping Types of Information and Information Systems to Security Categories, provides an overview of the security objectives and impact levels identified in FIPS Publication 199. The iTRAX FIPS 199 Security Categorization Template analyzes information processed by the system and its corresponding potential impacts on confidentiality, integrity, and availability. iTRAX is categorized with a high impact level for confidentiality, moderate for integrity, low for availability, and an overall categorization of “high.” The security categorization of iTRAX appears to be consistent with FIPS 199 and NIST SP 800- 60 requirements, and we agree with the categorization of “high.” III. System Security Plan Federal agencies must implement on each information system the security controls outlined in NIST SP 800-53 Revision 3, Recommended Security Controls for Federal Information Systems and Organizations. NIST SP 800-18 Revision 1, Guide for Developing Security Plans for Federal Information Systems, requires that these controls be documented in a System Security Plan (SSP) for each system, and provides guidance for doing so. The SSP for iTRAX was created using the template outlined in NIST SP 800-18 Revision 1. The template requires that the following elements be documented within the SSP: • System Name and Identifier; • System Categorization; • System Owner; 4 • Authorizing Official; • Other Designated Contacts; • Assignment of Security Responsibility; • System Operational Status; • Information System Type; • General Description/Purpose; • System Environment; • System Interconnection/Information Sharing; • Laws, Regulations, and Policies Affecting the System; • Security Control Selection; • Minimum Security Controls; and • Completion and Approval Dates. We reviewed the iTRAX SSP and determined that it adequately addresses each of the elements required by NIST. IV. Security Assessment Plan and Report A Security Assessment Plan (SAP) and Security Assessment Report (SAR) were completed for iTRAX in June and October 2013 as a part of the system’s SA&A process. The SAP and SAR were completed by a contractor that was operating independently from FIS and CACI. We reviewed the documents to verify that a risk assessment was conducted in accordance with NIST SP 800-30 Revision 1, Guide for Conducting Risk Assessments. We also verified that appropriate management, operational, and technical controls were tested for a system with a “high” security categorization according to NIST SP 800-53 Revision 3. The SAP outlined the assessment approach and test methods. The SAR identified 25 control weaknesses; 18 of those weaknesses were immediately remediated, and the remaining weaknesses were added to the iTRAX Plan of Action & Milestones (POA&M). A risk rating was applied to each weakness to determine the potential impact of exploitation. We also reviewed the Security Assessment results table that contained the detailed results of the NIST SP 800-53 Revision 3 controls testing. The table indicated that five controls were not fully satisfied. These controls were appropriately documented in the system POA&M for tracking. Nothing came to our attention to indicate that the security controls of iTRAX have not been adequately tested by an independent source. V. Security Control Self-Assessment OPM requires that the IT security controls of each contractor-operated system be tested on an annual basis. In the years that an independent assessment is not being conducted on a system as part of an SA&A, the system’s owner must ensure that annual controls testing is performed by a government employee or an independent third party (i.e., the contractor operating the system should not act as the assessor). 5 We reviewed the iTRAX security control tests for the past three years, and nothing came to our attention to indicate that the security controls of iTRAX have not been adequately tested. A fourth revision to NIST SP 800-53 was published in April 2013, and agencies are allowed one year to implement any new or modified NIST guidance. We informed FIS that they must conduct an analysis to determine if testing modifications are necessary to comply with NIST SP 800-53 Revision 3 for the fiscal year 2014 security controls test. VI. Contingency Planning and Contingency Plan Testing NIST SP 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems, states that effective contingency planning, execution, and testing are essential to mitigate the risk of system and service unavailability. OPM’s security policies require all major applications to have viable and logical disaster recovery and contingency plans, and that these plans be annually reviewed, tested, and updated. Contingency Plan The iTRAX contingency plan documents the functions, operations, and resources necessary to restore and resume iTRAX operations when unexpected events or disasters occur. The iTRAX contingency plan adequately follows the format suggested by NIST SP 800-34 Revision 1 and contains the required elements. Contingency Plan Test NIST SP 800-34 Revision 1 provides guidance for testing contingency plans and documenting the results. Contingency plan testing is a critical element of a viable disaster recovery capability. A tabletop test of the iTRAX contingency plan was conducted by CACI officials in August 2013. The test involved documenting and discussing the recovery process for the iTRAX system. The testing documentation contained an analysis and review of the results. While the overall FIPS 199 security categorization of iTRAX is “high,” the availability category is “low.” NIST SP 800-34 Revision 1 states that tabletop exercises are sufficient testing for systems with a “low” availability categorization. VII. Privacy Impact Assessment FISMA requires agencies to perform a screening of federal information systems to determine if a Privacy Impact Assessment (PIA) is required for that system. OMB Memorandum M-03-22 outlines the necessary components of a PIA. The purpose of the assessment is to evaluate any vulnerabilities of privacy in information systems and to document any privacy issues that have been identified and addressed. FIS completed an initial privacy screening or Privacy Threshold Analysis of iTRAX and determined that a PIA was required for this system. A PIA was completed in June 2013 and approved by the system owner and CIO. 6 VIII. Plan of Action and Milestones Process A POA&M is a tool used to assist agencies in identifying, assessing, prioritizing, and monitoring the progress of corrective efforts for IT security weaknesses. OPM has implemented an agency- wide POA&M process to help track known IT security weaknesses associated with the agency’s information systems. We evaluated the iTRAX POA&M and verified that it follows the format of OPM’s standard template and has been loaded into Trusted Agent, the OCIO’s POA&M tracking tool, for evaluation. We determined that the weaknesses discovered during the SA&A security assessment were appropriately included in the POA&M. Nothing came to our attention to indicate that there are any current weaknesses in the management of the iTRAX POA&M. IX. NIST SP 800-53 Revision 3 Evaluation NIST SP 800-53 Revision 3, Recommended Security Controls for Federal Information Systems and Organizations, provides guidance for implementing a variety of security controls for information systems supporting the federal government. As part of this audit, we independently evaluated whether a subset of these controls had been implemented for the iTRAX. We tested approximately 55 security controls that were identified as being system-specific or a hybrid control. We tested one or more controls from each of the following control families: • Access Control • Media Protection • Awareness and Training • Planning • Audit and Accountability • Personnel Security • Security Assessment and Authorization • Risk Assessment • Configuration Management • System and Services Acquisition • Contingency Planning • System and Communication Protection • Identification and Authorization • System and Information Integrity These controls were evaluated by interviewing individuals with iTRAX security responsibilities, reviewing documentation and system screenshots, viewing demonstrations of system capabilities and conducting tests directly on the system. We determined that all tested security controls appear to be in compliance with NIST SP 800-53 Revision 3 requirements with the following exceptions: 1. Control AC-5 – Separation of Duties During interviews with subject matter experts we were informed that CACI application developers have access to the iTRAX production environment and have administrator privileges within the back-end software platform, Serena Business Manager. This situation constitutes a segregation of duties violation. NIST SP 800-53 Revision 3 states that organizations should separate duties of individuals as necessary, to prevent malevolent activity without collusion, document separation of duties, and implement separation of duties through assigned information system access 7 authorizations. Failure to ensure separation of duties increases the risk that the application developers could make unauthorized or malicious modifications to the iTRAX application. Recommendation 1 We recommend that FIS ensure that proper separation of duties is maintained within iTRAX and the back-end software platform. FIS Response: “FIS agrees with the recommendation and has taken action to resolve the issue prior to the report’s finalization. The iTRAX Development Team has been segregated into two groups to meet separation of duties requirements. Administrative privileges have been removed for all Developers except the Serena Development Team Lead (normally not involved in actual code development). The Serena Development Team Lead will be added to the Configuration Control Board (CCB) and will coordinate with approval procedures, internally review all code created on the development environment prior to production approval, and orchestrate periodic and planned iTRAX software updates to the production server. The supporting evidence has been supplied in the Post-Exit Brief Submission package.” OIG Reply: The evidence provided by FIS in response to the draft audit report indicates that adequate segregation of duties has been implemented; no further action is required. 2. Control AC-7 – Unsuccessful Login Attempts iTRAX servers and user workstations are not configured in accordance with OPM security guidelines. User accounts are appropriately configured to automatically lock after an incorrect password has been entered three times. However, the accounts automatically unlock after a predefined period of time; 15 minutes for workstations and 30 minutes for servers. The OPM Security and Privacy Policy Handbook requires that “the information system automatically locks the account until released by an administrator when the maximum number of unsuccessful attempts is exceeded.” Failure to enforce these guidelines increases the risk of unauthorized access to the system through a brute force attack. Recommendation 2 We recommend that FIS ensure that iTRAX server and workstation account lockout settings are modified to comply with OPM policy. FIS Response: “FIS agrees with the recommendation. These requirements are appropriately met in regards to logging into the OPM CISCO VPN and at the iTRAX application interface thru PIV logon. However, the local machine login continues to use user id and password. As a result, the account unlock setting is currently 15 minutes. The iTRAX users are a remote 8 workforce across the country and sending the laptop to a central location for an Administrator to unlock the account (per the OPM policy) is not a feasible option based on investigation timelines dictated by federal law. FIS and the iTRAX technical teams have been pursuing internal conversations with OPM and other parties to find a proper resolution for PIV authentication on the local endpoints. POA&Ms (POA&Ms # FYI4-QI-ITRAX-03, FY14-QI-ITRAX-04 and FY14-QI-ITRAX- 05) are already in place regarding the need for PIV authentication of these devices. FIS will provide more detail in the POA&Ms and will accurately reflect the condition in Trusted Agent FISMA (TAF).” OIG Reply: As part of the audit resolution process, we recommend that FIS provide OPM’s Internal Oversight and Compliance (IOC) division with evidence that server and workstation account lockout settings are configured in compliance with OPM guidelines. Control AU-6 – Audit Review, Analysis, and Reporting iTRAX servers are configured to record the activity of privileged users (i.e., system administrators). However, the event logs generated by these servers are only reviewed retroactively if a problem has been reported or detected, and there is no process in place to routinely review privileged user activity logs. Furthermore, there is no policy or procedure documenting the process for reviewing audit logs or reporting anomalies. NIST SP 800-53 Revision 3 requires that an organization “Reviews and analyzes information system audit records . . . for indications of inappropriate or unusual activity, and reports findings to designated organizational officials. . . .” Failure to routinely review elevated user activity increases the risk that malicious activity could go undetected and sensitive information could be compromised. Recommendation 3 We recommend that FIS ensure that a documented process is in place to routinely review iTRAX privileged user (administrator) activity. FIS Response: “FIS agrees with the recommendation and has taken action to resolve the issue prior to the report's finalization. iTRAX did not have a documented procedure to satisfy this requirement. Logs were monitored on an as needed basis, but no official audit procedure existed for Administrator activity and no official reporting mechanisms were identified or utilized. This situation has been resolved with newly introduced policy, procedure and reporting documentation. The supporting evidence has been supplied in the Post-Exit Brief Submission package.” 9 OIG Reply: The evidence provided by FIS in response to the draft audit report indicates that a policy, procedures, and an event tracking template related to reviewing privileged user activity have been created. As part of the audit resolution process we recommend that FIS provide IOC with evidence that the template is being utilized in accordance with the new policy and procedures. Control PE-1 – Physical and Environmental Protection Policy and Procedures Although the current employees at CACI facilities have an informal understanding of their roles and responsibilities when responding to an emergency, the organization has not formally documented emergency response procedures. We were told that CACI is in the process of collecting and documenting procedures in one centralized repository, but they have not done so at this time. NIST SP 800-53 Revision 3 requires that an organization have “A formal, documented physical and environmental protection policy that addresses purpose, scope, roles and responsibilities, management commitment, coordination among organizational entities, and compliance” and “Formal, documented procedures to facilitate the implementation of the physical and environmental protection policy and associated physical and environmental protection controls.” Failure to establish documented emergency response procedures increases the likelihood that personnel will not know how to respond in emergency situations within the computer room. Recommendation 4 We recommend that FIS ensure that emergency response procedures are formally documented for CACI facilities. FIS Response: “FIS agrees with the recommendation and has taken action to resolve the issue prior to the report's finalization. FIS would like to specify the CACI facilities in question are specifically those housing the IT infrastructure for the iTRAX system located at the Park East Data Center in Chantilly, Virginia. Emergency response procedures have been formally documented and will be attached to the System Security Plan. The supporting evidence has been supplied in the Post-Exit Brief Submission package.” OIG Reply: The evidence provided by FIS in response to the draft audit report indicates that emergency response procedures have been formally documented; no further action is required. 10 Major Contributors to this Report This audit report was prepared by the U.S. Office of Personnel Management, Office of Inspector General, Information Systems Audits Group. The following individuals participated in the audit and the preparation of this report: • , Group Chief • , Auditor-In-Charge • , IT Auditor 11 Appendix United States Office of Personnel Management TO: - - - ~tems Audits Group FROM: ncr Chief, IT System Security & Access Federal Investigative Services SUBJECT: Response to "Draft" Report No. 4A-IS-00-14-017- Dated· January 28, 2014 OIG Recommendation 1: We recommend that FIS ensure that the iTRAX system is subject to a functional disaster recovery test and that the system can be fully recovered at the backup location. FIS Response: FIS respectfully disagrees with the OIG recommendation and requests an opportunity for further di scussion on this finding . In August 2013, a full interrupt test and server rebuild was completed for the iTRAX system as identified in the System Security Plan (SSP) dated October 2013. In addition to the actual contingency situation declaration in August, a table top exercise was also completed and with successful results reported. FIS would also request and opportunity to discuss the OPM policy on security control seeping guidance. Although the overall system categorization of the iTRAX system is "High", the FIPS 199 indicates a " Low" categorization for "Availability". Based on our understandi ng of OPM policy and the requirements identified in NIST 800-34 Revl, we believe tape back-up and plans for relocation to a cold site should fully satisfy the requirement. OIG Recommendation 2: We recommend that FIS ensure that proper separation of duties is maintained within iTRAX and the back-end software platform. FIS Response: FIS agrees with the recommendation and has taken action to resolve the issue prior to the report's finalization . The iTRAX Development Team has been segregated into two groups to meet separation of duties requirements. Administrative privileges have been re moved for all Developers except the Serena Development Team Lead (normally not involved in actual code development). The Serena Development Team Lead will be added to the Configuration Control Board (CCB) and will coordinate with approval procedures, internally rev iew all code created on the development environment prior to production approval, and orchestrate periodic and planned iTRAX software updates to the production server. The supporting evidence has been supplied in the Post-Exit Brief Submission package. OIG Recommendation 3: We recommend that FIS ensure that iTRAX server and workstation account lockout settings are modified to comply with OPM policy. FIS Response: FIS agrees with the recommendation. These requirements are appropriately met in regards to logging into the OPM CISCO VPN and at the iTRAX application interface thru PIV logon. However, the local machine login continues to use user id and password. As a result, the account unlock setting is currently 15 minutes. The iTRAX users are a remote workforce across the country and sending the laptop to a central location for an Administrator to unlock the account (per the OPM policy) is not a feasible option based on investigation timelines dictated by federal law. FIS and the iTRAX technical teams have been pursuing internal conversations with OPM and other parties to find a proper resolution for PIV authentication on the local endpoints. POA&Ms (POA&Ms # FY14-Ql-ITRAX-03, FY14-Ql-ITRAX-04 and FY14-Ql-ITRAX-05) are already in place regarding the need for PIV authentication of these devices. FIS will provide more detail in the POA&Ms and will accurately reflect the condition in Trusted Agent FISMA (TAF). OIG Recommendation 4: We recommend that FIS ensure that a documented process is in place to routinely review iTRAX privileged user (administrator) activity. FIS Response: FIS agrees with the recommendation and has taken action to resolve the issue prior to the report's finalization. iTRAX did not have a documented procedure to satisfy this requirement. Logs were monitored on an as needed basis, but no official audit procedure existed for Administrator activity and no official reporting mechanisms were identified or utilized. This situation has been resolved with newly introduced policy, procedure and reporting documentation. The supporting evidence has been supplied in the Post-Exit Brief Submission package. OIG Recommendation 5: We recommend that FIS ensure that emergency response procedures are formally documented for CACI facilities. FIS Response: FIS agrees with the recommendation and has taken action to resolve the issue prior to the report's finalization. FIS would like to specify the CACI facilities in question are specifically those housing the IT infrastructure for the iTRAX system located at the Park East Data Center in Chantilly, Virginia. Emergency response procedures have been formally documented and will be attached to the System Security Plan. The supporting evidence has been supplied in the Post Exit Brief Submission package.
Audit of the Information Technology Security Controls of the U.S. Office of Personnel Management's Investigations, Tracking, Assigning and Expediting System FY 2014
Published by the Office of Personnel Management, Office of Inspector General on 2014-04-04.
Below is a raw (and likely hideous) rendition of the original report. (PDF)