type: other

jurisdiction: US

text: b' Department of Homeland Security\n\n \xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\xef\xbf\xbd\n\n\n Management Advisory Report: \n\n A Guide for Assessing Cybersecurity within the Office \n\n of Inspector General Community \n\n\n\n\n\nThis report was prepared on behalf of Council of the Inspectors General on Integrity and Efficiency.\n\n\n\n\nOIG-14-43 February 2014\n\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n Washington, DC 20528 I www.oig.dhs.gov\n\n\n February 24, 2014\n\n\nMEMORANDUM FOR: Council ofthe Inspectors General on Integrity and\n\n\n\nFROM:\n n~ONc-\n 4arlton I. Mann\n Chief Operating Officer\n\nSUBJECT: Management Advisory Report: A Guide for Assessing\n Cybersecurity Within the Office of Inspector General\n Community\n\nThe Council ofthe Inspectors General on Integrity and Efficiency {CIGIE) tasked the\nCybersecurity Working Group with undertaking a review in which it would examine the\nrole of the Inspector General community in current Federal cybersecurity initiatives.\nCIGIE proposed that the Cybersecurity Working Group work under the auspices of the\nInformation Technology (IT) Committee. As a member of the IT Committee, the\nDepartment of Homeland Security (DHS) Office of Inspector General (OIG) was asked to\nlead and coordinate the Cybersecurity Working Group\'s efforts in identifying the\nInspector Generals\' cybersecurity oversight role.\n\nI am pleased to provide CIGIE with a high-level audit guide that can be used as a\nbaseline for cyber and IT security-related reviews conducted by the Inspector General\ncommunity. The guide is based on the subject matter expertise of DHS OIG IT audit\nmanagers and specialists, legal research, and a review of applicable websites and audit\nprograms developed within the OIG community. The intent ofthis guide is to provide a\nfoundation for conducting cybersecurity and IT system security-related audits. The\nguide was developed to the best knowledge available to DHS OIG. We trust that this\nguide will result in better protecting the integrity of Federal computer systems and\nnetworks and minimize the risks associated with cyber vulnerabilities and potential\nthreats.\n\nI would like to acknowledge the support provided to this effort by all the participants\nlisted in Appendix X to produce a final document that represents the needs of the\nInspector General community.\n\n\n\nAttachment\n\x0cThe Council of the Inspectors General on Integrity and Efficiency (CIGIE) was statutorily\nestablished as an independent entity within the executive branch by the Inspectorf\nGeneralfReformfActfoff2008, Public Law 110-409. The mission of the CIGIE is to\xe2\x80\x94\n\n\xe2\x80\xa2\t Address integrity, economy, and effectiveness issues that transcend individual\n government agencies.\n\n\xe2\x80\xa2\t Increase the professionalism and effectiveness of personnel by developing policies,\n standards, and approaches to aid in the establishment of a well-trained and highly\n skilled workforce in the Federal Inspector General (IG) community.\n\nCIGIE Membership\n\n\xe2\x80\xa2\t All IGs whose offices are established under either section 2 or section 8G of the\n InspectorfGeneralfAct, or pursuant to other statutory authority (e.g., the Special IGs\n for Iraq Reconstruction, Afghanistan Reconstruction, and Troubled Asset Relief\n Program).\n\n\xe2\x80\xa2\t The IGs of the Office of the Director of National Intelligence (or at the time of\n appointment, the IG of the Intelligence Community) and the Central Intelligence\n Agency.\n\n\xe2\x80\xa2\t The IGs of the Government Printing Office, the Library of Congress, the Capitol\n Police, the Government Accountability Office, and the Architect of the Capitol.\n\n\xe2\x80\xa2 The Controller of the Office of Federal Financial Management.\n\n\xe2\x80\xa2\t A senior-level official of the Federal Bureau of Investigation, designated by the\n Director of the Federal Bureau of Investigation.\n\n\xe2\x80\xa2 The Director of the Office of Government Ethics. \n\n\n\n\xe2\x80\xa2 The Special Counsel of the Office of Special Counsel. \n\n\n\n\xe2\x80\xa2 The Deputy Director of the Office of Personnel Management. \n\n\n\n\xe2\x80\xa2 The Deputy Director for Management of the Office of Management and Budget. \n\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\nCIGIE Information Technology Committee\n\nThe CIGIE Information Technology (IT) Committee\xe2\x80\x99s mission is to facilitate effective IT\naudits, evaluations, and investigations by IGs, and to provide a vehicle for the expression\nof the IG community\'s perspective on Government-wide IT operations. Under its\noperating principles, this committee strives to promote participation by the IG\ncommunity members in its activities, encourage communication and cooperation with\ncolleagues in the IT field (including Federal Chief Information Officers and staff, and\nsecurity professionals), and promote effective teamwork in addressing\nGovernment-wide initiatives, improving IG IT activities, and safeguarding national IT\nassets and infrastructure.\n\nSome of the key activities of this committee include coordinating IT-related activities of\nthe CIGIE, conducting relevant IT educational and training activities, advising the CIGIE\non IT issues, and providing for IT information exchange among the IGs, including best\npractices and current capabilities. The Cybersecurity Working Group was formed under\nthe auspices of the CIGIE IT Committee.\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\nTable of Contents\nExecutive Summary............................................................................................................. 1\n\n\nBackground ......................................................................................................................... 3\n\n\nObjective and Scope ........................................................................................................... 5\n\n\nFederal Agency Responsibilities for Critical Infrastructure ................................................ 6\n\n\nCybersecurity Policy............................................................................................................ 9\n\n\nSystem Security and Vulnerability Guidance .................................................................... 14 \n\n\nSystem Vulnerability Management and Penetration Testing........................................... 23 \n\n\nInformation Security Continuous Monitoring .................................................................. 29 \n\n\nCloud Computing .............................................................................................................. 33 \n\n\nSteps for Evaluating a Cybersecurity Program ................................................................. 37 \n\n\nSteps for Conducting Cybersecurity-Related Audits ......................................................... 41 \n\n\nAppendixes\n Appendix A: Additional References to Relevant Requirements and\n Guidance\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6.. ........................................................................... 54 \n\n Appendix B: 2013 and Beyond Threat Landscape ........................................... 70 \n\n Appendix C: Sample ROE ................................................................................. 75 \n\n Appendix D: Vulnerability Scanning and Penetration Testing Tools ............... 85 \n\n Appendix E: Objectives for Evaluating an Agency\xe2\x80\x99s Cybersecurity Program 100 \n\n Appendix F: Objectives for Evaluating Identity Management ...................... 102 \n\n Appendix G: Objectives for Evaluating Network Management and \n\n Security\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6................................................................ 105 \n\n Appendix H: Objectives for Evaluating Laptop Security ................................ 113 \n\n Appendix I: Objectives for Evaluating Wireless Security .............................. 118 \n\n Appendix J: Objectives for Evaluating Database Security............................. 122 \n\n Appendix K: Objectives for Evaluating UNIX Operating System Security ...... 130 \n\n Appendix L: Objectives for Evaluating Remote Access Controls and\n\n Security\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6................................................................ 141 \n\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix M: Objectives for Evaluating Mobile Device Security .................... 147\n Appendix N: Objectives for Evaluating Portable Storage Device Security ..... 150\n Appendix O: Objectives for Evaluating E-mail Security.................................. 152\n Appendix P: Objectives for Evaluating Web Server Security ......................... 155\n Appendix Q: Objectives for Evaluating DNS Server Security.......................... 157\n Appendix R: Objectives for Evaluating Firewall Security ............................... 159\n Appendix S: Objectives for AD Testing .......................................................... 163\n Appendix T: Objectives for Evaluating Incident Response, Handling, and\n Reporting\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6\xe2\x80\xa6................................................................ 165\n Appendix U: Objectives for Evaluating IPv6 ................................................... 168\n Appendix V: Objectives for RFID Testing ....................................................... 171\n Appendix W: Objectives for Evaluating Insider Threats ................................. 173\n Appendix X: Contributors to This Guide ........................................................ 176\n\nAbbreviations\n ACL Access Control List\n AD Active Directory\n AES Advanced Encryption Standard\n ANSI American National Standards Institute\n CD compact disk\n CERT/CC Computer Emergency Response Team Coordination Center\n CIGIE Council of the Inspectors General on Integrity and Efficiency\n CIKR critical infrastructure and key resources\n CIO Chief Information Officer\n CIS Center for Internet Security\n CISO Chief Information Security Officer\n CNCI Comprehensive National Cybersecurity Initiative\n COBIT Control Objectives for Information and related Technology\n CPR Cyberspace Policy Review\n CPU Central Processing Unit\n CVSS Common Vulnerability Scoring System\n DBMS database management system\n DHS Department of Homeland Security\n DISA Defense Information Systems Agency\n DMZ demilitarized zone\n DNS Domain Name System\n DNSSEC Domain Name System Security Extensions\n DoD Department of Defense\n EAP Extensible Authentication Protocol\n EIMS Enterprise Identity Management System\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\nE-mail electronic mail\nFedRAMP Federal Risk and Authorization Management Program\nFIPS Federal Information Processing Standards\nFISCAM Federal Information System Controls Audit Manual\nFISMA Federal Information Security Management Act of 2002\nFQDN Fully Qualified Domain Name\nFTP File Transfer Protocol\nGAO U.S. Government Accountability Office\nGID group identification\nHP Hewlett-Packard\nHSPD Homeland Security Presidential Directive\nHSR Homeland Security Roundtable\nHTML Hypertext Markup Language\nHTTP Hypertext Transfer Protocol\nIAO Information Assurance Officer\nICMP Internet Control Message Protocol\nICS Industrial Control Systems\nID identification\nIDPS intrusion detection and prevention system\nIDS intrusion detection system\nIEC International Electrotechnical Commission\nIEEE Institute of Electrical and Electronics Engineers\nIG Inspector General\nIP Internet Protocol\nIPv4 Internet Protocol, Version 4\nIPv6 Internet Protocol, Version 6\nISCM Information Security Continuous Monitoring\nISO International Organization for Standardization\nIT information technology\nITIL Information Technology Infrastructure Library\nITU International Telecommunication Union\nLDAP Lightweight Directory Access Protocol\nMAC Media Access Control\nNFS Network File System\nNIPP National Infrastructure Protection Plan\nNIST National Institute of Standards and Technology\nNSA U.S. National Security Agency\nNTP Network Time Protocol\nNVD National Vulnerability Database\nOCIO Office of the Chief Information Officer\nOIG Office of Inspector General\nOMB Office of Management and Budget\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\nOWASP Open Web Application Security Project\nPCI PIV Card Issuer\nPDD Presidential Decision Directive\nPII personally identifiable information\nPIV Personal Identity Verification\nRAM random access memory\nRAT Router Auditing Tool\nRFID Radio Frequency Identification\nRMF Risk Management Framework\nROE Rules of Engagement\nROM read-only memory\nSANS SysAdmin, Audit, Network, Security\nSDRAM synchronous dynamic random access memory\nsmb server message block\nSMS Short Message Service\nSMTP Simple Mail Transfer Protocol\nSNMP Simple Network Management Protocol\nSP Special Publication\nSQL Structured Query Language\nSSH Secure Shell\nSTIG Security Technical Implementation Guide\nTCP Transmission Control Protocol\nTFTP Trivial File Transfer Protocol\nUDP User Datagram Protocol\nURL Uniform Resource Locator\nUSB Universal Serial Bus\nUS-CERT United States Computer Emergency Readiness Team\nUUCP UNIX-to-UNIX-Copy\nVLAN virtual local area network\nVPN Virtual Private Network\nVTL Virtual Terminal Line\nVTP VLAN Trunking Protocol\nWEP Wired Equivalent Privacy\nWi-Fi wireless fidelity\nWLAN wireless local area network\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Executive Summary\n Securing cyberspace is an extraordinarily difficult challenge that requires a coordinated and\n focused effort from our entire society. The borderless nature of threats to, and emanating\n from, cyberspace requires robust engagement and strong partnerships with countries around\n the world. Cybersecurity risks pose some of the most serious economic and national security\n challenges our Nation faces. Cybersecurity involves the protective measures taken to secure\n cyberspace and its associated infrastructure, as well as the restoration of information systems\n and the data contained therein to ensure system confidentiality, integrity, and availability. It\n also aims to protect computers and networks from accidental or malicious harm by preventing,\n detecting, and responding to risks and attacks. Protection from the threat of cyber attacks is\n essential to the resilience and reliability of the Nation\xe2\x80\x99s critical infrastructure and key resources\n and, therefore, to our economic and national security.\n\n In the fall of 2010, the Council of the Inspectors General on Integrity and Efficiency asked the\n Department of Homeland Security Office of Inspector General to lead a Cybersecurity Working\n Group. The Cybersecurity Working Group was charged with undertaking a two-part review, in\n which it would (1) identify recommended best practices for maintaining the integrity of\n Inspector General information technology systems and protecting them against threats and\n vulnerabilities and (2) examine the role of the Inspector General community in current Federal\n cybersecurity initiatives.\n\n A report that addressed part one of the Council of the Inspectors General on Integrity and\n Efficiency\xe2\x80\x99s undertaking was published in September 2011. The second part of this effort\n focuses on the Inspector General\xe2\x80\x99s cybersecurity oversight role. Specifically, the Council of the\n Inspectors General on Integrity and Efficiency Cybersecurity Working Group, operating under\n the auspices of the Information Technology Committee, was tasked with developing a high-\n level audit guide that can be used as a baseline for cyber and information technology\n security-related reviews conducted by the Inspector General community. The Department of\n Homeland Security Office of Inspector General, a member of the Information Technology\n Committee, was asked to coordinate the Cybersecurity Working Group\xe2\x80\x99s efforts.\n\n As part of this effort, we collected cybersecurity and information technology system audit plans\n and programs from several agency Offices of the Inspector General. These plans and programs,\n in part, are consolidated in this guide. The guide will assist information technology auditors in\n evaluating the cybersecurity policies, practices, and system security controls implemented to\n protect Federal computer systems and networks from cyber threats and vulnerabilities. It also\n cites established policies and guidance that can be used to evaluate critical information\n technology security controls. Further, the guide provides a foundation for conducting\n cybersecurity and information systems security-related audits that support Federal Information\n Security Management Act requirements.\n\n\n\nwww.oig.dhs.gov 1 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n The guide is divided into seven sections. The first section outlines Federal agency cybersecurity\n roles and responsibilities. The second section covers cybersecurity policies and guidance for\n evaluating critical information technology security controls. The next section focuses on\n guidance regarding the use of vulnerability assessments and penetration testing Inspector\n General audit organizations can perform to evaluate the effectiveness of the system security\n and access controls implemented, and determine how well systems are protected when subject\n to attacks. The fourth and fifth sections cover information security continuous monitoring and\n cloud computing respectively. The sixth section consists of program steps for evaluating an\n agency\xe2\x80\x99s cybersecurity program and initiatives. The last section outlines program steps for\n conducting information system security-related audits and evaluations.\n\n\n\n\nwww.oig.dhs.gov 2 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Background\n Cyberspace is composed of numerous interconnected computers, servers, routers, switches,\n and fiber optic cables that allow our Nation\xe2\x80\x99s critical infrastructures to work. Our Nation\xe2\x80\x99s\n economy and security are highly dependent on the global cyber infrastructure. We depend on\n a complex array of interdependent and critical networks, systems, and resources. The network\n of networks that supports the operation of all sectors of our economy can be disrupted both\n from inside and outside of the physical borders of the U.S. International engagement is a key\n element of U.S. efforts to safeguard and secure cyberspace.\n\n The Internet is part of the cyber infrastructure and a strategic national asset. The Internet has\n been identified as a key resource, comprising domestic and international assets within both the\n information technology (IT) and communications sectors, and is used by all sectors to varying\n degrees. Protecting it is a national security priority. Attacks on our Nation\xe2\x80\x99s information\n networks can have serious consequences, such as disrupting critical operations, causing loss of\n revenue and intellectual property, or causing loss of life.\n\n Recent foreign-based intrusions on the computer systems of U.S. Federal agencies and\n commercial companies highlight the vulnerabilities of the interconnected networks that\n comprise the Internet, and the need to address the global security and governance of\n cyberspace. The global aspects of cyberspace present key challenges to U.S. policy. Until these\n challenges are addressed, the U.S. will be at a disadvantage in promoting its national interests\n in the realm of cyberspace. Figure 1 documents the global cybersecurity challenges.\n\n Figure 1: Challenges in Addressing Global Cybersecurity and Governance\n Challenge Description\n Leadership Providing top-level leadership that can coordinate across Federal entities and forge a\n coherent national approach.\n Strategy Developing a comprehensive national strategy that specifies overarching goals,\n subordinate objectives, and activities to support those objectives, and outcome-\n oriented performance metrics and timeframes.\n Coordination Engaging all key Federal entities in order to coordinate policy related to global aspects\n of cyberspace security and governance.\n Standards and Policies Ensuring that international technical standards and polices do not pose unnecessary\n barriers to U.S. trade.\n Incident Response Participating in international cyber incident response that includes appropriately\n sharing information without jeopardizing national security.\n Differing Laws Investigating and prosecuting transnational cybercrime amid a plurality of laws,\n varying technical capabilities, and differing priorities.\n Norms Providing models of behavior that shape the policies and activities of countries, such\n as defining countries\xe2\x80\x99 sovereign responsibility regarding the actions of its citizens.\n\n Source: U.S. Government Accountability Office (GAO) analysis of Federal and non-Federal information\n (GAO-10-606).\n\n\n\n\nwww.oig.dhs.gov 3 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Further, America\xe2\x80\x99s open and technologically complex society includes a wide array of critical\n infrastructure and key resources (CIKR) that are potential terrorist targets.1 The Nation\xe2\x80\x99s critical\n infrastructure includes the distributed networks, varied organizational structures and operating\n models (including multinational ownership), independent functions and systems in both the\n physical space and cyberspace, and governance constructs that involve multi-level authorities,\n responsibilities, and regulations. Repeated cyber intrusions into critical infrastructure\n demonstrate the need for improved cybersecurity. The majority of the Nation\xe2\x80\x99s CIKR are\n owned and operated by the private sector and State or local governments; CIKR are both\n physical and cyber-based and span all sectors of the economy. The national and economic\n security of the U. S. depends on the reliable functioning of the Nation\'s critical infrastructure.\n The cyber threat to critical infrastructure continues to grow and represents one of the most\n serious national security challenges we must confront.\n\n Countering cyber threats and attacks requires the development of new risk mitigation\n capabilities if we are to:\n\n \xe2\x80\xa2\t Reduce vulnerabilities.2\n \xe2\x80\xa2\t Deter those with the capabilities and intent to harm our Nation\xe2\x80\x99s critical infrastructures.\n \xe2\x80\xa2\t Ensure the confidentiality, integrity, and availability of our information and communications\n systems, and the sensitive data contained on these systems.\n\n\n\n\n 1\n Critical infrastructure is defined as those systems and assets\xe2\x80\x94both physical and cyber\xe2\x80\x94so vital to the U.S. that\n their incapacity or destruction would have a debilitating affect on national security, economic security, public\n health and safety, or any combination of those matters. Key resources are defined as publicly or privately\n controlled assets essential to the minimal operations of the economy and government.\n 2\n Vulnerabilities are defined as weaknesses in an information system, system security procedures, internal\n controls, or implementation, such as missing patches, service packs, open ports, and unnecessary services.\n\n\nwww.oig.dhs.gov 4\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Objective and Scope\n The purpose of this guide is to assist IT auditors in evaluating the cybersecurity policies,\n practices, and system security controls implemented to protect Federal computer systems and\n networks from cyber threats and vulnerabilities. The guide outlines the roles, responsibilities,\n and policies for cybersecurity oversight within the Federal Government. It also contains\n guidance on the use of vulnerability assessments and penetration testing OIG audit\n organizations can perform to evaluate the effectiveness of the system security and access\n controls implemented, and measure how well systems are protected when subject to attacks.\n Further, it provides a list of testing tools that can be used to evaluate critical IT security\n controls. Finally, the guide establishes program steps for evaluating cyber and IT security\n related audits. For example, the steps contained in this guide can be used to evaluate agencies\xe2\x80\x99\n implementation of the Administration\xe2\x80\x99s top three priorities to improve cybersecurity:\n\n 1.\t Trusted Internet Connections.3\n 2.\t Continuous monitoring of Federal information systems and networks.4\n 3.\t Strong authentication controls/use of Personal Identity Verification (PIV) cards for logical\n access.\n\n The steps in this guide are based on audits completed by members of the OIG community.\n They provide a baseline for conducting cyber and IT-related security evaluations, but they are\n not inclusive of all program steps that can be performed and controls that may be evaluated in\n conducting such audits. Additional steps and objectives can be added or modified as\n appropriate.\n\n The scope of this document does not cover evaluation steps to address statutory Federal\n Information Security Management Act of 2002 (FISMA) requirements.5 However, it contains\n audit steps for an assessment of agency-wide cybersecurity programs and information systems\n security that can be used to support FISMA requirements.\n\n\n\n 3\n The purpose of Trusted Internet Connections, as outlined Office of Management and Budget (OMB)\n Memorandum 08-05, is to optimize and standardize the security of individual external network connections\n currently in use by Federal agencies, including connections to the Internet. The initiative is to improve the Federal\n Government\'s security posture and incident response capability through the reduction and consolidation of\n external connections and provide enhanced monitoring and situational awareness of external network\n connections.\n 4\n An information system is a discrete set of information resources organized expressly for the collection,\n processing, maintenance, use, sharing, dissemination, or disposition of information. Information systems also\n include specialized systems such as industrial/process controls systems, telephone switching/private branch\n exchange systems, and environmental control systems.\n 5\n FISMA was enacted in 2002 as TitlefIIIfoffthefE-GovernmentfActfoff2002 to recognize the importance of\n information security to the economic and national security interests of the U.S.\n\n\nwww.oig.dhs.gov 5\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Federal Agency Responsibilities \n\n Responsibilities for cybersecurity are distributed across a wide array of Federal departments\n and agencies, many with overlapping authorities, and none with sufficient decision authority to\n direct actions that deal with often conflicting issues in a consistent way. Homeland Security\n Presidential Directive 7 (HSPD-7), Critical Infrastructure Identification, Prioritization, and\n Protection, issued in December 2003, directed DHS to serve as the Federal agencies\xe2\x80\x99 lead in\n assessing, mitigating, and responding to cyber risks in collaboration with Federal, State, and\n local governments, the private sector, academia, and international partners.6 The Department\n was also responsible for leading efforts to protect and defend Federal civilian networks against\n cyber threats; coordinating response to cyber attacks and security vulnerabilities; and\n addressing the challenges to secure cyberspace, cyber assets, and our Nation\xe2\x80\x99s IT\n infrastructure.7\n\n Presidential Decision Directive (PDD)-21, Critical Infrastructure Security and Resilience, issued in\n February 2013, advances a national unity of efforts to strengthen and maintain secure,8\n functioning, and resilient9 critical infrastructure.10 Through an updated and overarching\n framework that acknowledges the increased role of cybersecurity in securing physical assets,\n this directive focuses on actions to strengthen the security and resilience of critical\n infrastructure against evolving threats. Under this directive, which revokes HSPD-7, critical\n infrastructure security and resilience is to be a shared responsibility among Federal, State, local,\n tribal and territorial entities, and public and private owners and operators of critical\n infrastructure.\n\n PDD-21 establishes national policy on critical infrastructure security and resilience, refines and\n clarifies the critical infrastructure-related functions, roles, and responsibilities across the\n Federal Government, and enhances overall coordination and collaboration. Additionally, the\n directive encourages the Federal Government to engage with international partners to\n strengthen the security and resilience of domestic critical infrastructure and critical\n infrastructure located outside of the U.S. While greater information sharing within the\n\n\n\n\n 6\n http://www.dhs.gov/homeland-security-presidential-directive-7. \n\n 7\n The IT infrastructure consists of critical functions\xe2\x80\x94sets of processes that produce, provide, and maintain products \n\n and services. IT critical functions encompass the full set of processes (research and development, manufacturing, \n\n distribution, upgrades, and maintenance) involved in transforming supply inputs into IT products and services. \n\n 8\n As defined in PDD-21, secure refers to reducing the risk to critical infrastructure by physical means or defense\n\n cyber measures to intrusions, attacks, or the effects of natural or manmade disasters. \n\n 9\n Resilience refers to the ability to prepare for and adapt to changing conditions and withstand and recover rapidly \n\n from disruptions, including deliberate attacks, accidents, or naturally occurring threats or incidents. \n\n 10\n http://www.whitehouse.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-\n security-and-resil\n\n\n\nwww.oig.dhs.gov 6 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n government and with the private sector is one of the three strategic goals of this directive, all\n Federal departments and agencies are to ensure that all privacy and civil liberties are respected.\n\n DHS remains the focal point for coordinating best practices and supporting protective programs\n to secure cyberspace across and within government agencies under PDD-21. Further, DHS is\n responsible for providing the strategic guidance, promoting a national unity effort, and\n coordinating the overall Federal effort to promote the security and resilience of the Nation\xe2\x80\x99s\n critical infrastructure. As such, DHS is responsible for leading, integrating, and coordinating the\n overall national effort to enhance the protection of the critical infrastructure.\n\n PDD-21 further defines the role of DHS in conjunction with the Department of Commerce,\n Department of Defense (DoD), Department of Justice (including the Federal Bureau of\n Investigation), Department of State, Federal Communications Commission, General Services\n Administration, Office of Science and Technology Policy, and other appropriate agencies with\n additional responsibilities for critical infrastructures. It also identifies 16 critical infrastructure\n sectors and designates the responsibility for those sectors to associated Federal Sector Specific\n Agencies. Figure 2 outlines the Federal agencies responsible for the protection of the various\n sectors and critical infrastructures.\n\n Figure 2: Sector Specific Agencies and Critical Infrastructure Sectors\n Sector Specific Agency Critical Infrastructure Sectors\n Chemical; Commercial Facilities; Communications;\n DHS Critical Manufacturing; Dams; Emergency Services;\n IT; Nuclear Reactors, Materials, and Waste\n DHS & General Services Administration Government Facilities\n DHS & Department of Transportation Transportation Systems\n Department of Health and Human Services Healthcare and Public Health\n U.S. Department of Agriculture &\n Food and Agriculture\n Department of Health and Human Services\n Environmental Protection Agency Water and Wastewater Systems\n Department of Energy Energy\n Department of the Treasury Financial Services\n DoD Defense Industrial Base\n\n Source: PDD-21.\n\n All Federal departments and agencies are responsible for the identification, prioritization,\n assessment, remediation, and security of their respective critical infrastructure that supports\n primary mission essential functions. Consistent with FISMA, agencies are to identify and\n provide information security protections commensurate with the risk and magnitude of the\n harm resulting from the unauthorized access, use, disclosure, disruption, modification, or\n destruction of information.11\n\n 11\n Information security pertains to protecting the confidentiality and integrity of data and ensuring data availability.\n\n\nwww.oig.dhs.gov 7 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n FISMA emphasizes the need for each agency to develop, document, and implement an\n agency-wide information security program to provide a high level of security for the\n information and information systems that support agency operations and assets. It provides a\n comprehensive framework for ensuring the effectiveness of information security controls over\n information resources that support Federal operations and assets. FISMA also requires that\n personnel, including contractors and other users of information systems, be trained so that\n they are aware of the information security risks associated with their activities and their\n responsibilities in complying with agency policies and procedures designed to reduce these\n risks.\n\n In July 2010, the Office of Management and Budget (OMB) issued Memorandum 10-28,\n ClarifyingfCybersecurityfResponsibilitiesfandfActivitiesfoffthefExecutivefOfficefoffthefPresidentf\n andfthefDepartmentfoffHomelandfSecurityf(DHS). In the memorandum, while OMB\n acknowledges that it still has a number of cybersecurity responsibilities principally in\n connection with FISMA, OMB clarifies that DHS is to exercise primary responsibility within the\n executive branch for the operational aspects of Federal agency cybersecurity for the those\n information systems that fall within FISMA.\n\n\n\n\nwww.oig.dhs.gov 8 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Cybersecurity Policy\n As defined, cybersecurity comprises the collection of policies, security concepts and safeguards,\n guidelines, risk management approaches, actions, training, best practices, assurance, and\n technologies that can be used to protect the cyber environment, and organization and user\xe2\x80\x99s\n assets. Organization and user\xe2\x80\x99s assets include connected computing devices, personnel,\n infrastructure, applications, services, telecommunications systems, and the totality of\n transmitted and/or stored information in the cyber environment. The general security\n objectives comprise availability and integrity (that may include authentication, non-repudiation,\n and confidentiality). In addition, cybersecurity includes the full range of threat and vulnerability\n reduction, deterrence, international engagement, incident response, resiliency, and recovery\n policies.\n\n Different types of cyber threats may use various exploits to affect computers adversely,\n software, networks, agencies\xe2\x80\x99 operations, industries, or the Internet. Cited guidance outlining\n the responsibilities for securing cyberspace and CIKR follows.\n\n The National Strategy to Secure Cyberspace\n\n ThefNationalfStrategyftofSecurefCyberspace was issued in February 2003 to help reduce our\n Nation\xe2\x80\x99s vulnerability to debilitating attacks against our critical information infrastructures and\n the physical assets that support them.12 The Strategy provides an initial framework for both\n organizing and prioritizing Federal agencies\xe2\x80\x99 roles in securing cyberspace. It focuses on\n improving the national response to cyber incidents, reducing threats and vulnerabilities to\n potential exploits, preventing cyber attacks against critical U.S. infrastructure, and improving\n the international management of and response to such risks and harm.\n\n As outlined in ThefNationalfStrategyftofSecurefCyberspace, the need to secure cyberspace is a\n global matter due to the interconnectedness of the world\xe2\x80\x99s computer systems. The global\n interconnectivity provided by the Internet allows malicious users to easily cross national\n borders, affect large numbers of individuals, and maintain anonymity.\n\n National Infrastructure Protection Plan\n\n The National Infrastructure Protection Plan (NIPP), revised in 2009, provides the unifying\n structure to integrate existing and future CIKR.13 It addresses the protection of the cyber\n elements of CIKR in an integrated manner rather than as a separate consideration. Our\n Nation\xe2\x80\x99s economy and national security are highly dependent on the global cyber\n infrastructure, which has created an interconnected and interdependent global network. The\n\n 12\n http://www.us-cert.gov/reading_room/cyberspace_strategy.pdf.\n 13\n http://www.dhs.gov/xlibrary/assets/NIPP_Plan.pdf.\n\n\nwww.oig.dhs.gov 9 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n global network links the physical and cyber elements of CIKR. Cyber interdependence presents\n a unique challenge for all sectors. The security and effective operation of U.S. critical\n infrastructure rely on cyberspace, industrial control systems, and IT that may be vulnerable to\n disruption or exploitation.\n\n Comprehensive National Cybersecurity Initiative\n\n Launched by the White House in January 2008 in National Security Presidential\n Directive 54/HSPD-23, the Comprehensive National Cybersecurity Initiative (CNCI) consists of\n 12 mutually reinforcing initiatives designed to help secure the U.S. in cyberspace.14 Its goals\n include (1) managing the Federal Enterprise Network as a single network enterprise with\n Trusted Internet Connections; (2) deploying an intrusion detection and prevention system\n (IDPS) of sensors across the Federal enterprise to enhance shared situational awareness of\n network vulnerabilities, threats, and events in the Federal Government and to act quickly to\n reduce our current vulnerabilities and prevent intrusions; (3) enhancing U.S.\n counterintelligence capabilities and increasing the security of the supply chain for key IT;\n (4) strengthening the future cybersecurity environment by expanding cyber education,\n coordinating and redirecting research and development efforts across the Federal Government,\n and working to define and develop strategies to deter hostile or malicious activity in\n cyberspace; and (5) defining the Federal role for extending cybersecurity into critical\n infrastructure domains.\n\n Cyberspace Policy Review\n\n Recognizing the challenges and opportunities inherent in securing cyberspace, President\n Obama identified cybersecurity and the establishment of related performance metrics as key\n management priorities of his administration. Shortly after taking office, the President directed\n a 60-day comprehensive review to assess U.S. policies and structures for cybersecurity, known\n as the Cyberspace Policy Review (CPR).15 The CPR recommends that the U.S. work actively with\n all countries to develop a trusted, safe, and secure cyber infrastructure that enables prosperity\n for all nations. Upon completion of the review, the Commission on Cybersecurity for the 44th\n Presidency issued a report, titled AssuringfafTrustedfandfResilientfInformationfandf\n CommunicationsfInfrastructure, in May 2009.\n\n International Strategy for Cyberspace\n\n To address the recommendations made in the CPR, the White House released the Internationalf\n StrategyfforfCyberspace in May 2011.16 The Strategy outlines the Nation\xe2\x80\x99s approach to unify\n\n 14\n http://www.whitehouse.gov/cybersecurity/comprehensivenational-cybersecurity-initiative.\n 15\n http://www.whitehouse.gov/assets/documents/Cyberspace_Policy_Review_final.pdf.\n 16\n http://www.whitehouse.gov/sites/default/files/rss_viewer/international_strategy_for_cyberspace.pdf.\n\n\nwww.oig.dhs.gov 10 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n our engagement with international partners on a full range of cyber issues. It calls for the U.S.\n to work internationally to promote an open, interoperable, secure, and reliable information and\n communications infrastructure that supports international trade and commerce, strengthens\n security, and fosters free expression and innovation to reduce the threats we face.\n\n Because of cybersecurity\xe2\x80\x99s borderless nature, it is essential that foreign governments and\n international organizations play an active role in developing cyberspace security policies and\n procedures aimed at improving collaboration, information sharing, and incident response\n capabilities. As the Internet\xe2\x80\x99s core functionality relies on systems of trust, the international\n community needs to recognize the implications of its technical decisions and act with respect\n for one another\xe2\x80\x99s networks with the broader interest of preserving global network functionality\n and improving security.17\n\n Department of Defense Strategy for Operating in Cyberspace\n\n Along with the rest of the U.S. Government, DoD depends on cyberspace to function. DoD\n operates more than 15,000 networks and 7 million computing devices across hundreds of\n installations in dozens of countries around the globe. DoD uses cyberspace to enable its\n military, intelligence, and business operations. Furthermore, DoD operations\xe2\x80\x94both at home\n and abroad\xe2\x80\x94are dependent on the critical infrastructure.\n\n Issued in July 2011, the DepartmentfoffDefense StrategyfforfOperatingfinfCyberspace focuses on\n cyber threats that include external threat actors, insider threats, supply chain vulnerabilities,\n and threats to DoD\xe2\x80\x98s operational ability.18 DoD is particularly concerned with three areas of\n potential adversarial activity: theft or exploitation of data; disruption or denial of access or\n service that affects the availability of networks, information, or network-enabled resources;\n and destructive action, including corruption, manipulation, or direct activity that threatens to\n destroy or degrade networks or connected systems. The strategy contains five initiatives:\n (1) take advantage of cyberspace\xe2\x80\x99s potential; (2) employ new defense operating concepts to\n protect DoD networks and systems; (3) partner with other government departments and\n agencies and the private sector to enable a whole-of-government cybersecurity strategy;\n (4) build robust relationships with U.S. allies and international partners to strengthen collective\n cybersecurity; and (5) leverage the Nation\xe2\x80\x99s ingenuity through an exceptional cyber workforce\n and rapid technological innovation.\n\n\n\n\n 17\n Systems of trust are systems that can be relied upon, to a specified extent, to enforce a specified security policy.\n Trusted systems are used for the processing, storage, and retrieval of sensitive or classified information.\n 18\n http://www.defense.gov/news/d20110714cyber.pdf.\n\n\nwww.oig.dhs.gov 11 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Executive Order 13636\n\n To strengthen the resilience of the critical infrastructure, the President issued Executive Order\n 13636, ImprovingfCriticalfInfrastructurefCybersecurity, on February 12, 2013.19 This directive\n calls for the development of a \xe2\x80\x9cCybersecurity Framework\xe2\x80\x9d that provides a \xe2\x80\x9cprioritized, flexible,\n repeatable, performance-based, and cost-effective approach\xe2\x80\x9d to assist organizations\n responsible for critical infrastructure with services to manage cybersecurity risk. It also calls for\n partnerships with the owners and operators of critical infrastructure, to enhance the security\n and resilience of the Nation\'s critical infrastructure and to maintain a cyber environment that\n encourages efficiency, innovation, and economic prosperity while promoting safety, security,\n business confidentiality, privacy, and civil liberties.\n\n To assist the owners and operators of critical infrastructure in protecting their systems from\n unauthorized access, exploitation, or harm, DHS, in collaboration with DoD, are to establish\n procedures to expand the Enhanced Cybersecurity Services program, a voluntary information\n sharing program, to all critical infrastructure sectors. The program will provide classified cyber\n threat and technical information from the Government to eligible critical infrastructure\n companies or commercial service providers that offer security services to critical infrastructure.\n\n Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0\n\n In response to Executive Order 13636, on February 12, 2014, the National Institute of Standards\n and Technology (NIST)20 released the FrameworkfforfImprovingfCriticalfInfrastructuref\n Cybersecurity.21 The Framework, developed in collaboration with industry, provides guidance\n to an organization on reducing and better managing cybersecurity risks. It is focused on\n supporting the improvement of cybersecurity for the Nation\xe2\x80\x99s critical infrastructure using\n industry-known standards and best practices.\n\n The Framework focuses on using business drivers to guide cybersecurity activities and\n considering cybersecurity risks as part of the organization\xe2\x80\x99s risk management processes. It\n consists of three parts:\n\n 1.\t Framework Core - The Framework Core is a set of cybersecurity activities, outcomes, and\n informative references that are common across critical infrastructure sectors, providing the\n detailed guidance for developing individual organizational Profiles.\n\n\n 19\n http://www.whitehouse.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-\n cybersecurity. \n\n 20\n NIST is responsible for developing information security standards and guidelines, including minimum \n\n requirements for Federal information systems, but do not apply to national security systems without the express \n\n approval of appropriate federal officials exercising policy authority over those systems.\n\n 21\n http://www.nist.gov/cyberframework/upload/cybersecurity-framework-021214.pdf. \n\n\n\nwww.oig.dhs.gov 12\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 2.\t Framework Profile - Through use of the Profiles, the Framework will help the organization\n align its cybersecurity activities with its business requirements, risk tolerances, and\n resources.\n 3.\t Framework Implementation Tiers - The Tiers provide a mechanism for organizations to view\n and understand the characteristics of their approach to managing cybersecurity risk.\n\n The Framework enables organizations \xe2\x80\x93 regardless of size, degree of cybersecurity risk, or\n cybersecurity sophistication \xe2\x80\x93 to apply the principles and best practices of risk management to\n improving the security and resilience of critical infrastructure. It can also assist organizations in\n incorporating privacy and civil liberties as part of a comprehensive cybersecurity program. The\n Framework provides organization and structure to today\xe2\x80\x99s multiple approaches to cybersecurity\n by assembling standards, guidelines, and practices that are working effectively in industry\n today. Moreover, because it references globally recognized standards for cybersecurity, the\n Framework can also be used by organizations located outside the U.S. and can serve as a model\n for international cooperation on strengthening critical infrastructure cybersecurity.\n\n Appendix A of this guide contains additional references to relevant cybersecurity directives and\n guidance.\n\n\n\n\nwww.oig.dhs.gov 13\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n System Security and Vulnerability Guidance\n It is imperative to implement adequate logical security controls on Federal agencies\xe2\x80\x99\n information systems to ensure that the integrity and reliability of the information processed,\n stored, and transmitted is not compromised. Continually monitoring Federal agency networks\n for abnormalities is essential to minimize the risks of potential cyber attacks. Further, physical\n security controls are needed to protect the systems from unauthorized access, misuse, or\n destruction.\n\n Adequate security controls mitigate the risks and vulnerabilities incurred by the use of\n information and information systems in the performance of Federal agency missions and\n business functions. Risks and vulnerabilities need to be analyzed and their potential effect\n measured. Vulnerabilities should be remediated, mitigated through compensating controls, or\n documented, with the organization accepting the potential risk.\n\n Several different entities publish information security standards and baselines for various\n information systems, networks, platforms, software, and other products. Below are common\n sources used to audit Federal agency system and network security. The sources listed provide\n minimum security requirements, baselines, configuration settings, and checklists that can be\n used to evaluate the controls that should \xe2\x80\x9clock down\xe2\x80\x9d information systems, networks, and\n software that might otherwise be vulnerable to attack. Security controls are the management,\n operational, and technical safeguards or countermeasures employed within an organizational\n information system to protect the confidentiality, integrity, and availability of the system and\n its information.\n\n NIST Special Publication 800-53 - Security and Privacy Controls for Federal Information\n Systems and Organizations (Revision 4)\n\n NIST Special Publication (SP) 800-53, Revision 4, was developed in April 2013 to further NIST\xe2\x80\x99s\n statutory responsibilities under FISMA.22 It was written as part on an ongoing effort to produce\n a unified information security framework for the Federal Government. The purpose of this\n publication is to provide guidelines for selecting and specifying security controls for\n organizations and information systems supporting the executive agencies of the Federal\n Government and to meet all the requirements of Federal Information Processing Standards\n Publication 200, MinimumfSecurityfRequirementsffor FederalfInformationfSystems (see\n\n\n\n\n 22\n http://dx.doi.org/10.6028/NIST.SP.800-53r4.\n\n\nwww.oig.dhs.gov 14 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix A).23 The guidelines apply to all components of an information system that process,\n store, or transmit Federal information.24\n\n This special publication provides a catalog of security controls and privacy standards for Federal\n information systems and organizations.25 It also outlines a process for selecting controls to\n protect organizational operations, organizational assets, individuals, other organizations, and\n the Nation from a diverse set of threats that include hostile cyber attacks, natural disasters,\n structural failures, and human errors.26 Additionally, the publication contains guidance on\n multitiered risk management, security control baselines, and external service providers.\n\n The security and privacy controls contained in NIST SP 800-53 are customizable and\n implemented as part of an organization-wide process that manages information security and\n privacy risk. Both of the types of controls outlined in this publication are designed to facilitate\n compliance with applicable Federal laws, Executive Orders, directives, policies, regulations,\n standards, and guidance.\n\n The catalog of security controls addresses security from both a functionality perspective (the\n strength of security functions and mechanisms provided) and an assurance perspective (the\n measures of confidence in the implemented security capability). Security controls are\n organized into 17 families based on the domain areas of the security requirements. The control\n families are grouped into three broad classes \xe2\x80\x93 technical, operational, and management. See\n Figure 3 for the control families and classes.\n\n Figure 3: Security Control Families and Classes\n Technical Operational Management\n Access Control Awareness and Training Certification, Accreditation and\n Audit and Accountability Configuration and Management Security Assessment\n Identification and Authentication Contingency Planning Planning\n System and Communication Incident Response Risk Assessment\n Protection Maintenance System and Services Acquisition\n Media Protection\n Physical and Environmental\n Protection\n Personnel Security\n System and Information Integrity\n\n Source: NIST SP 800-146.\n\n 23\n The term organization describes an entity of any size, complexity, or positioning within an organizational \n\n structure (e.g., Federal agency or, as appropriate, any of its operational elements).\n\n 24\n Information system components include for example, mainframes, workstations, servers (e.g., database, \n\n electronic mail, authentication, web, proxy, file, domain name), input/output devices (e.g., scanners, copiers, \n\n printers), network components (e.g., firewalls, routers, gateways, voice and data switches, process controllers, \n\n operating systems, virtual machines, middleware), and applications. \n\n 25\n The privacy controls are based on international standards and best practices that help organizations enforce\n\n privacy requirements derived from Federal legislation, directives, policies, regulations and standards. \n\n 26\n Organizational operations include mission, functions, image, and reputation. \n\n\n\nwww.oig.dhs.gov 15 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n The catalog of privacy controls is intended to:\n\n \xe2\x80\xa2\t Establish a linkage and relationship between privacy and security controls for the purposes\n of enforcing respective privacy and security requirements which may overlap in concept\n and in implementation within Federal information systems, programs, and organizations.\n \xe2\x80\xa2\t Demonstrate the applicability of the NIST Risk Framework in the selection, implementation,\n assessment, and ongoing monitoring of privacy controls deployed in Federal information\n systems, programs and organizations.\n \xe2\x80\xa2\t Promote closer cooperation between privacy and security officials within the Federal\n Government to help achieve the objectives of senior leaders/executives in enforcing the\n requirements in Federal privacy legislation, policies, regulations, directives, standards, and\n guidance.\n\n NIST SP 800-61 - Computer Security Incident Handling Guide (Revision 2)\n\n Computer security incident response has become an important component of IT programs. An\n incident response capability is necessary for rapidly detecting incidents, minimizing loss and\n destruction, mitigating the weaknesses that were exploited, and restoring IT services. FISMA\n requires Federal agencies to establish incident response capabilities. In addition, each Federal\n civilian agency must contact the U.S. Computer Emergency Readiness Team (US-CERT) and\n report all incidents consistent with the agency\xe2\x80\x99s incident response policy.27\n\n Performing incident response effectively is a complex undertaking; establishing a successful\n incident response capability requires substantial planning and resources. NIST SP 800-61,\n Revision 2, issued in August 2012, assists organizations in establishing computer security\n incident response capabilities and handling incidents efficiently and effectively.28 This\n publication provides guidelines for incident handling, particularly for analyzing incident-related\n data and determining the appropriate response to each incident. The guidelines can be\n followed independently of particular hardware platforms, operating systems, protocols, or\n applications. According to NIST SP 800-61, effective incident response has four phases:\n preparation; detection and analysis; containment, eradication, and recovery; and post-incident\n activity (see figure 4).\n\n\n\n\n 27\n Under DHS, US-CERT is responsible for analyzing and reducing cyber threats and vulnerabilities, disseminating\n cyber threat warning information, and coordinating incident response activities.\n 28\n http://csrc.nist.gov/publications/nistpubs/800-61rev2/SP800-61rev2.pdf.\n\n\nwww.oig.dhs.gov 16\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Figure 4: Incident Response Life Cycle\n\n\n\n\n\n Source: NIST SP 800-61.\n\n NIST SP 800-94 - Guide to Intrusion Detection and Prevention Systems\n\n IDPSs have become a necessary addition to the security infrastructure of nearly every\n organization. NIST SP 800-94, issued in February 2007, defines intrusion detection as the\n process of monitoring the events occurring in a computer system or network and analyzing\n them for signs of possible incidents, which are violations or imminent threats of violation of\n computer security policies, acceptable use policies, or standard security practices.29 Intrusion\n prevention is the process of performing intrusion detection and attempting to stop detected\n possible incidents. An intrusion prevention system is software that has all the capabilities of an\n intrusion detection system (IDS) and can also attempt to stop possible incidents.\n\n IDPSs are primarily focused on identifying possible incidents, logging information about them,\n attempting to stop them, and reporting them to security administrators. In addition,\n organizations use these systems for other purposes, such as identifying areas of noncompliance\n with security policies, documenting existing threats, and deterring individuals from violating\n security policies. Intrusion detection and prevention technologies offer many of the same\n capabilities, and administrators can usually disable prevention features in intrusion prevention\n products, causing them to function as IDSs.\n\n The types of IDPS technologies are differentiated primarily by the types of events they monitor\n and the ways in which they are deployed. NIST SP 800-94 discusses four types of IDPS\n technologies:\n\n \xe2\x80\xa2\t Network-Based \xe2\x80\x93 Monitors network traffic for particular network segments or devices and\n analyzes the network and application protocol activity to identify suspicious activity.\n \xe2\x80\xa2\t Wireless \xe2\x80\x93 Monitors wireless network traffic and analyzes it to identify suspicious activity\n involving the wireless networking protocols themselves.\n \xe2\x80\xa2\t Network Behavior Analysis \xe2\x80\x93 Examines network traffic to identify threats that generate\n unusual traffic flows, such as distributed denial of service attacks, certain forms of malware,\n and policy violations (e.g., a client system providing network services to other systems).\n\n 29\n http://csrc.nist.gov/publications/nistpubs/800-94/SP800-94.pdf.\n\n\nwww.oig.dhs.gov 17\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n \xe2\x80\xa2\t Host-Based \xe2\x80\x93 Monitors the characteristics of a single host (e.g., computer, laptop) and the\n events occurring within that host for suspicious activity.\n\n Security Technical Implementation Guides\n\n The Defense Information Systems Agency (DISA), a component of DoD, has defined baselines\n called Security Technical Implementation Guides (STIGs) 30 to lockdown information systems\n and software that might otherwise be vulnerable to attack.31 STIGs are information security\n guides that contain a compendium of DoD policies, security regulations, and best practices for\n securing an information assurance or information assurance-enabled device (operating system,\n network, application software, etc.). The STIG website contains links to numerous security\n baselines for operating systems, applications, and telecommunication equipment. STIGs can\n assist agencies in producing security baselines for the products they use.\n\n US-CERT\n\n US-CERT was created as the focal point to protect the Nation\xe2\x80\x99s Internet infrastructure by\n coordinating defense against and response to cyber attacks. US-CERT is responsible for\n analyzing and reducing cyber threats and vulnerabilities, disseminating cyber threat warning\n information, and coordinating incident response activities. Its information sharing and incident\n response process includes distributing recipient-specific Department/Agency Cybersecurity\n Activity Reports to Federal agencies.32 Additionally, as part of these responsibilities, each week,\n US-CERT provides Cyber Security Bulletins33 that summarize new vulnerabilities that have been\n recorded by NIST in the National Vulnerability Database (NVD).34 The bulletins are compiled\n from external, open source reports, not directly from results of US-CERT analyses.\n\n The NVD is the U.S. Government repository of standards-based vulnerability management data\n represented using the Security Content Automation Protocol.35 This data enables the\n automation of vulnerability management, security measurement, and compliance. The NVD\n also includes databases of security checklists, security-related software flaws,\n misconfigurations, product names, and metrics. Further, the NVD contains historical\n vulnerability information; the vulnerabilities are based on the Common Vulnerability and\n\n 30\n http://iase.disa.mil/stigs/.\n\n 31\n System lockdown is a protection setting that can be used to control applications that that are authorized to run \n\n on a client computer. It ensures that an organization\xe2\x80\x99s system stays in a known and trusted state and can be used \n\n to block almost any Trojan horse, spyware, or malware that tries to run or load itself into an existing application.\n\n 32\n US-CERT publishes the weekly Department/Agency Cybersecurity Activity Reports to provide senior \n\n cybersecurity officials awareness of cybersecurity incidents occurring across the civilian Federal Government. \n\n These reports detail the trends observed in the .gov domain and open source reporting.\n\n 33\n http://www.us-cert.gov/alerts-and-tips/. \n\n 34\n http://nvd.nist.gov/. \n\n 35\n The Security Content Automation Protocol is a synthesis of interoperable specifications derived from community \n\n ideas. \n\n\n\nwww.oig.dhs.gov 18\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n Exposures naming standard and are organized according to severity, determined by the\n Common Vulnerability Scoring System (CVSS) standard.36 Vulnerabilities are listed as high,\n medium, or low based upon their severity and corresponding CVSS score. The NVD provides\n CVSS scores for almost all known vulnerabilities. Patch information is provided when\n available.37\n\n US-CERT collaborates with Federal agencies, the private sector, the research community, State,\n local, and tribal governments, and international entities. Through coordination with various\n national security incident response centers responding to incidents on both classified and\n unclassified systems and related analysis, US-CERT disseminates reasoned and actionable cyber\n security information to the public. Figure 5 illustrates US-CERT\xe2\x80\x99s operating environment, which\n aims to initiate two-way exchanges in order to collect incident information that may affect the\n Nation\xe2\x80\x99s cyber infrastructure.\n\n Figure 5: US-CERT\xe2\x80\x99s Operating Environment\n\n\n\n\n Source: US-CERT.\n\n Industrial Control Systems CERT\n\n Control systems are vital to the operation of the U.S. critical infrastructures, which are often\n highly interconnected and mutually dependent systems. The Industrial Control Systems Cyber\n Emergency Response Team (ICS-CERT) works to reduce risks within and across all critical\n infrastructure sectors by partnering with law enforcement agencies and the intelligence\n\n 36\n http://nvd.nist.gov/cvss.cfm. \n\n 37\n A patch is an additional piece of code developed to address problems (commonly called \xe2\x80\x9cbugs\xe2\x80\x9d) in software. \n\n\n\nwww.oig.dhs.gov 19 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n community and coordinating efforts among Federal, State, local, and tribal governments, as\n well as control systems owners, operators, and vendors. Additionally, ICS-CERT collaborates\n with international and private sector computer emergency response teams to share control\n systems-related security incidents and mitigation measures.\n\n ICS-CERT has four focus areas: situational awareness for CIKR stakeholders; control systems\n incident response and technical analysis; control systems vulnerability coordination; and\n strengthening cybersecurity partnerships with government departments and agencies.\n ICS-CERT is a key component of the StrategyfforfSecuringfControlfSystems. The primary goal of\n the Strategy is to build a long-term common vision where effective risk management of control\n systems security can be realized through successful coordination efforts. ICS-CERT leads this\n effort by:\n\n \xe2\x80\xa2\t Responding to and analyzing control systems-related incidents.\n \xe2\x80\xa2\t Conducting vulnerability, malware, and digital media analysis.\n \xe2\x80\xa2\t Providing on-site incident response services.\n \xe2\x80\xa2\t Providing situational awareness in the form of actionable intelligence.\n \xe2\x80\xa2\t Coordinating the responsible disclosure of vulnerabilities and associated mitigations.\n \xe2\x80\xa2\t Sharing and coordinating vulnerability information and threat analysis through information\n products and alerts.\n\n ICS-CERT provides on-site incident response, free of charge, to organizations that require\n immediate investigation and resolution in responding to a cyber attack. Further, ICS-CERT\n maintains and operates a malware lab, which provides testing capabilities to analyze\n vulnerabilities and malware threats to control system environments. ICS-CERT collaborates\n with US-CERT, bringing technical expertise and incident response capabilities related to\n industrial control systems security to the partnership. Their work is performed with US-CERT\n and supports their overall mission to coordinate defense against and response to cyber attacks\n across the Nation. ICS-CERT publishes security bulletins in conjunction with US-CERT\n (http://ics-cert.us-cert.gov/alerts).\n\n SysAdmin, Audit, Network, Security Institute\n\n The SysAdmin, Audit, Network, Security (SANS) Institute38 has identified 20 critical IT security\n controls that organizations should implement for effective cyber defense.39 These controls, the\n TwentyfCriticalfSecurityfControlsfforfEffectivefCyberfDefense:ffConsensusfAuditfGuidelines, were\n\n 38\n http://www.sans.org/.\n 39\n The SANS Institute is a well-known cooperative research company that develops and maintains the largest\n collection of research documents about various aspects of information security and operates the Internet Storm\n Center, the Internet\xe2\x80\x99s early warning system. Reference to the SANS Institute, a private organization, is made for\n informational purposes only and does not constitute an endorsement by CIGIE or any Federal agency. Moreover, it\n does not imply that its recommendations are necessarily the most appropriate or best available.\n\n\nwww.oig.dhs.gov 20\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n agreed upon by a powerful consortium that includes the National Security Agency (NSA),\n US-CERT, DoD, the Departments of Energy and State, and the top commercial forensics experts\n and penetration testers that serve the banking and critical infrastructure communities.\n\n The consortium produced a document that identifies the 20 specific technical security controls\n effective in blocking currently known high-priority attacks, as well as attack types expected in\n the near future. The top 20 controls are not intended to be comprehensive and do not replace\n the numerous controls outlined in NIST SP 800-53. Rather, they represent a starting baseline,\n part of the recognition that complete security is neither possible nor necessary. Each of the 20\n control areas includes multiple individual subcontrols that specify actions an organization can\n take to help improve its defenses. The control areas and individual subcontrols focus on\n various technical aspects of information security, with the primary goal of helping organizations\n prioritize their efforts to defend against today\xe2\x80\x99s most common and damaging computer and\n network attacks. The SANS Institute recommends that Federal agencies examine all 20 control\n areas against the current agency status and develop an agency-specific plan to implement the\n controls as a key component of an overall IT security program. Figure 6 lists the control areas.\n\n Figure 6: Twenty Critical Security Controls for Effective Cyber Defense\n Security Controls\n Inventory of Authorized and Unauthorized Devices Controlled Use of Administrative Privileges\n Inventory of Authorized and Unauthorized Software; Limitation and Control of Ports, Protocols, and\n Enforcement of \xe2\x80\x9cWhite\xe2\x80\x9d Lists of Authorized Software Services\n Secure Configurations for Hardware and Software on Maintenance, Monitoring, and Analysis of Complete\n Laptops, Workstations, and Servers Audit Logs\n Continuous Vulnerability Testing and Remediation Boundary Defense\n Anti-Malware Defenses Controlled Access Based on Need to Know\n Application Software Security Dormant Account Monitoring and Control\n Wireless Device Control Data Leakage Prevention\n Data Recovery Capability (validated manually) Red Team Exercises\n Security Skills Assessment and Appropriate Training to Fill\n Secure Network Engineering (validated manually)\n Gaps (validated manually)\n Secure Configurations for Network Devices such as\n Incident Response Capability (validated manually)\n Firewalls, Routers, and Switches\n\n Source: SANS Institute.\n\n\n\n\n\nwww.oig.dhs.gov 21 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Sources for Additional Guidance\n\n According to the Center for Internet Security (CIS), sources for additional best practice\n standards, frameworks, and guidelines for IT security include:40\n\n \xe2\x80\xa2\t Control Objectives for Information and related Technology (COBIT)\n COBIT includes generally accepted best practices, processes, measures, and indicators for IT\n governance and control (http://www.isaca.org).\n\n \xe2\x80\xa2\t International Standardization Organization/International Electrotechnical Commission\n 27001 IT Security techniques - Information security management systems\n Together, these techniques provide a comprehensive management system for information\n security focused on IT risk and controls (http://www.iso.org).\n\n \xe2\x80\xa2\t CIS Benchmarks\n CIS provides best practice standards and benchmarks to control IT risks, with a focus on\n technical security benchmarks, configurations, and metrics (http://cisecurity.org).\n\n \xe2\x80\xa2\t Open Web Application Security Project (OWASP)\n OWASP provides web and application security best practices and tools\n (http://www.owasp.org).\n\n \xe2\x80\xa2\t NSA Guides\n These technical security configuration guides developed and used by NSA cover a wide\n range of technologies (http://www.nsa.gov/ia/guidance/security_configuration_guides/).\n\n \xe2\x80\xa2\t Information Technology Infrastructure Library (ITIL)\n The ITIL is a comprehensive set of best practices for IT services management (problem,\n change, configuration, and incident management), development, and operations\n (http://www.itil-officialsite.com).\n\n Appendix A contains additional references to relevant system security and vulnerability\n guidance.\n\n\n\n\n 40\n CIS is a nonprofit organization focused on enhancing the cybersecurity readiness and response of public and\n private sector entities, with a commitment to excellence through collaboration. Through its four divisions\xe2\x80\x94\n Security Benchmarks, Multi-State Information Sharing & Analysis Center, Trusted Purchasing Alliance, and the\n Integrated Intelligence Center\xe2\x80\x94CIS serves as a central resource in the development and delivery of high-quality,\n timely products and services to assist government, academia, the private sector, and the general public in\n improving their cyber security posture.\n\n\nwww.oig.dhs.gov 22\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n System Vulnerability Management and Penetration Testing\n In today\xe2\x80\x99s Federal IT environment, it is essential that organizations maintain a strong and secure\n information security program. One of the biggest security challenges Federal agencies\n encounter today is protecting their information systems against malicious attacks from both\n internal and external threats. The exploitation of vulnerabilities via the Internet is a huge\n problem requiring immediate proactive control and management. Vulnerabilities that have\n plagued operating systems and software applications from the earliest days of computing are\n identified on a daily basis. Further, reliance on a global IT supply chain introduces multiple risks\n to Federal information systems. These risks may include threats posed by foreign intelligence\n services or counterfeiters, who may exploit vulnerabilities, thereby compromising the\n confidentiality, integrity, or availability of an end system and the data it contains. These risks\n can also have an adverse effect on an agency\xe2\x80\x99s ability to carry out its mission. Appendix B\n contains a list of the top system threats for 2013 and beyond.\n\n Vulnerability management is the practice of identifying, classifying, remediating, and mitigating\n vulnerabilities. This practice generally refers to software vulnerabilities in computing systems.\n As the Federal Government works to protect its information systems and networks, it is\n important that system vulnerabilities be identified and prioritized for remediation. Once\n vulnerabilities are identified, it is equally important to test systems to determine whether these\n vulnerabilities can be exploited to gain unauthorized access to the system or network.\n Vulnerabilities need to be analyzed and their potential impact measured. Vulnerabilities should\n be remediated, mitigated through compensating controls, or documented, with the potential\n risk to the organization accepted. OIG audit organizations can perform vulnerability\n assessments and penetration testing to evaluate the effectiveness of the system security and\n access controls implemented, and measure how well systems are protected when subject to\n attacks.\n\n Vulnerability Assessment\n\n When exposed, vulnerabilities can be targeted for exploitation by a threat source. A\n vulnerability assessment is a formal description and evaluation of the vulnerabilities in an\n information system. Assessments are typically performed according to the following steps:\n\n 1. Cataloging assets and capabilities (resources) in a system.\n 2. Assigning quantifiable value (or at least rank order) and importance to those resources.\n 3. Identifying the vulnerabilities or potential threats to each resource.\n 4. Mitigating or eliminating the most serious vulnerabilities for the most valuable resources.\n\n Scanning is the foundational process in conducting a vulnerability assessment. System scans\n test the effectiveness of the security policy and controls by examining the network\n\n\n\nwww.oig.dhs.gov 23 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n infrastructure for vulnerabilities by systematically testing and analyzing Internet Protocol (IP)\n devices, services, and applications for known security weaknesses. Scans can also test for\n compliance with system and network configuration requirements.\n\n Proper planning is critical to any successful security assessment. Prior to launching a scan, the\n audit team should have a Rules of Engagement (ROE) in place with agency management to\n define what will be tested, how the testing will be conducted, the names of the agency\n monitor(s) who will observe the testing, the system location(s) for testing, and a list of\n scanning/testing tools. Prior to beginning testing, the ROE should be agreed to and signed off\n on by agency and OIG management. The ROE should also document the individuals to contact\n in the event of disagreement(s) during testing and the process to be followed should a\n significant event occur during testing that would result in the OIG test team or the agency\n requesting that the testing be terminated. The agency\xe2\x80\x99s monitor(s) should have the knowledge\n and understanding of the significant events that would lead the agency to direct the OIG to\n terminate testing. A sample ROE is outlined in Appendix C.\n\n At a minimum, the OIG team will need the IP (or IP ranges) for the agency\xe2\x80\x99s domains and\n sub-networks and the special access permissions needed to perform the testing. If the audit\n includes scanning specific devices, these devices should be identified by IP before the scan is\n launched. A list of what to scan may include the following:\n\n \xe2\x80\xa2\t System/server/network operating systems.\n \xe2\x80\xa2\t Web servers.\n \xe2\x80\xa2\t Simple Mail Transfer Protocol (SMTP)/Post Office Protocol servers (i.e., electronic mail\n [E-mail] servers).\n \xe2\x80\xa2\t File Transfer Protocol servers.\n \xe2\x80\xa2\t Lightweight Directory Access Protocol (LDAP) servers.\n \xe2\x80\xa2\t Domain Name System (DNS) servers.\n \xe2\x80\xa2\t Load balancing servers.\n \xe2\x80\xa2\t Workstations and laptops.\n \xe2\x80\xa2\t Firewalls.\n \xe2\x80\xa2\t Databases.\n \xe2\x80\xa2\t Web applications.\n \xe2\x80\xa2\t Network infrastructure appliances.\n \xe2\x80\xa2\t Routers, switches, and hubs.\n \xe2\x80\xa2\t Wireless access points (for signal leakage).\n\n There are many options for scanning tools. Appendix D contains a list of automated scanning\n tools used by the IG community. The use of tools should be coordinated with the audit team\n and site personnel to determine the most appropriate tool for the platform being assessed.\n\n\n\n\nwww.oig.dhs.gov 24\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Vulnerability assessment and management involve more than running scanning software on an\n application, computer, or network to detect common weaknesses. A security vulnerability\n assessment may also include:\n\n \xe2\x80\xa2\t Determining whether agency requirements for system account access and security controls,\n including authentication procedures, have been implemented.\n \xe2\x80\xa2\t Identifying the faults in software that affect security.\n \xe2\x80\xa2\t Evaluating the effectiveness of the security controls implemented on operating systems,\n databases, and web applications.\n \xe2\x80\xa2\t Determining whether separation of duties exists to restrict access to systems containing\n sensitive data.\n \xe2\x80\xa2\t Ensuring that antivirus software and signatures are updated.\n \xe2\x80\xa2\t Evaluating the software configurations for all security devices to evaluate compliance with\n the standard or required configuration.\n \xe2\x80\xa2\t Ensuring that current security updates are applied on network-attached devices.\n \xe2\x80\xa2\t Determining whether audit trails are being captured and monitored according to agency\n policy.\n \xe2\x80\xa2\t Evaluating the agency\xe2\x80\x99s continuous monitoring strategy and process.\n \xe2\x80\xa2\t Identifying the adequacy of the physical controls over the facilities where IT systems are\n housed.\n \xe2\x80\xa2\t Documenting the state of security based on compliance with laws, regulations, and agency\n policy.\n\n Subsequent to vulnerability testing, the vulnerabilities identified need to be analyzed and their\n potential significance measured. Each site or program should be given a list of the\n vulnerabilities and weaknesses identified during scanning, and the audit team should discuss\n any false positives that were identified by management.41 The audit team and management\n should then discuss mitigation strategies for the remaining vulnerabilities. Vulnerabilities\n should be remediated, mitigated with compensating controls, or documented, with the\n potential risk to the organization accepted.\n\n Penetration Testing\n\n A more reliable way to identify the risk of vulnerabilities in aggregate is through penetration\n testing. Penetration testing is security testing in which assessors mimic real-world attacks to\n identify methods for circumventing the security features of an application, system, or network.\n It often involves launching real attacks on real systems and data, using tools and techniques\n\n\n 41\n A false positive is any normal or expected behavior that is identified as anomalous or malicious. For example, a\n false positive can occur when a security scanner, such as Nessus, detects a specific vulnerability in an\n organization\xe2\x80\x99s program, but it is not a vulnerability. Sometimes the scanner signatures (the \'check logic\') make\n mistakes and report a vulnerability that may not exist.\n\n\nwww.oig.dhs.gov 25\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n commonly used by attackers. Most penetration tests involve looking for combinations of\n vulnerabilities on one or more systems that can be used to gain more access than could be\n achieved through a single vulnerability. A penetration test captures in-depth vulnerability\n information at a single point in time.\n\n Penetration testing can also be useful for determining:\n\n \xe2\x80\xa2\t How well the system tolerates real-world-style attack patterns.\n \xe2\x80\xa2\t The likely level of sophistication an attacker needs to compromise the system.\n \xe2\x80\xa2\t Additional countermeasures that could mitigate or minimize threats against the system.\n \xe2\x80\xa2\t Defenders\xe2\x80\x99 ability to detect attacks and respond appropriately.\n\n Testing can be conducted in a number of ways and should first be discussed with management\n and defined in the ROE. For example, external security testing is conducted from outside the\n agency\xe2\x80\x99s security perimeter. This kind of testing offers the ability to view the environment\xe2\x80\x99s\n security posture as it appears outside the security perimeter\xe2\x80\x94usually as seen from the\n Internet\xe2\x80\x94with the goal of revealing vulnerabilities that an external attacker could exploit. With\n internal security testing, an audit team can work from the internal network and assume the\n identity of a trusted insider or an attacker who has penetrated the perimeter defenses. This\n kind of testing can reveal vulnerabilities that could be exploited, and demonstrates the\n potential damage this type of attacker could cause. Internal security testing also focuses on\n system-level security and configuration, including application and service configuration,\n authentication, access control, and system hardening.\n\n In addition to the way testing will be conducted, specific tests, constraints, tools, and systems\n to be tested should be discussed with agency management and documented in the ROE.\n Further, any potential legal concerns with an assessment should be taken into account and\n addressed before testing begins. While the involvement of legal advisors is at the discretion of\n the agency, it is recommended that they always be involved for intrusive tests such as\n penetration testing. Penetration testing involves a methodology that may attempt to\n (1) circumvent or defeat the security features of an application, system, or network, or\n (2) exploit identified or known system security vulnerabilities.\n\n The four-stage penetration methodology is outlined below:\n\n 1.\t Planning: This phase covers information gathering and scanning. The assessment plan, or\n ROE, is developed in this phase.\n 2.\t Discovery: This is the vulnerability analysis phase and involves comparing the services,\n applications, and operating systems of scanned hosts against vulnerability databases (a\n process that is automatic for vulnerability scanners) and the testers\xe2\x80\x99 own knowledge of\n vulnerabilities. Written logs are usually kept and periodic reports are made to system\n administrators and/or management during this phase.\n\n\nwww.oig.dhs.gov 26\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 3.\t Attack: This phase is at the heart of any penetration test. It involves verifying previously\n identified potential vulnerabilities by attempting to exploit them. If an attack is successful,\n the vulnerability is verified and safeguards are identified to mitigate the associated security\n exposure. As with discovery, written logs are usually kept during this phase to apprise\n system personnel and management of the testing status and results.\n 4.\t Reporting: At the conclusion of the test, a report is generally developed to describe\n identified vulnerabilities, present a risk rating, and provide and discuss guidance on how to\n mitigate the discovered weaknesses.\n\n Penetration testing can be invaluable, but it is labor-intensive and requires great expertise to\n minimize the risk to targeted systems. Systems may be damaged or otherwise rendered\n inoperable during penetration testing, even though the agency benefits in knowing how a\n system could be rendered inoperable by an intruder. Although experienced penetration testers\n can mitigate this risk, it can never be fully eliminated. Penetration testing should be performed\n only after careful consideration, notification, and planning.\n\n Penetration testing is usually conducted under specific constraints. It is important to be aware\n that depending on an agency\xe2\x80\x99s policies, the test team may be prohibited from using particular\n tools or techniques or may be limited to using them only during certain times of the day or days\n of the week. Results are valid only until the environment changes or new threats arise.\n Penetration testing often includes non-technical methods of attack and typically includes the\n following steps:\n\n \xe2\x80\xa2\t Network resource identification (ID): Sometimes called network mapping, network\n footprinting, or target ID. It involves scanning systems for open ports, identifying operating\n systems, and determining the types of applications that are operating on open ports.\n\n \xe2\x80\xa2\t Scanning for vulnerabilities: Looking for vulnerabilities on server, firewall, and Voice Over\n IP operating systems. Tests designed to break the existing authentication scheme or\n database and web application controls can also be conducted. Once the audit team has\n finished with these tests, the resources identified are prioritized. Determining the\n significance of vulnerabilities is a complex task that requires considerable analytical\n thought. For example, any number of systems may have fairly serious vulnerabilities, but\n the audit team needs to assign certain systems a lower priority than others that are\n considered more vital, especially if a vulnerable system is not likely to become a stage for an\n attack.\n\n \xe2\x80\xa2\t Perimeter testing: Firewall testing (see appendix R for evaluation steps).\n\n \xe2\x80\xa2\t Intrusion detection testing: In this step, the audit team might generate traffic to determine\n whether the IDS is capable of identifying anomalies.\n\n\n\nwww.oig.dhs.gov 27\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Audit trails are used to detect and deter penetration of a computer system and to reveal\n usage that identifies misuse. At the discretion of the system administrator, audit trails may\n be limited to specific events or may encompass all of the activities on a system.\n\n \xe2\x80\xa2\t Consideration of security policy and end user issues: Determining the effectiveness of the\n security policy, and how well the network\xe2\x80\x99s applications ensure compliance. The team may\n also determine how well end users comply with the security policy. Although this step is\n not as relevant to applications, it is important to understand that an auditor does more than\n scan systems and generate packets.\n\n Any vulnerabilities discovered during penetration testing should be remediated or mitigated\n with compensating controls if possible. A well-designed program of regularly scheduled\n network and vulnerability scanning, interspersed with periodic penetration testing, can help\n prevent many types of attacks and reduce the potential damaging effects of successful ones.\n\n\n\n\nwww.oig.dhs.gov 28\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Information Security Continuous Monitoring\n NIST SP 800-137, InformationfSecurityfContinuousfMonitoringf(ISCM)fforfFederalfInformationf\n SystemsfandfOrganizations, issued in September 2011, defines ISCM as maintaining ongoing\n awareness of information security, vulnerabilities, and threats to support organizational risk\n management decisions.42 NIST SP 800-137 specifically addresses the assessment and analysis\n of security control effectiveness and of organizational security status according to\n organizational risk tolerance. The purpose of this guideline is to assist organizations in the\n development of an ISCM strategy and the implementation of an ISCM program that provides an\n awareness of threats and vulnerabilities, visibility into organizational assets, and the\n effectiveness of deployed security controls.\n\n Any effort or process intended to support ongoing monitoring of information security across an\n organization begins with leadership defining a comprehensive ISCM strategy encompassing\n technology, processes, procedures, operating environments, and people. The objective of an\n ISCM strategy is to conduct ongoing monitoring of the security of an organization\xe2\x80\x99s networks,\n information, and systems and respond by accepting, avoiding/rejecting, transferring/sharing, or\n mitigating risk as situations change. This strategy should:\n\n \xe2\x80\xa2\t Provide a clear understanding of organizational risk tolerance and help officials set priorities\n and manage risk consistently throughout the organization.\n \xe2\x80\xa2\t Include metrics that provide meaningful indications of security status at all organizational\n tiers.\n \xe2\x80\xa2\t Ensure continued effectiveness of all security controls.\n \xe2\x80\xa2\t Verify compliance with information security requirements derived from organizational\n missions/business functions, Federal legislation, directives, regulations, policies, and\n standards/guidelines.\n \xe2\x80\xa2\t Include all organizational IT assets and help to maintain visibility into the security of the\n assets.\n \xe2\x80\xa2\t Ensure knowledge and control of changes to organizational systems and environments of\n operation.\n \xe2\x80\xa2\t Maintain an awareness of threats and vulnerabilities.\n\n An ISCM program is established to collect information according to pre-established metrics,\n utilizing information readily available in part through implemented security controls. According\n to NIST, organizations should take the following steps to establish, implement, and maintain\n ISCM:\n\n \xe2\x80\xa2\t Define an ISCM strategy based on risk tolerance that maintains clear visibility into assets,\n awareness of vulnerabilities, up-to-date threat information, and mission/business aspects.\n\n 42\n http://csrc.nist.gov/publications/nistpubs/800-137/SP800-137-Final.pdf.\n\n\nwww.oig.dhs.gov 29\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n \xe2\x80\xa2\t Establish an ISCM program determining metrics, status monitoring frequencies, control\n assessment frequencies, and an ISCM technical architecture.\n \xe2\x80\xa2\t Implement an ISCM program and collect the security-related information required for\n metrics, assessments, and reporting. Automate collection, analysis, and reporting of data\n where possible.\n \xe2\x80\xa2\t Analyze the data collected and report findings, determining the appropriate response. It\n may be necessary to collect additional information to clarify or supplement existing\n monitoring data.\n \xe2\x80\xa2\t Respond to findings with technical, management, and operational mitigating activities or\n acceptance, transference/sharing, or avoidance/rejection.\n \xe2\x80\xa2\t Review and update the monitoring program, adjusting the ISCM strategy, and maturing\n measurement capabilities to increase visibility into assets and awareness of vulnerabilities,\n further enable data-driven control of the security of an organization\xe2\x80\x99s information\n infrastructure, and increase organizational resilience.\n\n Overall, an effective continuous monitoring program is one that can adapt to the ever changing\n technology and cybersecurity threat landscape and encompasses vulnerability, application, and\n threat monitoring.\n\n The importance of continuous monitoring is highlighted by NIST as one of the steps in its Risk\n Management Framework (RMF). The RMF developed by NIST describes a disciplined and\n structured process that integrates information security and risk management activities into the\n system development lifecycle. Ongoing monitoring is a critical part of the risk management\n process and assessing an organization\xe2\x80\x99s information security posture. In the RMF, NIST defines\n the six components that work together to provide comprehensive guidance on how to\n implement continuous monitoring into the security lifecycle. Figure 7 outlines the components\n of the RMF, including continuous monitoring, in assessing an organization\xe2\x80\x99s overall state of\n security.\n\n Continuous monitoring and real-time analysis of threats, while not new, are evolving concepts\n and are being implemented and deployed at various levels. While each organization\xe2\x80\x99s\n requirements are different, continuous monitoring should include the following types of both\n legacy and leading-edge monitoring and correlation capabilities:\n\n \xe2\x80\xa2\t Vulnerability, configuration, and asset management.\n \xe2\x80\xa2\t System and network log collection, correlation, and reporting.\n \xe2\x80\xa2\t Advanced network monitoring using real-time network forensics.\n \xe2\x80\xa2\t Threat intelligence and business analytics that fuse data from all monitoring feeds for\n correlation and analysis.\n\n\n\n\nwww.oig.dhs.gov 30\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Figure 7: Assessing an Organization\xe2\x80\x99s Information Security Posture\n\n\n\n\n\n Source: A Real-Time Approach to Continuous Monitoring (A SANS Whitepaper - February 2011).\n\n The ISCM strategy and program support ongoing assurance that planned and implemented\n security controls are aligned with organizational risk tolerance and the ability to provide the\n information needed to respond to risk in a timely manner. The result should be a picture of an\n IT system\xe2\x80\x99s status that can be used to maintain and improve an organization\xe2\x80\x99s information\n security posture and ensure compliance with NIST, FISMA, and other relevant guidance and\n requirements.\n\n Real-time monitoring of implemented technical controls using automated tools and techniques\n can provide an organization with a much more dynamic view of the effectiveness of those\n controls and the security posture of the organization. According to NIST, a robust ISCM\n program enables organizations to move from compliance-driven risk management to\n data-driven risk management, providing organizations with the information necessary to\n support risk response decisions, status information, and ongoing insight into security control\n effectiveness.\n\n FISMA emphasizes the importance of continuously monitoring information system security by\n requiring agencies to conduct assessments of security controls at a frequency appropriate to\n risk, but no less than annually. The OIG community is also responsible for reviewing an\n agency\xe2\x80\x99s continuous monitoring process at least annually during their agency FISMA\n evaluations. Further, OMB\xe2\x80\x99s annual FISMA reporting instructions emphasize monitoring the\n\n\nwww.oig.dhs.gov 31 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n security state of information systems on an ongoing basis with a frequency sufficient to make\n ongoing, risk-based decisions.\n\n\n\n\nwww.oig.dhs.gov 32 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Cloud Computing\n The present availability of high-capacity networks, low-cost computers and storage devices, in\n addition to the widespread adoption of hardware virtualization, service-oriented architectures,\n and utility computing have led to the growth in cloud computing.43 Cloud computing allows\n computer users to conveniently rent access to fully featured applications, software\n development and deployment environments, and computing assets such as network-accessible\n data storage and processing. It is based on virtualization technology and focuses on the sharing\n of resources. The goal of cloud computing is to allow users to benefit from all technologies,\n without the need for in-depth knowledge or expertise with each one of them, thereby cutting\n costs, maximizing the effectiveness of shared resources, and helping users focus on their core\n business instead of being impeded by IT obstacles.\n\n In February 2011, the White House issued the FederalfCloudfComputingfStrategy.44 According\n to the strategy, cloud computing has the potential to significantly help agencies address its\n inefficiencies (e.g., low asset utilization, a fragmented demand for resources, and duplicative\n systems) and the need to provide highly reliable, innovative services quickly despite resource\n constraints. For the Federal Government, cloud computing holds tremendous potential to\n deliver public value by increasing operational efficiency and responding faster to user needs.\n\n To harness the benefits of cloud computing, the White House instituted a Cloud First policy.\n This policy was intended to accelerate the pace at which the government would realize the\n value of cloud computing by requiring agencies to evaluate safe, secure cloud computing\n options before making any new investments.\n\n Following the publication of the FederalfCloudfComputingfStrategy, each agency was to\n re-evaluate its technology sourcing strategy to include consideration and application of cloud\n computing solutions as part of the budget process. Consistent with the Cloud First policy,\n agencies were to modify their IT portfolios to fully take advantage of the benefits of cloud\n computing in order to maximize capacity utilization, improve IT flexibility and responsiveness,\n and minimize cost. Agencies were to simplify their IT environments through the use of tools\n such as cloud computing and enterprise architectures to make them more manageable and\n then invest in the needed security to make them resilient.\n\n The FederalfCloudfComputingfStrategy is designed to:\n\n \xe2\x80\xa2\t Articulate the benefits, considerations, and trade-offs of cloud computing.\n \xe2\x80\xa2\t Provide a decision framework and case examples to support agencies in migrating towards\n cloud computing.\n\n 43\n Virtualization is the simulation of the software and/or hardware upon which other software runs.\n 44\n http://www.whitehouse.gov/sites/default/files/omb/assets/egov_docs/federal-cloud-computing-strategy.pdf\n\n\nwww.oig.dhs.gov 33\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n \xe2\x80\xa2\t Highlight cloud computing implementation resources.\n \xe2\x80\xa2\t Identify Federal Government activities and roles and responsibilities for catalyzing cloud\n adoption.\n\n NIST issued SP 800-145, ThefNISTfDefinitionfoffCloudfComputing, in September 2011 to\n characterize the important aspects of cloud computing, serve as a means for broad\n comparisons of cloud services and deployment strategies, and provide a baseline for discussion\n of what cloud computing is and how best to use cloud computing.45 In this publication, NIST\n defines cloud computing as a model for enabling convenient, on-demand network access to a\n shared pool of configurable computing resources (e.g., networks, servers, storage, applications,\n and services) that can be rapidly provisioned and released with minimal management effort or\n service provider interaction.\n\n The cloud model is composed of five essential characteristics: (1) on-demand self-service, (2)\n broad network access, (3) resource pooling, (4) rapid scalability and elasticity, and (5) measured\n service. The cloud may be owned, managed, and operated by an organization, a third party, or\n a combination of the two, and may exist on or off an organization\xe2\x80\x99s premises. Cloud computing\n providers offer their services according to three service models: infrastructure as a service,\n platform as a service, and software as a service. Further, cloud computing can be implemented\n using a variety of deployment models \xe2\x80\x93 private, community, public, or a hybrid combination.\n Figure 8 depicts the types of cloud computing.\n\n Figure 8: Cloud Computing Types\n\n\n\n\n Source: Wikipedia.\n\n Cloud computing offers the government an opportunity to be more efficient, agile, and\n innovative through more effective use of IT investments, and by applying innovations\n developed in the private sector. If an agency wants to launch a new innovative program, it can\n 45\n http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf\n\n\nwww.oig.dhs.gov 34\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n quickly do so by leveraging the cloud infrastructure without having to acquire significant\n hardware, lowering both time and cost barriers to deployment.46\n\n By leveraging shared infrastructure and economies of scale, cloud computing presents a\n compelling business model for Federal leadership. Organizations will be able to measure and\n pay for only the IT resources they consume, increase or decrease their usage to match\n requirements and budget constraints, and leverage the shared underlying capacity of IT\n resources via a network. Resources needed to support mission critical capabilities can be\n provisioned more rapidly and with minimal overhead and routine provider interaction.\n\n As cloud computing uses increase, it is likely that criminals will find new ways to exploit system\n vulnerabilities. While the cloud offers many strong points (e.g., infrastructure flexibility, faster\n deployment of applications and data, and cost control), several deterrents to widespread\n adoption of cloud computing remain. Among them, are reliability, availability of services and\n data, security, complexity, costs, regulations and legal issues, performance, migration, the lack\n of standards, limited customization, and data privacy issues.\n\n When an organization subscribes to a cloud, all the data processed will physically reside in\n premises owned and operated by a service provider. Security concerns must be addressed to\n maintain trust in cloud computing technology. To mitigate the threat, cloud computing\n stakeholders will need to invest heavily in risk assessment to ensure that providers encrypt\n data, have established a foundation to secure the platform and infrastructure, and build higher\n assurance into auditing to strengthen compliance. NIST SP 800-144, GuidelinesfonfSecurityfandf\n PrivacyfinfPublicfCloudfComputing, issued in December 2011, outlines security and privacy\n issues in depth for public clouds (see Appendix A).\n\n To comply with regulations, including FISMA, OMB, in December 2011, directed Federal\n agencies to use a process called the Federal Risk and Authorization Management Program\n (FedRAMP) to assess and authorize cloud products and services.47 FedRAMP consists of a\n subset of NIST SP 800-53 security controls specifically selected to provide protection in cloud\n environments.\n\n The privacy and security of cloud computing depend primarily on whether the cloud service\n provider has implemented robust security controls and a sound privacy policy. In May 2012,\n NIST issued SP 800-146, CloudfComputingfSynopsisfandfRecommendations,fwhich explains cloud\n computing technology in plain terms and provides recommendations for IT decision makers.48\n According to NIST, cloud computing is a developing area and its ultimate strengths and\n\n\n 46\n A cloud infrastructure is the collection of hardware and software that enables the five essential characteristics of\n cloud computing.\n 47\n https://cio.gov/wp-content/uploads/2012/09/fedrampmemo.pdf\n 48\n http://csrc.nist.gov/publications/nistpubs/800-146/sp800-146.pdf\n\n\nwww.oig.dhs.gov 35 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n weaknesses are not yet fully researched, documented, and tested. This publication provides\n recommendations on how and when cloud computing is an appropriate tool, and indicates the\n limits of current knowledge and areas for future analysis. Generally, NIST recommends that the\n following be considered in the context of cloud computing:\n\n \xe2\x80\xa2\t Management: Mitigating data to and from clouds, continuity of operations, compliance,\n administrator staff, legal issues, operating policies, acceptable use policies, licensing, patch\n management\n \xe2\x80\xa2\t Data Governance: Data access standards, data separation, data integrity, data regulations,\n data disposition, data recovery\n \xe2\x80\xa2\t Security and Reliability: Consumer-side vulnerabilities, encryption, physical security,\n authentication, identity and access management, performance requirements, visibility\n \xe2\x80\xa2\t Virtual Machines: Vulnerabilities, migration49\n \xe2\x80\xa2\t Software and Applications: Time critical software, safety-critical software, application\n development tools, application runtime support, application configuration, standard\n programming languages\n\n In July 2012, GAO reported that until agencies\xe2\x80\x99 cloud implementations are sufficiently planned\n and relevant systems are retired, the benefits of Federal efforts to implement cloud\n solutions\xe2\x80\x94improved operational efficiencies and reduced costs\xe2\x80\x94may be delayed or not fully\n realized.50 Additionally, GAO identified seven common challenges associated with the\n implementation of the \xe2\x80\x9cCloud First\xe2\x80\x9d policy:\n\n 1.\t Meeting Federal security requirements.\n 2.\t Obtaining guidance.\n 3.\t Acquiring knowledge and expertise.\n 4.\t Certifying and accrediting vendors.\n 5.\t Ensuring data portability and interoperability.\n 6.\t Overcoming cultural barriers.\n 7.\t Procuring services on a consumption (on-demand) basis.\n\n\n\n\n 49\n A virtual machine is an efficient, isolated duplicate of a real machine. \n\n 50\n INFORMATION TECHNOLOGY REFORM: ProgressfMadefbutfFuturefCloudfComputingfEffortsfShouldfbefBetterf\n\n Planned (GAO-12-756).\n\n\n\nwww.oig.dhs.gov 36\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Steps for Evaluating a Cybersecurity Program\n Over the past few years, threats in cyberspace have risen dramatically. Securing cyberspace\n involves reducing our vulnerabilities to these threats before they can be exploited to damage\n the cyber systems supporting our Nation\xe2\x80\x99s critical infrastructures. Ensuring that such\n disruptions of cyberspace are infrequent, of minimal duration, manageable, and cause the least\n damage is an extraordinarily difficult challenge. The speed and anonymity of cyber attacks\n makes it difficult to distinguish among the actions of terrorists, criminals, and nation states; this\n task often occurs only after the fact, if at all.\n\n Cybersecurity strives to ensure that an organization\xe2\x80\x99s systems and networks are protected\n against relevant security risks in the cyber environment. An organization\xe2\x80\x99s systems and\n networks include connected computing devices, infrastructure, applications, services,\n telecommunications capabilities, and information transmitted and stored. Addressing network\n security issues requires public-private partnerships as well as international cooperation and\n governing standards. A cybersecurity program encompasses the security controls used to\n protect the availability, integrity, and confidentiality of an organization\xe2\x80\x99s systems and networks,\n and the information stored on these computers. Federal agencies need to develop a plan to\n address the cybersecurity-related issues confronting the U.S.\n\n The following areas should be considered when evaluating the effectiveness of an agency\xe2\x80\x99s\n cybersecurity program:\n\n \xe2\x80\xa2 Strategic cybersecurity and IT planning.\n \xe2\x80\xa2 Performance metrics.\n \xe2\x80\xa2 Information sharing and collaboration.\n \xe2\x80\xa2 Partnerships with counterparts in public, private, and international domains.\n\n See appendix E for a list of audit objectives and steps that can be conducted in evaluating an\n agency\xe2\x80\x99s cybersecurity program.\n\n Strategic Planning\n\n PDD-21 instructs all Federal departments and agencies to identify, prioritize, and coordinate the\n protection of their own critical infrastructures in order to prevent, deter, or mitigate the effects\n of attacks. In addition, this national policy recognizes that certain other Federal entities have\n special functions related to critical infrastructure protection: DHS\xe2\x80\x99 responsibility for developing\n a comprehensive plan outlining the risk management framework, goals, and initiatives for\n strengthening the security and resiliency of critical infrastructure; Department of Justice\xe2\x80\x99s\n responsibilities for law enforcement activities across the critical infrastructure sectors;\n Department of State\xe2\x80\x99s responsibilities to engage with foreign governments and international\n\n\n\nwww.oig.dhs.gov 37 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n organizations, and the Executive Office of the President\xe2\x80\x99s Office of Science and Technology\xe2\x80\x99s\n responsibilities to prioritize and guide research and development requirements and\n investments.\n\n Further, ThefNationalfStrategyftofSecurefCyberspace provides a framework for both organizing\n and prioritizing efforts to protect our nation\xe2\x80\x99s cyberspace. It also provides direction to Federal\n departments and agencies that have roles in cyberspace security and identifies steps that State\n and local governments, private companies, organizations, and individuals can take to improve\n our collective cybersecurity.\n\n In addition, the GovernmentfPerformancefandfResultsfActfModernizationfActfoff2010 requires\n the development of a strategic implementation plan that identifies an agency\xe2\x80\x99s major functions\n and operations. The plan should include general goals and objectives, describe how those goals\n and objectives can be achieved, and cover at least 4 years following the fiscal year in which the\n plan is developed.\n\n Without a strategic implementation plan for cybersecurity, given the complexity of protecting\n cyberspace, it is difficult for an agency to achieve its IT goals and objectives. It is crucial that a\n comprehensive implementation plan be developed to provide the necessary guidance to work\n with appropriate stakeholders to meet the requirements specified in ThefNationalfStrategyftof\n SecurefCyberspace.\n\n Performance Metrics\n\n Closely tied to strategic planning are performance metrics. The use of performance metrics is a\n critical step in the risk management process to enable DHS and Sector-Specific Agencies to\n assess improvements in CIKR protection and resiliency at the national and sector levels\n objectively and qualitatively. Performance metrics allow an organization to track progress\n against priorities, establish accountability, document actual performance, promote effective\n management, and provide for a method to advise decision makers. Performance metrics\n indicate what a program is accomplishing and whether results are being achieved. In addition,\n measures help management determine how to allocate resources and evaluate the\n effectiveness of current efforts.\n\n The GovernmentfPerformancefandfResultsfActfModernizationfActfoff2010 requires Federal\n agencies to establish performance goals as well as metrics that assess relevant outputs, service\n levels, and outcomes of each program activity. OMB requires each agency to prepare an annual\n performance plan covering each program activity included in its budget. A performance plan\n should include the following:\n\n \xe2\x80\xa2 Goals that define the level of performance to be achieved by a program activity.\n \xe2\x80\xa2 Goals that are objective, quantifiable, and measurable.\n\n\nwww.oig.dhs.gov 38 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n \xe2\x80\xa2\t Performance indicators to measure or assess the relevant output, service levels, and\n outcomes of each program activity.\n \xe2\x80\xa2\t A basis for comparing actual program results with established performance goals.\n\n Measuring performance allows organizations to track their progress toward their goals and\n gives managers crucial information on which to base their organizational and management\n decisions. For example, performance metrics are valuable to management when forecasting\n future budgetary needs. Leading organizations also recognize that performance measures can\n create powerful incentives to influence organizational and individual behavior. Additionally,\n when appropriate, making performance measurements available to the public demonstrates\n transparency, allowing the public to see evidence of program effectiveness.\n\n Information Sharing and Collaboration\n\n PDD-21 requires DHS and other Federal agencies, as well as State and local governments, to\n collaborate with the private sector to facilitate information sharing concerning physical and\n cyber threats, vulnerabilities, incidents, potential protective measures, and best practices in a\n timely manner. Additionally, the CNCI encourages increased information sharing between the\n Federal Government and the public and private sector owners and operators of the CIKR.\n\n The NIPP of 2009 encourages effective communication, which includes multidirectional\n information sharing between government and industry, to streamline and reduce redundant\n reporting. The plan establishes a goal that requires CIKR partners to strive toward access to\n robust information sharing networks that include relevant intelligence and threat analysis, and\n incident reporting.\n\n Interaction among all levels of government, the private sector, and our international partners\n can enhance the measures taken and decisions made to improve and protect cyberspace. It is\n difficult to exchange cyber data among government organizations, and with industry, academia,\n international partners, and government counterparts, without an information sharing policy.\n Additionally, without continued engagement and commitment to address cyberspace and IT\n system security issues, there is increased risk that cyber threat information sharing will be\n severely limited. Further, inadequate communication and information sharing can restrict the\n ability to develop the trust-based relationships required to share and receive actionable cyber\n threat information.\n\n Public/Private/International Partnerships\n\n The protection of our critical infrastructures is necessarily a shared responsibility and requires\n partnerships between owners, operators, and the government. Approximately 90 percent of\n critical infrastructure is privately owned and operated. Public-private partnerships are essential\n for developing trusted, two-way information sharing that is crucial to improve and protect\n\n\nwww.oig.dhs.gov 39\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n cyberspace.51 Furthermore, the Federal Government needs to encourage international\n cooperation to help manage this increasingly global problem.\n\n The CNCI encourages the enhancement of partnerships between the Federal Government and\n the public and private sector owners and operators of the CIKR, while the President\xe2\x80\x99s CPRf\n recommends that the U.S. work with all countries to develop a trusted, safe, and secure cyber\n infrastructure that enables prosperity for all nations. The InternationalfStrategyfforfCyberspace\n recommends that the U.S. provide knowledge, training, and other resources to countries\n seeking to build technical and cybersecurity capacity. The strategy also recommends that the\n U.S. continue to develop and share international cybersecurity best practices with its\n international partners.\n\n The borderless nature of threats to, and emanating from, cyberspace requires active\n engagement and strong partnerships with countries around the world. Trust-based working\n relationships with our international partners are essential in securing the global cyber\n infrastructure. A number of U.S. Federal entities have responsibilities for, and are involved in,\n international cyberspace governance and security efforts. Specifically, the Departments of\n Commerce, Defense, Homeland Security, Justice, and State, among others, are involved in\n efforts to develop international standards, formulate cyber-defense policy, facilitate overseas\n investigations and law enforcement, and represent U.S. interests in international forums.\n\n Since the targets of attacks on our critical infrastructure would likely include both government\n and privately owned facilities, the elimination of our potential vulnerability requires a closely\n coordinated effort of both the public and the private sectors. Establishing regular\n communication and personal dialogue with international counterparts will allow U.S.\n Government agencies to build capacity with other countries and take steps to secure\n cyberspace collectively. Collaboration among public, private, and international partners\n enhances information sharing, increases situational awareness, improves incident response\n capabilities, and supports law enforcement activities.\n\n\n\n\n 51\n Public-private partnerships have been defined as collaboration between a public sector (government) entity and\n a private sector (for-profit) entity to achieve a specific goal or set of objectives. This collaboration results in\n government-business relationships that include service contracts, supply chains, ad hoc partnerships, and\n information dissemination partnerships.\n\n\nwww.oig.dhs.gov 40 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Steps for Conducting Cybersecurity-Related Audits\n To ensure the continuity and viability of critical infrastructures, all necessary measures should\n be taken to eliminate any significant vulnerability to both physical and cyber attacks on our\n critical infrastructure and IT systems. Frequent assessments will be made of our critical\n infrastructures\xe2\x80\x99 existing reliability, vulnerability, and threat environment because, as\n technology and the nature of the threats to our critical infrastructures continue to change\n rapidly, so must the protective measures and responses.\n\n Proper management of IT systems is essential to ensure the confidentiality, integrity, and\n availability of critical infrastructure information. Configuration and account access\n vulnerabilities identified on IT systems must be mitigated to manage and secure the systems\n and data from the risks associated with internal and external threats, unauthorized access, and\n misuse. Authorized system administrators, users, and contractor personnel need to be\n appropriately trained to ensure that data and systems containing the data are adequately\n safeguarded. Security documentation needs to be updated to ensure that system information\n is accurate, the appropriate security controls have been evaluated, and the data stored on the\n system is protected.\n\n The following are audit-specific areas that should be considered when evaluating the security of\n an agency\xe2\x80\x99s critical infrastructure and cyber systems. The steps presented for each\n audit-specific area provide a baseline for conducting IT security audits and evaluations; they do\n not include all program steps that can be performed. The types of audits listed are based on\n audits that have been completed by members within the OIG community:\n\n \xe2\x80\xa2 Identity Management.\n \xe2\x80\xa2 Network Management and Security.\n \xe2\x80\xa2 Laptop Security.\n \xe2\x80\xa2 Wireless Security.\n \xe2\x80\xa2 Database Security.\n \xe2\x80\xa2 UNIX Operating System Security.\n \xe2\x80\xa2 Remote Access Controls and Security.\n \xe2\x80\xa2 Mobile Device Security.\n \xe2\x80\xa2 Portable Storage Device Security.\n \xe2\x80\xa2 E-mail Security.\n \xe2\x80\xa2 Web Server Security.\n \xe2\x80\xa2 Domain Name System (DNS) Server Security.\n \xe2\x80\xa2 Firewall Security.\n \xe2\x80\xa2 Active Directory (AD) Testing.\n \xe2\x80\xa2 Incident Response, Handling, and Reporting.\n \xe2\x80\xa2 Internet Protocol, Version 6 (IPv6).\n\n\n\nwww.oig.dhs.gov 41 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n \xe2\x80\xa2 Radio Frequency Identification (RFID) Testing.\n \xe2\x80\xa2 Insider Threats.\n\n Identity Management\n\n The Federal Identity, Credential, and Access Management Initiative efforts, including those of\n the OIG community, are a key enabler for addressing the Nation\xe2\x80\x99s cybersecurity challenges. In\n recent years, increasing emphasis has also been placed on improving the physical security of\n the hundreds of thousands of facilities that the Federal Government owns and leases. In\n addition to complex physical and logical cybersecurity threats, the Federal Government faces\n significant challenges in carrying out its IT capabilities to enable a level of assurance and\n electronic service delivery. Standardized controls around identity and access management\n combine to support an improvement in the cybersecurity posture across the Federal\n Government.\n\n The Federal Government has long been challenged in employing effective identity management\n and authentication technologies. In an effort to increase the quality and security of Federal ID\n and credentialing practices, the President issued HSPD-12, Policy for a Common Identification\n Standard for Federal Employees and Contractors, in August 2004, requiring the establishment\n of a government-wide standard for secure and reliable forms of ID.52 A common, standardized,\n trusted basis for digital identity and access management is needed to provide a consistent\n approach to deploying and managing appropriate identity assurance, credentialing, and access\n control services.\n\n OMB issued Memorandum 5-24 on August 5, 2005. This memorandum provided all\n departments and agencies with HSPD-12 implementing instructions and guidance, as well as\n implementation deadlines. Then, in March 2006, NIST issued FIPS 201-1, PersonalfIdentityf\n VerificationfoffFederalfEmployeesfandfContractors. FIPS 201-1 consists of two parts, PIV-I and\n PIV-II. The minimum requirements for a Federal personal ID system that meets the control and\n security objectives of HSPD-12, including personal identity proofing, registration, and issuance,\n are described in PIV-I. Detailed technical specifications to support the control and security\n objectives in PIV-I, as well as the interoperability of PIV cards and systems among Federal\n departments and agencies, are outlined in PIV-II.\n\n See appendix F for baseline audit objectives and steps that can be used for conducting and\n evaluating identity management.\n\n\n\n\n 52\n The purpose of HSPD-12 is to enhance security, reduce identity fraud, protect personal privacy, and leverage\n logical (computer) and physical (building access) security through one ID card.\n\n\nwww.oig.dhs.gov 42 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Network Management and Security\n\n Networks are a series of interconnected devices and software that allow individual users and\n agencies to share information. Since sensitive data is stored on and transmitted along\n networks, securing networks is essential for protecting sensitive data from unauthorized access,\n manipulation, and misuse. Adequate network security is needed to protect the confidentiality,\n integrity, and availability of sensitive information.\n\n A comprehensive approach to network security requires that testing for vulnerabilities be\n performed from points within the network as well as outside the firewall, and include the\n testing and verification of network-related security controls (e.g., antivirus software updates,\n audit trail [system log] monitoring and review process, patch management process) on a\n regular basis. All points of entry into the network, such as desktop and laptop computers,\n remote access (Virtual Private Network [VPN] and dial-up), connections to third-party networks,\n wireless access points, and the network perimeter, must be evaluated. The goal is to eliminate\n or minimize all security weaknesses and protect the network from both external and internal\n attack. Routine security testing can prevent many types of security incidents from occurring\n and uncover unknown vulnerabilities and misconfigurations.\n\n See appendix G for baseline audit objectives and steps that can be used for conducting and\n evaluating network management and security.\n\n Laptop Security\n\n As the weight and price of laptop computers have decreased and their computing power and\n ease of use have increased, so has their popularity for use as the primary or only computer for\n Federal Government employees. The Government is now heavily reliant on laptop computers\n for conducting its business. The mobility of laptops has increased the productivity of the\n Federal workforce, but at the same time increased the risk of theft, unauthorized data\n disclosure, and virus infection. Thefts of laptop computers occur regularly from offices,\n airports, automobiles, and hotel rooms.\n\n Data on a lost or stolen laptop, if not encrypted, can reveal critical information such as changes\n to legislation, investigations, or economic analyses. Consequently, government organizations\n that provide for the use of laptop computers must take steps to ensure that the equipment and\n the information that is stored on it are adequately protected. Such steps may include providing\n additional security awareness training to laptop users, ensuring secure storage of laptop\n computers when they are not in use, encrypting data files stored on the laptop, and ensuring\n that adequate security software applications, such as firewalls and antivirus software, are\n installed and regularly updated.\n\n\n\n\nwww.oig.dhs.gov 43 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n See appendix H for baseline audit objectives and steps that can be used for conducting and\n evaluating laptop security.\n\n Wireless Security\n\n The use of wireless networks and devices is becoming increasingly popular throughout the\n Federal Government environment. Wireless networks extend the range of traditional wired\n networks by using radio waves to transmit data to wireless-enabled devices. Wireless systems\n include local area networks, personal networks, cell phones, and devices such as wireless\n headphones, microphones, and other devices. The most common communication standards\n used by wireless devices are the Institute of Electrical and Electronics Engineers (IEEE) 802.11\n (802.11x) and Bluetooth. 802.11x devices can form a wireless local area network by connecting\n through an access point or to other 802.11x devices. Bluetooth is used primarily on handheld\n devices such as BlackBerries and other smartphones, but can also be used to connect desktop\n peripherals such as a mouse or keyboard. Two or more Bluetooth devices can form an ad-hoc\n network by connecting to each other.\n\n Wireless technology can offer Federal agencies many potential benefits in improving employee\n productivity and flexibility. In addition, wireless network installations can provide tremendous\n cost savings compared to traditional wired infrastructures. However, wireless networks and\n devices also present significant security challenges, including protection against outside attacks,\n physical controls over wireless infrastructure and devices, and unauthorized deployments of\n wireless networks or access points. In addition, the increased use of wireless technology has\n introduced several new security risks to the computing environment, including eavesdropping,\n unauthorized access points, and signal leakage that can compromise sensitive information. As a\n result, the Federal Government must take the extra effort needed to implement effective\n security controls necessary to protect sensitive information stored and processed on and by its\n wireless networks and devices.\n\n See appendix I for baseline audit objectives and steps that can be used for conducting and\n evaluating the security of wireless networks and devices.\n\n Database Security\n\n A database is one or more large structured sets of data (e.g., fields, records, files) organized so\n that the data can easily be accessed, managed, and updated. Databases are usually associated\n with software to update and query the data, called a database management system (DBMS). A\n DBMS can be an extremely complex set of software programs that control an organization\xe2\x80\x99s\n storage and retrieval of information in a database. It also controls access to the data and\n ensures the security and integrity of the database. DBMSs can be classified according to their\n architectural model (relational, hierarchical, or network) and can be centralized on one\n platform or distributed across multiple servers.\n\n\nwww.oig.dhs.gov 44 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Databases and DBMSs have become a more frequent target of attack by malicious users. Such\n an attack can result in financial loss, loss of privacy, a breach of national security, and many\n other varieties of corruption that can result from unauthorized access to sensitive data. To\n counter this threat, an increasing number of security options have become available to protect\n the sensitive data housed in databases. However, for these measures to be effective, DBMS\n security controls must be properly configured and maintained. In addition, as database\n products have become more complex and the attacks against them have increased, a number\n of vulnerabilities have been identified that attackers could exploit. DBMS vendors have\n responded by issuing patches or fixes for discovered vulnerabilities, but these patches must be\n quickly and appropriately applied to ensure that sensitive data is adequately protected.\n\n See appendix J for baseline audit objectives and steps that can be used for conducting and\n evaluating database security.\n\n UNIX Operating System Security\n\n UNIX is a computer operating system that was first developed in 1969 by AT&T employees\n while at Bell Labs. It was originally conceived as an academic operating system, particularly at\n the university level, and hence security was not a top design priority. Since then, however,\n UNIX computing systems have been made more widely available and have become an essential\n part of networking and Internet infrastructure. Linux, a descendant of UNIX, is a leading\n operating system on servers and other systems such as mainframe computers and\n supercomputers; more than 90 percent of today\'s 500 fastest supercomputers run some variant\n of Linux. Linux also runs on embedded systems (devices where the operating system is typically\n built into the firmware and highly tailored to the system) such as mobile phones, tablet\n computers, network routers, building automation controls, televisions, and video game\n consoles.\n\n The evolution of UNIX security features continues to this day, with an increasingly urgent need\n for preventing inappropriate access to systems and their data. The increased level of access\n and the need for data security have driven improvements to UNIX security features. Whether\n servers are purchased operating systems with vendor support such as Solaris, Red Hat, or\n Hewlett-Packard (HP), or an open source Linux variant such as Debian, openSUSE, or Fedora,\n these servers are all referred to as UNIX servers. Each of these operating systems has unique\n security vulnerabilities from differing implementations, applications, and services.\n\n See appendix K for a list of audit objectives and steps that can be conducted in evaluating UNIX\n and Linux operating system security. Depending on the UNIX version being reviewed (which\n include IBM AIX and Linux), there are STIG templates that can be used to evaluate whether the\n operating system controls for have been properly implemented. In addition, the CERT\n Coordination Center (CERT/CC), at Carnegie Mellon University\xe2\x80\x99s Software Engineering Institute,\n\n\n\nwww.oig.dhs.gov 45 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n has published a system security checklist that can be used to audit an organization\xe2\x80\x99s UNIX\n network (http://staff.washington.edu/dittrich/R870/security-checklist.html).53\n\n Remote Access Controls and Security\n\n Remote access allows trusted computer users to access government networks via modem or\n the Internet. This allows mobile employees access to network resources (e.g., E-mail messages,\n files, databases, applications) while they are away from their office. Remote access has\n numerous advantages; for example, it allows employees who are on travel or telework to\n access an agency\xe2\x80\x99s network and resources.\n\n Though providing government employees with remote access has several advantages, granting\n and maintaining remote access to government systems and resources also involves numerous\n security concerns. High-speed Internet access technologies, such as cable modems, fiber-optic\n lines, satellites, and wireless systems allow for increased transmission speed and bandwidth,\n and make it easier for users to access and transfer large amounts of data. These factors make\n remote access users an attractive target for attackers, increasing the risk that malicious users\n may attempt to gain inappropriate or unauthorized access to government systems and\n resources from a remote location. Therefore, greater potential exists for the exposure of\n internal government network resources and data from external sources.\n\n See appendix L for baseline audit objectives and steps that can be used for conducting and\n evaluating remote access capabilities.\n\n Mobile Device Security\n\n Mobile devices, such as tablets the Android and Apple smartphones, have become widely used\n tools for today\xe2\x80\x99s highly mobile workforce. These devices allow workers to accomplish their\n duties and carry out their tasks at any time and from any place as well as transport large\n volumes of data. For example, these devices enable workers to send and receive E-mail\n messages, browse the Internet, store and modify documents, deliver presentations, and\n remotely access data.\n\n Mobile devices provide many productivity benefits, but they also expose the organization to\n new security risks, such as downloading viruses or inadvertently exposing sensitive information\n or personally identifiable information (PII). In addition, mobile devices, such as tablet\n computers and smartphones based on Android, Apple iPhone Operating System, Web\n\n 53\n CERT/CC studies Internet security vulnerabilities, researches long-term changes in networked systems, and\n develops information and training to help the public improve security. Although it was established as an incident\n response team, CERT/CC has evolved beyond that, focusing instead on identifying and addressing existing and\n potential threats, notifying system and other technical personnel of these threats, and coordinating with vendors\n and incident response teams worldwide to address the threats.\n\n\nwww.oig.dhs.gov 46 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Operating System, and Windows Operating Systems, typically lack several important security\n features commonly used on desktop computers. Security threats to mobile devices include\n loss, theft, or disposal; unauthorized access; spam; and electronic eavesdropping and tracking.\n Further, these devices are difficult to administer centrally because they lack the functionality\n and security features needed to be easily managed in an enterprise or government\n environment without employing a third-party application.\n\n See appendix M for baseline audit objectives and steps that can be used for evaluating mobile\n device security.\n\n Portable Storage Device Security\n\n The proliferation and uncontrolled use of Universal Serial Bus (USB) flash drives and other\n portable storage devices increase the risk of theft and mishandling of sensitive information.\n When users insert their personal or unauthorized devices into a computer\xe2\x80\x99s USB or FireWire\n ports to transfer data, new IT security risks can be introduced to agency computers and\n networks and amplify risks that already exist.54 Examples of portable storage devices include\n flash drives, pen drives, external hard drives, and portable music and video players that can also\n store data (e.g., Apple iPods). These portable devices are small enough to fit into a shirt pocket,\n relatively inexpensive, and can store a large amount of data.\n\n The risk of unauthorized access to sensitive data becomes more apparent with U3-enabled USB\n devices.55 The open-standard U3 platform allows a user to install applications onto the USB\n drive and then launch them on USB-equipped Windows machines, regardless of whether the\n user has administrative privileges. A small, 4-megabyte, read-only system partition of the U3\n drive looks to the system like a compact disk (CD) read-only memory (ROM) drive, while the\n data partition looks like a regular flash drive. Windows treats the system partition as a CD. U3\n then takes advantage of the AutoPlay feature in Windows to automatically run the U3\n LaunchPad application and unlock the data partition of the hard drive. Therefore, unsecured\n computers might allow these portable devices to install a (1) key catcher program that will\n capture all characters typed on the computer keyboard, likely including application IDs and\n passwords; (2) password gathering program that will retrieve Windows password hashes and\n could later be cracked; (3) vulnerability scanner program that could launch vulnerability scans\n of devices on the network, obtaining information that could later be used to gain unauthorized\n access; or (4) virus that could propagate across the network, affecting system availability.\n\n\n\n 54\n The IEEE 1394 interface, developed in the late 1980s and early 1990s by Apple as FireWire, is a serial bus\n interface standard for high-speed communications and isochronous real-time data transfer. This interface is\n comparable with USB, and often those two technologies are considered together.\n 55\n U3 was a joint venture that produced a proprietary method of launching Windows applications from special USB\n flash drives.\n\n\nwww.oig.dhs.gov 47 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n See appendix N for baseline audit objectives and steps that can be used for conducting and\n evaluating portable storage device security.\n\n E-mail Security\n\n E-mail is the most popularly used system for exchanging information over the Internet, and is a\n critical tool used by government agencies to complete their missions. Sensitive data is often\n sent via E-mail within an agency as well as between government employees and outside\n entities. In today\xe2\x80\x99s network environment, E-mail is also a preferred path hackers use to\n distribute viruses, worms, spam, and other attacks. E-mail system servers are among the most\n targeted and attacked machines within an organization\xe2\x80\x99s network, second only to web servers.\n It is critical to protect information sent or received via E-mail from unauthorized use, disclosure,\n modification, destruction, or exploitation.\n\n See appendix O for baseline audit objectives and steps that can be used for conducting and\n evaluating E-mail security.\n\n Web Server Security\n\n The World Wide Web is a system for exchanging information over the Internet. At the most\n basic level, it can be divided into two principal components: (1) web servers that make\n information available over the Internet (in essence, provide hosting services), and (2) websites\n and applications using software to access and display the information stored on web servers\n and support systems.\n\n An agency\xe2\x80\x99s public-facing website is the most accessible point of entry and attack to its\n resources.56 These types of sites and the servers that support them are useful in providing\n information and services, but they are often the most targeted and attacked hosts on\n organizations\xe2\x80\x99 networks. Web servers and the network infrastructure that supports them must\n be configured to protect sensitive data.\n\n Appropriate management practices are essential to operating and maintaining a secure web\n server. Security practices entail the ID of an organization\xe2\x80\x99s information system assets and the\n development, documentation, and implementation of policies, standards, procedures, and\n guidelines that help to ensure the confidentiality, integrity, and availability of information\n system resources.\n\n\n\n\n 56\n A public-facing website is a website freely accessible by all Internet users. Typically, it contains information\n about an organization\xe2\x80\x99s business, products, services, contact information, and history. It may also have links to\n other related websites. It is an information source about an organization for its customers and partners.\n\n\nwww.oig.dhs.gov 48 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n See appendix P for baseline audit objectives and steps that can be used for conducting and\n evaluating web server security.\n\n DNS Server Security\n\n An IP address is a numerical label assigned to each device (e.g., computer, printer) configured\n on a computer network that uses the IP for communication. Computers in the network route\n communication packets across the Internet based on the IP addresses of the packets. However,\n when accessing websites and using E-mail services, a user can simply employ a domain name,\n such as DHS.gov or DOJ.gov that is easier to remember than a full IP address. The DNS\n transforms human-readable domain names into machine-readable IP addresses and also does\n the reverse process, taking a query with an IP address and returning the associated domain\n name.\n\n The primary security goals for DNS are data integrity and source authentication, both needed to\n ensure the authenticity of domain name information and maintain the integrity of domain\n name information in transit. DNS services and data availability are also important; DNS\n components are often subjected to denial-of-service attacks intended to disrupt access to the\n resources whose domain names are handled by the attacked DNS components. DNS\n deployments must be configured to prevent denial-of-service attacks that exploit vulnerabilities\n in various DNS components. DNS is susceptible to the same types of vulnerabilities (platform,\n software, and network level) as any other distributed computing system.\n\n As part of the Federal Government\'s effort to increase its level of service to the public, agencies\n have been instructed to implement Domain Name System Security (DNSSEC) extension\n measures to all websites in the ".gov" domain. The purpose of this initiative is to ensure that\n public users of government services who are provided online access are confident that a\n website they visit and over which they transmit information is an authentic government\n website and secure. Securing Federal Internet domains is of critical importance given the\n government\xe2\x80\x99s increased reliance on the Internet to provide services and disseminate\n information to the public. OMB Memorandum 08-23 establishes authority to secure the\n Federal Government\xe2\x80\x99s DNS Infrastructure.\n\n See appendix Q for baseline audit objectives and steps that can be used for conducting and\n evaluating the management and security measures in place over DNS servers.\n\n\n\n\nwww.oig.dhs.gov 49 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Firewall Security\n\n Network firewalls protect systems and networks from external threats.57 Firewalls can block\n access to internal services, bar unwanted users, and in some cases, filter network traffic by\n content. However, hackers utilize several exploits to penetrate firewalls and undermine\n firewall security. The most common of these include brute force, backdoor passwords, service\n provider passwords, improper configuration, firmware bugs, and telnet/web access. Firewall\n audits can evaluate the security posture of a network. Beyond compliance requirements,\n firewall audits can increase the chances of catching weaknesses in an organization\xe2\x80\x99s network\n and identify deficiencies in firewall policies that need to be addressed. Two of the most\n important aspects of conducting a firewall audit are to review the change process and the\n firewall rule base (also called a policy).\n\n See appendix R for baseline audit objectives and steps that can be used for conducting and\n evaluating firewall security controls. In addition, the SANS Institute has developed a firewall\n checklist as part of its Security Consensus Operational Readiness Evaluation program that can\n be used to audit a firewall. The checklist does not provide vendor-specific security\n considerations, but rather attempts to provide a generic listing of security considerations to be\n used when auditing a firewall (http://www.sans.org/score/checklists/FirewallChecklist.pdf).\n\n AD Testing\n\n AD is the directory service associated with Microsoft\xc2\xae Windows Server operating systems. It\n enables centralized, secure management of an entire network of users and acts as a data store\n for multiple kinds of enterprise information. AD also allows administrators to add, delete,\n organize, and maintain user, local administrative, and system service accounts, as well as define\n group policy objects to enforce password and permission polices across an enterprise.\n\n The distributed nature of an organization\xe2\x80\x99s component networks requires the use of many\n trusts between their AD servers. These trusts, the process for allowing a user to authenticate\n to one domain and access resources in another domain without authenticating again, must be\n secured and maintained to protect the organization\xe2\x80\x99s data and services. Trust zones within and\n throughout these networks pose a significant security risk if they are not effectively configured,\n implemented, and managed.\n\n Because AD is such a powerful tool for administrators, access should be limited to minimize the\n threat of insider attacks\xe2\x80\x94either malicious or a result of human error\xe2\x80\x94as well as external\n attacks that could elevate privileges through weak security measures. Attacks on networks\n could be successful via faulty trust authentication, unpatched domain controllers, or\n\n 57\n Firewalls are devices or programs that control the flow of network traffic between networks or hosts that\n employ differing security postures.\n\n\nwww.oig.dhs.gov 50 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n unstructured system and management policies that do not separate duties and enforce least\n privilege. Such attacks could result in unauthorized access to an organization\xe2\x80\x99s data or\n resources.\n\n Effective access controls implemented through AD services and trusts are a core element of an\n enterprise security program. Additionally, the overall security posture must include elements\n such as group policy objects in place to enforce password and file permissions, administrative\n efforts and policy enforcement for inactive account removal, event logging, and up-to-date\n patches on domain controllers.\n\n See appendix S for baseline audit objectives and steps that can be used to test and evaluate AD\n controls.\n\n Incident Response, Handling, and Reporting\n\n Computer security incident response has become an important component of IT programs.\n Security-related threats have become not only more numerous and diverse but also more\n damaging and disruptive. New types of security-related incidents emerge frequently.\n Preventive activities based on the results of risk assessments can lower the number of\n incidents, but not all incidents can be prevented. An incident response capability is therefore\n necessary for rapidly detecting incidents, minimizing loss and destruction, mitigating the\n weaknesses that were exploited, and restoring computing services.\n\n Because performing incident response effectively is a complex undertaking, establishing a\n successful incident response capability requires substantial planning and resources. Continually\n monitoring threats through IDSs and other mechanisms is essential. The speed with which an\n organization can recognize, analyze, and respond to an incident will limit the damage and lower\n the cost of recovery. Therefore, establishing clear procedures for assessing the current and\n potential business effect of incidents is crucial, as is implementing effective methods of\n collecting, analyzing, and reporting data. Also, building relationships and developing a means\n of communication with other internal groups (e.g., human resources, legal) and with external\n groups (e.g., other incident response teams, law enforcement) are vital for an organization\xe2\x80\x99s\n incident response and reporting system.\n\n See appendix T for baseline audit objectives and steps that can be used for conducting and\n evaluating an agency\xe2\x80\x99s incident response, handling, and reporting capabilities.\n\n IPv6\n\n IP is the common language that allows different types of information, such as E-mail and other\n data, voice communications, and video, to travel seamlessly over the same network or the\n\n\n\nwww.oig.dhs.gov 51 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Internet. Many devices that connect to the Internet need a unique IP address. IP addresses\n identify information\xe2\x80\x99s origin and destination.\n\n The existing protocol supporting the Internet today is Internet Protocol, Version 4 (IPv4), which\n defines an IP address as a 32-bit number. However, IPv4 provides only 4 billion IP addresses,\n inherently limiting the number of devices that can have a unique, globally routable location on\n the Internet. Due to the enormous growth of the Internet and the predicted depletion of\n available addresses, a new version of IP (IPv6), introduced as the next generation of IP using a\n 128-bit address, was developed in 1995. IPv6 was standardized in 1998, and its deployment\n has continued since the mid-2000s.\n\n IPv6 provides more addresses and many features to enhance the use and efficiency of\n networking. It provides an exponentially larger number of available IP addresses and is\n essential to the continued growth of the Internet and development of new applications\n leveraging mobile Internet connectivity. Federal agencies must prepare for the future of\n networking and Internet technology by enabling their networks to support IPv6 addresses and\n data packets.\n\n See appendix U for baseline audit objectives and steps that can be used for conducting and\n evaluating an agency\xe2\x80\x99s implementation of IPv6.\n\n RFID Testing\n\n RFID is an automated data-capture technology that can be used to electronically identify, track,\n and store information contained on a device called an RFID tag. The technology provides a\n more efficient method for Federal agencies, manufacturers, retailers, and suppliers to collect,\n manage, disseminate, store, and analyze information on inventory, business processes, and\n security controls by providing real-time access to information. Technology components of an\n RFID system consist of a tag, reader, and database.\n\n Adequate security controls are needed to protect the confidentiality, integrity, and availability\n of the information contained on RFID tags and in the database systems where information is\n stored and retrieved. Privacy concerns must also be addressed when implementing a system\n using RFID technology. The primary reason for developing controls and testing the security of\n RFID is to identify potential issues and vulnerabilities and put preventive and detective controls\n into place. Since this is a relatively new technology for the Federal Government, there is little\n guidance and policy governing RFID technology or controls.\n\n See appendix V for baseline audit objectives and steps that can be used for evaluating and\n testing RFID controls.\n\n\n\n\nwww.oig.dhs.gov 52 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Insider Threats\n\n Insider threats represent the greatest risk to computer security because an organization\xe2\x80\x99s own\n employees understand how the computer systems work. According to Gartner, Inc., more than\n 70 percent of data thefts, data breaches, and instances of unauthorized access to data are\n committed by an organization\'s own employees.58 Effectively mitigating the insider threat\n requires policies, practices, and continued training.\n\n Two common policy areas that can reduce insider threat are access controls and segregation of\n duties. Poor access controls enable an individual or group to inappropriately modify, destroy,\n or disclose sensitive data or computer programs for purposes such as personal gain or\n sabotage. Segregation of duties is important in ensuring the integrity of an enterprises\n information system. No one individual should have complete control of any system. Failing to\n properly segregate the computer duties of an organization\xe2\x80\x99s staff can dramatically increase the\n risk of errors or fraud.\n\n Monitoring users\xe2\x80\x99 access and data actions on a system is not enough. Once the enterprise\n develops a policy and presents it to all users, it must enforce the policy. Software and\n hardware solutions currently allow the input of policy in human terms, translate it to machine\n code, and then monitor at the packet level of all data transactions within, and outbound from,\n the network. Packet monitoring for policy compliance is one way to enforce the policy itself.\n Without this approach, the administrator is dependent on the trustworthiness of the users to\n adhere to the policy.\n\n See appendix W for baseline audit objectives and steps that can be used for conducting and\n evaluating insider threats.\n\n\n\n\n 58\n Gartner, Inc. is a world leading IT research and advisory company.\n\n\nwww.oig.dhs.gov 53 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix A\n Additional References to Relevant Requirements and Guidance\n Executive Order 13286\n This order, issued in February 2003, specifies the national policy statement regarding the\n protection against disruption of information systems for critical infrastructures. The order\n designates the National Infrastructure Advisory Council to provide the President with advice on\n the security of information systems for critical infrastructures supporting other sectors of the\n economy through the Secretary of Homeland Security.\n (http://www.fas.org/irp/offdocs/eo/eo-13286.htm)\n\n Freedom of Information Act\n Enacted on July 4, 1966, and taking effect one year later, the Freedom of Information Act \n\n provides that any person has a right, enforceable in court, to obtain access to Federal agency \n\n records, except to the extent that such records (or portions of them) are protected from public \n\n disclosure. Under the Act, agencies must disclose any information that is requested, unless that \n\n information is protected from public disclosure. It also requires that agencies automatically \n\n disclose certain information, including frequently requested records. \n\n\n The Freedom of Information Act is a law that gives individuals the right to access information \n\n from the Federal Government. It is often described as the law that keeps citizens in the know \n\n about their government. \n\n (http://www.foia.gov/) \n\n\n PDD-63\n PDD-63, Critical Infrastructure Protection, issued in May 1998, required the establishment of\n lead agencies for infrastructure sectors that could become targets for significant cyber or\n physical attacks. As required by PDD-63, the Federal Government and private sectors were to\n produce a National Infrastructure Assurance Plan that, among other initiatives, included:\n\n \xe2\x80\xa2\t Performance of initial vulnerability assessments, followed by periodic updates, for each\n sector of the economy and government that might become a target of an infrastructure\n attack intended to significantly damage the U.S.\n\n \xe2\x80\xa2\t Development and implementation of a remedial plan, based upon the results of the\n vulnerability assessments, to identify timelines, responsibilities, and funding for addressing\n identified risks.\n\n On December 17, 2003, PDD-63 was superseded by HSPD-7. HSPD-7 required Federal\n departments and agencies to identify and prioritize the Nation\xe2\x80\x99s critical infrastructures and key\n resources and to protect them from terrorist attacks. In February 2013, PDD-21 revoked\n\n\nwww.oig.dhs.gov 54\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n HSPD-7. Under PDD-21, critical infrastructure security and resilience is to be a shared\n responsibility among Federal, State, local, tribal and territorial entities, and public and private\n owners and operators of critical infrastructure.\n (http://www.fas.org/irp/offdocs/pdd/pdd-63.htm)\n\n HSPD-12 \xe2\x80\x93 Policy for a Common Identification Standard for Federal Employees and\n Contractors\n Traditionally, a wide range of procedures has been employed to authenticate an individual\xe2\x80\x99s\n identity, using various classes of credentials for both physical access to buildings and\n authorization to access computers and data. HSPD-12, signed in 2004, established a mandatory\n government standard for secure and reliable ID credentials issued by government departments\n and agencies to its employees and contractors. The policy is intended to enhance security,\n increase efficiency, reduce identify fraud, and protect personal privacy. These credentials are\n to be used for gaining physical and logical access to federally controlled facilities and\n information systems.\n (http://www.dhs.gov/homeland-security-presidential-directive-12)\n\n Homeland Security Act of 2002\n In November 2002, this act created DHS, with the overriding mission of protecting the U.S. from\n further terrorist attacks. Under the act, DHS was assigned the following critical infrastructure\n protection responsibilities: (1) developing a comprehensive national plan for securing the key\n resources and critical infrastructures of the U.S.; (2) recommending measures to protect the\n key resources and critical infrastructures of the U.S. in coordination with other groups; and\n (3) disseminating, as appropriate, information to assist in the deterrence, prevention, and\n preemption of or response to terrorist attacks.\n (http://www.dhs.gov/xlibrary/assets/hr_5005_enr.pdf)\n\n The National Strategy for Homeland Security\n In response to the terrorist attacks that occurred in September 2001,fThefNationalfStrategyfforf\n HomelandfSecurity, issued in July 2002, was developed to mobilize and organize the Nation to\n secure the U.S. from terrorist attacks. The strategy identified eight major initiatives, including\n the need to secure cyberspace and unify the Nation\xe2\x80\x99s infrastructure protection efforts in DHS.\n (http://www.ncs.gov/library/policy_docs/nat_strat_hls.pdf)\n\n National Response Framework\n The U.S. National Response Framework is part of ThefNationalfStrategyfforfHomelandfSecurity,f\n which presents the guiding principles that enable all response partners to prepare for and\n provide a unified national response to disasters and emergencies, from the smallest incident to\n the largest catastrophe. It establishes a comprehensive, national, all-hazards approach to\n domestic incident response.\n (http://www.fema.gov/national-response-framework)\n\n\n\nwww.oig.dhs.gov 55 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n National Strategy for the Physical Protection of Critical Infrastructures and Key Assets\n Issued in February 2003, this strategy provides a statement of national policy to remain\n committed to protecting critical infrastructures and key assets from physical attacks. This\n strategy builds on the sector-based approach of PDD 63 and calls for expanding the capabilities\n of information sharing and analysis centers. The strategy describes three key objectives:\n (1) identifying and ensuring the protection of the most critical assets, systems, and functions;\n (2) ensuring the protection of infrastructures that face an imminent threat; and (3) pursuing\n collaborative measures and initiatives to ensure the protection of other potential targets.\n (http://www.dhs.gov/xlibrary/assets/Physical_Strategy.pdf)\n\n Federal Identity, Credential, and Access Management Roadmap and Implementation\n Guidance (Version 1.0)\n In November 2009, the Federal Chief Information Officers Council issued this document to\n present the Federal Government with a common framework and implementation guidance\n needed to plan and execute ID, credential, and access management programs. Standardized\n identity and access management controls combine to support an improvement in the\n cybersecurity posture across the Federal Government.\n (http://www.idmanagement.gov/documents/ficam_roadmap_implementation_guidance.pdf)\n\n NIST SP 500-267 \xe2\x80\x93 A Profile for IPv6 in the U.S. Government Version 1.0\n NIST SP 500-267, issued in July 2008, defines a standards profile for IPv6 in the U.S. \n\n Government that is intended to be applicable to all future uses of IPv6 in non-classified, \n\n non-national security Federal IT systems. The standards profile is meant to (1) define a simple \n\n catalog of common network devices; (2) define the minimal mandatory IPv6 capabilities and \n\n identify significant configuration options to assist agencies in the development of more specific\n\n acquisition and deployment plans; and (3) provide the technical basis upon which future U.S. \n\n Government policies can be defined. \n\n (http://www-x.antd.nist.gov/usgv6/docs/usgv6-v1.pdf)\n\n\n NIST SP 800-40 \xe2\x80\x93 Creating a Patch and Vulnerability Management Program (Version 2.0)\n Patch and vulnerability management is a security practice designed to proactively prevent the\n exploitation of IT vulnerabilities that exist within an organization. Timely patching of security\n issues is generally recognized as critical to maintaining the operational availability,\n confidentiality, and integrity of IT systems. In November 2005, this document was issued to\n provide basic guidance for establishing a patch and vulnerability management program and\n testing the effectiveness of that program. It also provides technical solutions that are available\n for vulnerability remediation.\n (http://csrc.nist.gov/publications/nistpubs/800-40-Ver2/SP800-40v2.pdf)\n\n NIST SP 800-40 \xe2\x80\x93 Guide to Enterprise Patch Management Technologies (Revision 3)\n This publication, issued in July 2013, is designed to assist organizations in understanding the\n basics of enterprise patch management technologies. The information contained in this\n\n\nwww.oig.dhs.gov 56 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n publication assumes that the organization has a mature patch management capability and is\n focused on increasing its automation level.59 It was developed for security managers,\n engineers, administrators, and others responsible for acquiring, testing, prioritizing,\n implementing, and verifying security patches. In addition, this publication may be used by\n auditors in assessing the security of systems. It covers the importance of patch management,\n the challenges of patch management, enterprise patch management technologies, and metrics.\n (http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-40r3.pdf)\n\n NIST SP 800-41 \xe2\x80\x93 Guidelines on Firewalls and Firewall Policy (Revision 1)\n NIST SP 800-41, issued in September 2009, describes the capabilities of firewall technologies\n and firewall policies. It also provides practical guidance on developing firewall policies and\n selecting, configuring, testing, deploying, and managing firewalls.\n (http://csrc.nist.gov/publications/nistpubs/800-41-Rev1/sp800-41-rev1.pdf)\n\n NIST SP 800-44 \xe2\x80\x93 Guidelines on Securing Public Web Servers (Version 2)\n Issued in September 2007, this guidefrecommends security practices for designing,\n implementing, and operating publicly accessible web servers, including related network\n infrastructure issues. This document can be used by organizations interested in enhancing\n security on existing and future web server systems to reduce the number and frequency of\n web-related security incidents.\n (http://csrc.nist.gov/publications/nistpubs/800-44-ver2/SP800-44v2.pdf)\n\n NIST SP 800-45 \xe2\x80\x93 Guidelines on Electronic Mail Security (Version 2)\n Attackers frequently target mail servers. Various types of email content and attachments have\n also proven to be effective in introducing viruses and other malware into networks through\n mail clients. Email is extensively used to deliver attacks that exploit vulnerabilities in users\xe2\x80\x99\n workstations or use social engineering methods to trick users. These attacks often lead to the\n compromise of the user workstation or the release of sensitive information even when the\n email client is securely configured. This document, issued in February 2007, recommends\n security practices for designing, implementing, and operating E-mail systems on public and\n private networks.\n (http://csrc.nist.gov/publications/nistpubs/800-45-version2/SP800-45v2.pdf)\n\n NIST SP 800-46 \xe2\x80\x93 Guide to Enterprise Telework and Remote Access Security (Revision 1)\n This guide, issued in June 2009, was developed to assist organizations in mitigating the risks\n associated with the enterprise technologies used for telework, including remote access servers,\n telework client devices, and remote access communications. The document emphasizes the\n importance of securing sensitive information stored on telework devices and transmitted\n\n 59\n Organizations seeking more basic guidance on establishing a patch management program or that that have\n legacy needs that cannot be met with current enterprise management technologies could consult the previous\n complementary publication, NIST SP 800-40 (Version 2), CreatingfafPatchfandfVulnerabilityfManagementfProgram.\n\n\nwww.oig.dhs.gov 57 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n through remote access across external networks. It also provides recommendations for\n creating telework-related policies and for selecting, implementing, and maintaining the\n necessary security controls for remote access servers and clients.\n (http://csrc.nist.gov/publications/nistpubs/800-46-rev1/sp800-46r1.pdf)\n\n NIST SP 800-48 \xe2\x80\x93 Guide to Securing Legacy IEEE 802.11 Wireless Networks (Revision 1)\n Wireless local area networks (WLAN) are groups of wireless networking nodes within a limited\n geographic area, such as an office building or building campus, that are capable of radio\n communication. WLANs are usually implemented as extensions to existing WLANs to provide\n enhanced user mobility and network access. The most widely implemented WLAN technologies\n are based on IEEE 802.11 and its amendments. This document, issued in July 2008, is to\n provide guidance to organizations in securing their legacy IEEE 802.11 WLANs that cannot use\n IEEE 802.11i.\n (http://csrc.nist.gov/publications/nistpubs/800-48-rev1/SP800-48r1.pdf)\n\n NIST SP 800-63 \xe2\x80\x93 Electronic Authentication Guideline (Version 1.0.2)\n This document, issued in December 2011, provides technical guidance to Federal agencies\n implementing electronic authentication (e-authentication).60 It covers remote authentication\n of users over open networks and defines technical requirements for each of four levels of\n assurance in the areas of identity proofing, registration, tokens, authentication protocols, and\n related assertions.\n (http://csrc.nist.gov/publications/nistpubs/800-63-1/SP-800-63-1.pdf)\n\n NIST SP 800-70 \xe2\x80\x93 National Checklist Program for IT Products - Guidelines for Checklist Users\n and Developers (Revision 2)\n In February 2011, NIST SP 800-70 was issued to describe security configuration checklists and\n their benefits, and explain how to use the NIST National Checklist Program to find and retrieve\n checklists. Prepared for use by Federal agencies, the document also describes the policies,\n procedures, and general requirements for participation in the NIST Checklist Program.\n (http://csrc.nist.gov/publications/nistpubs/800-70-rev2/SP800-70-rev2.pdf)\n\n NIST SP 800-73-3 \xe2\x80\x93 Interfaces for Personal Identity Verification (4 Parts)\n HSPD-12 required the adoption of a common ID standard to govern the interoperable use of\n identity credentials for physical and logical access to Federal Government locations and\n systems. This document, issued in February 2010, contains technical specifications to interface,\n retrieve, and use identity credentials, and is a companion document to FIPS-201. FIPS 201 was\n developed to establish standards for identity credentials.\n (http://csrc.nist.gov/publications/nistpubs/800-73-3/sp800-73-3_PART1_piv-card-applic-\n namespace-date-model-rep.pdf)\n\n 60\n E-authentication is the process of establishing confidence in user identities electronically presented to an\n information system.\n\n\nwww.oig.dhs.gov 58 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n (http://csrc.nist.gov/publications/nistpubs/800-73-3/sp800-73-3_PART2_piv-card-applic-card-\n common-interface.pdf)\n (http://csrc.nist.gov/publications/nistpubs/800-73-3/sp800-73-3_PART3_piv-client-applic-\n programming-interface.pdf)\n (http://csrc.nist.gov/publications/nistpubs/800-73-3/sp800-73-3_PART4_piv-transitional-\n interface-data-model-spec.pdf)\n\n NIST SP 800-76-1 \xe2\x80\x93 Biometric Data Specification for Personal Identity Verification\n This publication, issued in January 2007, is a companion document to FIPS 201. It contains\n technical specifications for biometric data mandated in FIPS. These specifications reflect the\n design goals of universal interoperability and high performance of the PIV card.61 The\n specifications also address image acquisition to support background check, fingerprint template\n creation, retention, and authentication.\n (http://csrc.nist.gov/publications/nistpubs/800-76-1/SP800-76-1_012407.pdf)\n\n NIST SP 800-79-1 \xe2\x80\x93 Guidelines for the Accreditation of Personal Identity Verification Card\n Issuers\n HSPD-12 mandates that PIV cards be \xe2\x80\x9cissued only by providers whose reliability has been\n established by an official accreditation process.\xe2\x80\x9d This document, issued in June 2008, contains\n guidelines for satisfying the requirements for an official accreditation and provides a\n methodology that any organization can utilize to formally accredit a PIV Card Issuer (PCI). This\n methodology consists of two major elements\xe2\x80\x93assessment62 and accreditation.63 This document\n is applicable to, and shall be used by, all Federal organizations for all their employees and\n contractors for authorizing their physical access to Federal facilities (e.g., buildings, leased\n offices) and logical access to Federal information systems.\n (http://csrc.nist.gov/publications/nistpubs/800-79-1/SP800-79-1.pdf)\n\n NIST SP 800-81 \xe2\x80\x93 Secure Domain Name System (DNS) Deployment Guide (Revision 1)\n NIST issued SP 800-81 in April 2010 to provide deployment guidelines for securing DNS within\n an enterprise.64 The DNS infrastructure is made up of computing and communication entities\n that are geographically distributed throughout the world. Because DNS data is meant to be\n public, preserving the confidentiality of DNS data pertaining to publicly accessible IT resources\n\n 61\n A PIV card is a physical artifact (e.g., identity card, \xe2\x80\x9csmart\xe2\x80\x9d card) issued to an individual that contains stored\n identity credentials (e.g., photograph, cryptographic keys, biometric data) so that the claimed identity of the\n cardholder can be verified against the stored credentials by another person (human readable and verifiable) or an\n automated process (computer readable and verifiable).\n 62\n Assessment, which occurs before accreditation, is the process of gathering evidence regarding a PCI\xe2\x80\x99s\n satisfaction of the requirements of FIPS 201-1, both at the organization and facility level.\n 63\n Accreditation is the decision to authorize the operation of a PCI once it has been established that the\n requirements of FIPS 201-1 have been met and the risks regarding security and privacy are acceptable.\n 64\n To access Internet resources by user-friendly domain names rather than IP addresses, users need a system that\n translates domain names to IP addresses and back. This translation is the primary task of an engine called the\n DNS.\n\n\nwww.oig.dhs.gov 59 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n is not a concern. The primary security goals for DNS are data integrity and source\n authentication, both needed to ensure the authenticity of domain name information and\n maintain the integrity of domain name information in transit.\n\n This document provides extensive guidance on maintaining data integrity and performing\n source authentication. Availability of DNS services and data is also important; DNS components\n are often subjected to denial-of-service attacks intended to disrupt access to the resources\n whose domain names are handled by the attacked DNS components. This document outlines\n the guidelines for configuring DNS deployments to prevent many denial-of-service attacks that\n exploit vulnerabilities in various DNS components.\n (http://csrc.nist.gov/publications/nistpubs/800-81r1/sp-800-81r1.pdf)\n\n NIST SP 800-82 \xe2\x80\x93 Guide to Industrial Control Systems Security\n Control systems are vital to the operation of the U.S. critical infrastructures, which are often\n highly interconnected and mutually dependent systems. This document provides guidance for\n establishing secure ICSs that include supervisory control and data acquisition systems,\n distributed control systems, and other control system configurations. ICSs are typically used in\n industries such as electric, water and wastewater, oil and natural gas, transportation, chemical,\n pharmaceutical, pulp and paper, food and beverage, and discrete manufacturing (e.g.,\n automotive, aerospace, durable goods). Supervisory control and data acquisition systems are\n generally used to control dispersed assets using centralized data acquisition and supervisory\n control, while distributed control systems are generally used to control production systems\n within a local area. This guide was issued in June 2011 to provide an overview of ICSs and\n typical system topologies, identify typical threats and vulnerabilities to these systems, and\n provide recommended security countermeasures to mitigate the associated risks.\n (http://csrc.nist.gov/publications/nistpubs/800-82/SP800-82-final.pdf)\n\n NIST SP 800-92 \xe2\x80\x93 Guide to Computer Security Log Management\n A log is a record of the events occurring within an organization\xe2\x80\x99s systems and networks. Logs\n are composed of entries that contain information related to a specific event that has occurred\n within a system or network. Many logs within an organization contain records related to\n computer security. These computer security logs are generated by many sources, including\n security software, such as antivirus software, firewalls, and IDPSs; operating systems on servers,\n workstations, and networking equipment; and applications.\n\n This guide was issued in September 2006 to provide guidance for developing, implementing,\n and maintaining effective log management practices throughout an enterprise. The guidance in\n this publication covers several topics, including establishing log management infrastructures,\n and developing and performing robust log management processes throughout an organization.\n (http://csrc.nist.gov/publications/nistpubs/800-92/SP800-92.pdf)\n\n\n\n\nwww.oig.dhs.gov 60 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n NIST SP 800-95 \xe2\x80\x93 Guide to Secure Web Services\n The security challenges presented by the web services approach are formidable and\n unavoidable. This publication, issued in August 2007, provides practical, real-world guidance on\n current and emerging standards applicable to web services, as well as background information\n on the most common security threats to service-oriented architectures based on web services.\n This document presents information that is largely independent of particular hardware\n platforms, operating systems, and applications.\n (http://csrc.nist.gov/publications/nistpubs/800-95/SP800-95.pdf)\n\n NIST SP 800-97 \xe2\x80\x93 Establishing Wireless Robust Security Networks: A Guide to IEEE 802.11i\n One of the most active standards organizations that address wireless networking is the IEEE.\n This publication, issued in February 2007, seeks to assist organizations in understanding,\n selecting, and implementing technologies based on IEEE 802.11i, part of the IEEE 802.11 family\n of wireless networking standards. Through its framework for security networks, this document\n explains the security features and capabilities associated with IEEE 802.11i, and provides\n extensive guidance on the planning and deployment of robust security networks.\n (http://csrc.nist.gov/publications/nistpubs/800-97/SP800-97.pdf)\n\n NIST SP 800-111 \xe2\x80\x93 Guide to Storage Encryption Technologies for End User Devices\n In today\xe2\x80\x99s computing environment, there are many threats to the confidentiality of information\n stored on end user devices. This guide, issued in November 2007, outlines storage encryption\n technologies for end user devices and for planning, implementing, and maintaining storage\n encryption solutions. The types of end user devices it addresses are personal computers\n (e.g., desktops, laptops), consumer devices (e.g., personal digital assistants, smartphones), and\n removable storage media (e.g., USB flash drives, memory cards, external hard drives, writeable\n CDs, digital video disks).\n (http://csrc.nist.gov/publications/nistpubs/800-111/SP800-111.pdf)\n\n NIST SP 800-115 \xe2\x80\x93 Technical Guide to Information Security Testing and Assessment\n An information security assessment is the process of determining how effectively an entity\n (e.g., host, system, network, procedure, person\xe2\x80\x94known as the assessment object) meets\n specific security objectives. This document, issued in September 2008, is a guide to the basic\n technical aspects of conducting information security assessments. It presents technical testing\n and examination methods and techniques that an organization might use as part of an\n assessment, and offers insights to assessors on their execution and the impact they may have\n on systems and networks.\n (http://csrc.nist.gov/publications/nistpubs/800-115/SP800-115.pdf)\n\n NIST SP 800-119 \xe2\x80\x93 Guidelines for the Secure Deployment of IPv6 (December 2010)\n The migration to IPv6 services is inevitable, as the IPv4 address space is almost exhausted. IPv6\n is not backward compatible with IPv4, which means that organizations will have to change their\n network infrastructure and systems to deploy IPv6. This document provides guidelines for\n\n\nwww.oig.dhs.gov 61 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n organizations to aid in securely deploying IPv6. Since the majority of organizations will most\n likely run both IPv6 and IPv4 on their networks for the foreseeable future, this document\n speaks about the deployment of IPv6 rather than the transition to IPv6.\n\n Federal agencies will most likely face security challenges throughout the deployment process,\n including:\n\n \xe2\x80\xa2\t An attacker community that is likely to have more experience and comfort with IPv6 than\n an organization in the early stages of deployment.\n \xe2\x80\xa2\t Difficulty in detecting unknown or unauthorized IPv6 assets on existing IPv4 production\n networks.\n \xe2\x80\xa2\t Added complexity while operating IPv4 and IPv6 in parallel.\n \xe2\x80\xa2\t Lack of IPv6 maturity in security products when compared to IPv4 capabilities.\n \xe2\x80\xa2\t Proliferation of transition-driven IPv6 (or IPv4) tunnels, which complicate defenses at\n network boundaries even if properly authorized, and can completely circumvent those\n defenses if unauthorized (e.g., host-based tunnels initiated by end users).\n (http://csrc.nist.gov/publications/nistpubs/800-119/sp800-119.pdf)\n\n NIST SP 800-120 \xe2\x80\x93 Recommendation for EAP Methods Used in Wireless Network Access\n Authentication\n As different wireless technologies are launched to enable user mobility and provide pervasive\n network and service accessibility, security has been a prominent requirement for the Federal\n Government in such access environments. Access authentication and the establishment of keys\n that protect wireless traffic are both core security components in wireless applications. The\n Extensible Authentication Protocol (EAP) is a framework for access authentication that supports\n different authentication methods. Currently, EAP various wireless standards have adopted EAP\n as an access authentication and key establishment protocol. It is desirable for EAP methods\n used for WLAN to support mutual authentication and key derivation.\n\n This recommendation, issued in September 2009, formalizes a set of core security requirements\n for EAP methods when employed by the Federal Government for wireless access authentication\n and key establishment. The requirements should be considered generic, in the sense that they\n are independent of specific wireless technologies.\n (http://csrc.nist.gov/publications/nistpubs/800-120/sp800-120.pdf)\n\n NIST SP 800-121 \xe2\x80\x93 Guide to Bluetooth Security (Revision 1)\n Bluetooth is an open standard for short-range radio frequency communication. Bluetooth\n technology is used primarily to establish wireless personal area networks, commonly referred\n to as ad hoc or peer-to-peer networks. Bluetooth technology and associated devices are\n susceptible to general wireless networking threats, such as denial-of-service attacks,\n eavesdropping, man-in-the-middle attacks, message modification, and resource\n misappropriation. They are also threatened by more specific Bluetooth-related attacks that\n\n\nwww.oig.dhs.gov 62\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n target known vulnerabilities in Bluetooth implementations and specifications. Issued in\n June 2012, this guide provides information to organizations on the security capabilities of\n Bluetooth and provide recommendations to organizations employing Bluetooth technologies\n on securing them effectively.\n (http://csrc.nist.gov/publications/nistpubs/800-121-rev1/sp800-121_rev1.pdf)\n\n NIST SP 800-123 \xe2\x80\x93 Guide to General Server Security\n An organization\xe2\x80\x99s servers provide a wide variety of services to internal and external users, and\n many servers also store or process sensitive information for the organization. Some of the\n most common types of servers are web, email, database, infrastructure management, and file\n servers. This publication addresses the general security issues of typical servers\xe2\x80\x94the\n fundamental activities performed as part of securing and maintaining the security of servers\n that provide services over network communications as a main function. Issued in July 2008,\n this document addresses common servers that use general operating systems such as Unix,\n Linux, and Windows.\n (http://csrc.nist.gov/publications/nistpubs/800-123/SP800-123.pdf)\n\n NIST SP 800-124 \xe2\x80\x93 Guidelines for Managing the Security of Mobile Devices in the Enterprise\n (Revision 1 - Draft)\n Mobile devices, such as smartphones and tablets, typically need to support multiple security\n objectives: confidentiality, integrity, and availability. To achieve these objectives, mobile\n devices should be secured against a variety of threats. The purpose of this publication, issued\n in draft in June 2013, is to help organizations centrally manage and secure mobile devices\n against a variety of threats. It provides recommendations for selecting, implementing and using\n centralized management technologies and explains the security concerns inherent in mobile\n device use. The scope covers both organization-provided and personally-owned (bring your\n own device) mobile devices. Laptops and mobile devices with minimal computing capabilities,\n such as basic cell phones, are not included within the scope of this publication.\n (http://csrc.nist.gov/publications/drafts/800-124r1/draft_sp800-124-rev1.pdf)\n\n NIST SP 800-144 \xe2\x80\x93Guidelines on Security and Privacy in Public Cloud Computing\n Cloud computing has been defined by NIST as a model for enabling convenient, on-demand\n network access to a shared pool of configurable computing resources (e.g., networks, servers,\n storage, applications, and services. Cloud computing is to enable these resources to be rapidly\n provisioned and released with minimal management effort or cloud provider interaction. In\n public clouds, however, the infrastructure and computational resources are owned and\n operated by an outside party that delivers services to the general public via a multi-tenant\n platform.\n\n This publication, issued in December 2011, provides an overview of the security and privacy\n challenges pertinent to public cloud computing and points out considerations organizations\n should take when outsourcing data, applications, and infrastructure to a public cloud\n\n\nwww.oig.dhs.gov 63 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n environment. It also describes the threats, technology risks, and safeguards surrounding public\n cloud environments, and their treatment.\n (http://csrc.nist.gov/publications/nistpubs/800-144/SP800-144.pdf)\n\n OMB Circular A-130 (Revised \xe2\x80\x93 Management of Federal Information Resources\n This circular, last updated in 2000, establishes policy for the management of Federal\n information resources government-wide. OMB includes procedural and analytic guidelines for\n implementing specific aspects of these policies as appendices. The policies in this circular apply\n to the information activities of all agencies of the executive branch of the Federal Government.\n The Director of OMB will use IT planning reviews, fiscal budget reviews, information collection\n budget reviews, management reviews, and such other measures as the Director deems\n necessary to evaluate the adequacy and efficiency of each agency\'s information resources\n management and compliance with this circular.\n (http://www.whitehouse.gov/omb/circulars_a130_a130trans4#1)\n\n OMB Memorandum 05-22 \xe2\x80\x93 Transition Planning for Internet Protocol Version 6 (IPv6)\n This memorandum and its attachments provide guidance to Federal agencies to ensure an\n orderly and secure transition from IPv4 to IPv6. It required all Federal agency network\n infrastructures use IPv6 by June 2008. The memorandum includes milestones outlining goals\n and dates to transition to IPv6.\n (http://georgewbush-whitehouse.archives.gov/omb/memoranda/fy2005/m05-22.pdf)\n\n OMB Memorandum 05-24 \xe2\x80\x93 Implementation of Homeland Security Presidential Directive\n (HSPD) 12 \xe2\x80\x93 Policy for a Common Identification Standard for Federal Employees and\n Contractors\n On August 27, 2004, the President signed HSPD-12. The directive requires agencies to develop\n and implement a mandatory, government-wide standard for secure and reliable forms of ID for\n Federal employees and contractors. As required by the directive, the Department of\n Commerce issued FIPS 201. This memorandum provides implementing instructions for\n HSPD-12 and FIPS 201.\n (http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2005/m05-24.pdf)\n\n OMB Memorandum 06-06 \xe2\x80\x93 Sample Privacy Documents for Agency Implementation of\n Homeland Security Presidential Directive (HSPD) 12\n OMB guidance itemizes the privacy-related elements of HSPD-12 implementation based on\n existing requirements to inform individuals about collections of their personal information.\n Included as attachments to this memorandum are sample privacy documents (e.g., Privacy Act\n systems of records notices, Privacy Act statements, and a privacy impact assessment) to use as\n models in implementing HSPD-12 at Federal agencies.\n (http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2006/m06-\n 06.pdf)\n\n\n\nwww.oig.dhs.gov 64 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n OMB Memorandum 06-16 \xe2\x80\x93 Protection of Sensitive Agency Information\n In addition to NIST\xe2\x80\x99s checklist for protection of remote information, this memorandum\n recommends that all departments and agencies take actions including (1) encrypting all data on\n mobile computers/devices that carry agency data unless the data are determined to be\n nonsensitive; (2) allowing remote access only with two-factor authentication where one of the\n factors is provided by a device separate from the computer gaining access; (3) using a\n \xe2\x80\x9ctimeout\xe2\x80\x9d function for remote access and mobile devices, requiring user reauthentication after\n 30 minutes of inactivity; and (4) logging all computer-readable data extracts from databases\n holding sensitive information and verifying that each extract including sensitive data has been\n erased within 90 days or that its use is still required.\n (http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2006/m06-16.pdf)\n\n OMB Memorandum 06-18 \xe2\x80\x93 Acquisition of Products and Services for Implementation of\n HSPD-12\n This memorandum provides updated direction for the acquisition of products and services for\n the implementation of HSPD-12 and also provides status of implementation efforts.\n (http://georgewbush-whitehouse.archives.gov/omb/memoranda/fy2006/m06-18.pdf)\n\n OMB Memorandum 06-19 \xe2\x80\x93 Reporting Incidents Involving Personally Identifiable Information\n and Incorporating the Cost for Security in Agency Information Technology Investments\n This memorandum provides updated guidance on the reporting of security incidents involving\n\n PII and explains new requirements that need to be provided in agency budget submissions for \n\n IT.\n\n (http://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2006/m06-19.pdf) \n\n\n OMB Memorandum 07-06 \xe2\x80\x93 Validating and Monitoring Agency Issuance of Personal Identity\n Verification Credentials\n This memorandum discusses validation and monitoring of agency issuance of PIV-compliant\n identity credentials. It also specifies the requirements for agencies to complete background\n checks on all current employees and contractors, and the issuance of PIV credentials according\n to the technical specifications documented in FIPS 201.\n (http://www.whitehouse.gov/sites/default/files/omb/assets/omb/memoranda/fy2007/m07-\n 06.pdf)\n\n OMB Memorandum 08-23 \xe2\x80\x93 Securing the Federal Government\xe2\x80\x99s Domain Name System\n Infrastructure\n This memorandum, issued in August 2008, describes existing and new policies for deploying\n DNSSEC to all Federal information systems. DNSSEC provides cryptographic protections to DNS\n communication exchanges, thereby removing threats of DNS-based attacks and improving the\n overall integrity and authenticity of information processed over the Internet.\n (http://georgewbush-whitehouse.archives.gov/omb/memoranda/fy2008/m08-23.pdf)\n\n\n\nwww.oig.dhs.gov 65 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n FIPS 112 \xe2\x80\x93 Password Usage\n A password is a sequence of characters that can be used for several authentication purposes.\n This standard identifies fundamental automated data processing management functions\n pertaining to passwords and specifies some user actions required to satisfy these functions. In\n addition, it specifies several technical features that may be implemented in an automated data\n processing system in order to support a password system. Those technical features desired by\n the automated data processing management should be specified in all procurement documents\n when acquiring new systems and provisions should be made to ensure that they are included\n when upgrading existing systems.\n (http://www.itl.nist.gov/fipspubs/fip112.htm)\n\n FIPS Publication 140-2 \xe2\x80\x93 Security Requirements for Cryptographic Modules\n The selective application of technological and related procedural safeguards is an important\n responsibility of every Federal organization in providing adequate security in its computer and\n telecommunication systems. This publication provides a standard that Federal organizations\n will use to specify that cryptographic-based security systems are to be used to protect sensitive\n or valuable data. Protection of a cryptographic module within a security system is necessary to\n maintain the confidentiality and integrity of the information protected by the module. This\n standard specifies the security requirements that will be satisfied by a cryptographic module\n and provides four increasing, qualitative levels of security intended to cover a wide range of\n potential applications and environments.65\n (http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf)\n\n FIPS Publication 197 \xe2\x80\x93 Advanced Encryption Standard (AES)\n The AES specifies a FIPS-approved cryptographic algorithm that can be used to protect\n electronic data. The AES algorithm is a symmetric block cipher that can encrypt (encipher) and\n decrypt (decipher) information. Encryption converts data to an unintelligible form called\n ciphertext; decrypting the ciphertext converts the data back into their original form, called\n plaintext.\n (http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf)\n\n FIPS Publication 199 \xe2\x80\x93 Standards for Security Categorization of Federal Information and\n Information Systems\n This publication addresses standards for categorizing information and information systems.\n Security categorization standards for information and information systems provide a common\n framework and understanding for expressing security that, for the Federal Government,\n promotes (1) effective management and oversight of information security programs, including\n\n 65\n A cryptographic module is the set of hardware, software, and/or firmware that implements FIPS-approved\n security functions (including cryptographic algorithms and key generation) and is contained within the\n cryptographic boundary. The cryptographic boundary is an explicitly defined continuous perimeter that\n establishes the physical bounds of a cryptographic module and contains all the hardware, software, and/or\n firmware components of a cryptographic module.\n\n\nwww.oig.dhs.gov 66 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n the coordination of information security efforts throughout the civilian, national security,\n emergency preparedness, homeland security, and law enforcement communities; and\n (2) consistent reporting to OMB and Congress on the adequacy and effectiveness of\n information security policies, procedures, and practices.\n (http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf)\n\n FIPS Publication 200 \xe2\x80\x93 Minimum Security Requirements for Federal Information and\n Information Systems\n FIPS Publication 200 specifies minimum security requirements for information and information\n systems supporting the executive agencies of the Federal Government and a risk-based process\n for selecting the security controls necessary to satisfy the minimum security requirements. This\n standard promotes the development, implementation, and operation of more secure\n information systems within the Federal Government by establishing minimum levels of due\n diligence for information security and facilitating a more consistent, comparable, and\n repeatable approach for selecting and specifying security controls for information systems that\n meet minimum security requirements.\n (http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf)\n\n FIPS Publication 201-1 \xe2\x80\x93 Personal Identity Verification of Federal Employees and Contractors\n (with Change Notice 1)\n This standard, issued in March 2006, specifies the architecture and technical requirements for a\n common ID standard for Federal employees and contractors. The overall goal is to achieve\n appropriate security assurance for multiple applications by efficiently verifying the claimed\n identity of individuals seeking physical access to federally controlled government facilities and\n electronic access to government information systems.\n (http://csrc.nist.gov/publications/fips/fips201-1/FIPS-201-1-chng1.pdf)\n\n Federal Information System Controls Audit Manual (FISCAM) (Revised)\n FISCAM presents a methodology for performing information system control audits of Federal\n and other government entities in accordance with generally accepted government auditing\n standards, where system controls are significant to the audit objectives. Developed by GAO\n with significant CIGIE input and revised in February 2009, this manual focuses on evaluating the\n effectiveness of general and application controls.\n (http://www.gao.gov/assets/80/77142.pdf)\n\n Guide to Securing Microsoft\xc2\xae Windows 2000 Active Directory\n Developed by NSA, this draft document provides AD security configuration guidance and\n recommendations. AD is the directory service used for Windows 2000 domain controllers.\n According to Microsoft, a directory is a source used to store information about objects, and a\n directory service includes both the information source and the services making the information\n available to users. In its simplest definition, AD is a hierarchical namespace of objects that is\n\n\n\nwww.oig.dhs.gov 67 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n tightly integrated with the DNS. AD holds information on objects stored in underlying domains\n and provides a method for safeguarding directory objects from unauthorized access.\n (http://www.nsa.gov/ia/_files/os/win2k/w2k_active_dir.pdf)\n\n Microsoft\xe2\x80\x99s Best Practice Guide for Securing Active Directory Installations\n This guide contains recommendations for protecting domain controllers against known threats,\n establishing administrative policies and practices to maintain network security, and protecting\n DNS servers from unauthorized updates. It also provides guidelines for maintaining AD security\n boundaries and securing AD administration, and procedures for enacting the\n recommendations. The scope of this guide is limited to recommendations for deploying and\n securing AD domain controllers.\n (http://technet.microsoft.com/en-us/library/cc773365(v=ws.10).aspx)\n\n Microsoft\xe2\x80\x99s Exchange Server 2003 Security Hardening Guide\n This guide is designed to provide essential information about how to harden an organization\xe2\x80\x99s\n Microsoft Exchange Server 2003 environment. In addition to practical, hands-on configuration\n recommendations, this guide includes strategies for combating spam, viruses, and other\n external threats to the Exchange 2003 messaging system.\n (http://technet.microsoft.com/en-us/library/aa997203(v=exchg.65).aspx)\n\n CIS Exchange Server 2003 Benchmark (Version 1.0)\n This CIS document provides security configuration guidance for Microsoft Exchange Server\n 2003. The CIS provides benchmarks, scoring tools, software, data, information, suggestions,\n ideas, and other services and materials from the CIS website or elsewhere as a public service to\n Internet users worldwide. Recommendations result from a consensus-building process that\n involves many security experts and are generally generic in nature.\n (http://www.nsa.gov/ia/_files/vtechrep/I333-TR-999-2005.pdf)\n\n Federal Identity Management Handbook (version 0.1)\n In December 2005, the General Services Administration issued this handbook as an\n implementation guide for government agency credentialing managers, their leadership, and\n other stakeholders in pursuing compliance with HSPD-12 and FIPS 201. While this handbook\n cites policies and standards, it is not a policy document. It is intended as a resource for agency\n implementers of HSPD-12.\n (http://www.hss.doe.gov/HSPD12/ficc/FederalIdentityManagementHandbook.pdf)\n\n\n\n\nwww.oig.dhs.gov 68 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n INCITS 256-2007 \xe2\x80\x93 RFID\n This standard, developed by the American National Standards Institute (ANSI), establishes a\n technical standard for a family of compatible RFID devices, specifically RFID devices operating in\n freely available international frequency bands at license-free power levels.66\n (http://www.webstore.ansi.org/RecordDetail.aspx?sku=ANSI+INCITS+256-2007)\n\n ISO/IEC 18000-1 \xe2\x80\x93 Radio Frequency Identification for Item Management (Revised)\n Given the growing use of RFID, from supply chain management to tracking packages to locating\n and identifying luggage, the International Organization for Standardization (ISO) 67 and the\n International Electrotechnical Commission (IEC) issued this revised standard to address RFID for\n item management.68 This document provides definitions for the generic architecture\n concepts that commonly require item ID within the logistics and supply chain. It also\n guides the parameters that are needed in any standardized air interface definition\xe2\x80\x94the\n communication that occurs between the RFID tag or device and the RFID reader. In addition,\n the document provides parameter definitions for communications protocols within a common\n framework for internationally usable frequencies for RFID, as well as reference information\n regarding relevant patents.\n (http://www.iso.org/iso/catalogue_detail?csnumber=46145)\n\n Recommendation ITU-T X.1500 \xe2\x80\x93 Cybersecurity Information Exchange Techniques (Draft)\n This International Telecommunication Union (ITU) recommendation describes techniques for\n exchanging cybersecurity information.69 These techniques can be used individually or in\n combinations, as desired or appropriate, to enhance cybersecurity through coherent,\n comprehensive, global, timely, and assured information exchange.\n (http://www.itu.int/ITU-T/recommendations/rec.aspx?id=11060)\n\n\n\n\n 66\n The ANSI oversees the creation, promulgation, and use of thousands of norms and guidelines that directly affect \n\n businesses in nearly every sector, from acoustical devices to construction equipment, from dairy and livestock \n\n production to energy distribution, and many more. \n\n 67\n The ISO is the world\xe2\x80\x99s largest developer of voluntary international standards for products, services, and good \n\n practice, helping to make industry more efficient and effective. \n\n 68\n The IEC is the world\xe2\x80\x99s leading organization that prepares and publishes international standards for all electrical, \n\n electronic, and related technologies.\n\n 69\n The ITU is the United Nations specialized agency for telecommunications, information, and communications \n\n technologies. The ITU-T is responsible for studying technical, operating, and tariff questions and issuing \n\n recommendations on them with a view of standardizing telecommunications on a worldwide basis. \n\n\n\nwww.oig.dhs.gov 69 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix B\n 2013 and Beyond Threat Landscape\n Today, cybersecurity is more than detecting a virus or worm. Today\xe2\x80\x99s world of cybersecurity\n consists of not only detecting complicated malware, but also detecting adversaries \xe2\x80\x93 insider\n and outsiders \xe2\x80\x93 determining what data left the organization, developing defensive and\n preemptive measures to keep the attacks from happening in the first place, and most\n importantly, managing risk-based compliance.\n\n Every attack on an organization begins with a single vulnerability \xe2\x80\x93 usually a hole in an\n application, an open port on a network, or a misconfigured device. Protecting data in a world\n where systems are changing rapidly, and information flows freely, requires a coordinated effort\n to secure these systems at the endpoint and gateway, on mobile devices, and in the cloud.\n Cyber criminals are increasingly using advanced methods to implement attack techniques\n (vectors) that are non-traceable and difficult to take down. The widespread use of mobile\n devices leads to an amplification of abuse based on knowledge/attack methods targeting social\n media; outages in telecommunications infrastructures impact a considerable number of users.\n The availability of malware and cyber hacking tools and services, together with digital\n currencies (e.g., Bitcoins) and anonymous payment services, is opening up new avenues for\n cyber fraud and criminal activity.\n\n Based on a number of industry research reports, below are the top types or \xe2\x80\x9cclasses\xe2\x80\x9d of system\n and cyber security threats with major impact for 2013 and beyond.70\n\n 1.\t Malware: Any malicious software, script, or code developed or used for the purpose of\n compromising or harming information assets without the owner\xe2\x80\x99s informed consent.\n Malware threats include the following: keyloggers/form grabbers/spyware, sending data to\n external site/entity, exploitation of backdoors, disabling or interfering with security controls\n or system/network utilities, initiating brute force or dictionary attacks, RAM scraper,\n capturing data resident on system, exploitation of command and control channels/servers,\n downloading/installing additional malware or updates, and redirecting to another\n site/address.\n\n SQL injection, cross-site scripting, and unauthorized remote access are attackers\xe2\x80\x99 favored\n methods of stealing data and depositing malware.71 However, there has been a shift to\n\n 70\n This list of threat classes is based on the following industry research and reports: ThreatfLandscape,fMid-Yearf\n 2013 (ENISA, September 2013), InternetfSecurityfReportf\xe2\x80\x93f2013 (Symantec, April 2013), 2013fDatafBreachf\n InvestigationsfReport (Verizon, April 2013), ThefBiggestfCybersecurityfThreatsfoff2013 (Forbes, December 2012),\n SecurityfThreatfReportf2013 (Sophos, December 2012), 2013fWebsitefSecurityfReport (WhiteHat webinar, April\n 2013), and SecurityfThreatsftofBusiness,fthefDigitalfLifestyle,fandfthefCloud (Trend Micro, December 2012).\n 71\n Cross-site scripting is a type of computer security vulnerability typically found in Web applications.\n\n\nwww.oig.dhs.gov 70\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n malicious Uniform Resource Locators (URL) as the preferred means to distribute malware.72\n An advantage of URLs as a distribution mechanism lies in the fact that URLs are not an easy\n target for law enforcement takedowns.\n\n With such a high proportion of command and control servers, the U.S. is subject to the\n highest rate of malware attacks.73 This is most likely due to a very high concentration of\n intellectual property and digitized data that resides in the U.S. Anytime attackers who wish\n to launch a denial-of-service attack can send special commands to their botnets.74\n Command and control servers with instructions to perform an attack on a particular target,\n and any infected machines communicating with the contacted command and control server\n will comply by launching a coordinated attack. Additionally, as attackers continue to\n improve their techniques, they have developed precision-targeted malware that is more\n dedicated so that it only attacks computers with a specific configuration.\n\n 2.\t Hacking: All attempts to intentionally access or harm information assets without\n authorization or in excess of authorization by thwarting logical security mechanisms. A\n hacker is an expert computer programmer, or a person who breaks into computers or\n networks; hackers seek and exploit weaknesses in a computer system or computer network\n and gain unauthorized access to the data on that system or network.\n\n Hacking is usually conducted remotely, allowing attackers the benefits of anonymity and\n scalability; automated tools and basic scripting, often written by someone else and made\n available to attackers, make many varieties of hacking extremely easy to conduct, and allow\n for attacks against multitudes of potential victims. Forms of hacking include: exploitation\n of default or guessable credentials, use of stolen login credentials, brute force and\n dictionary attacks, exploitation of backdoor or command and control channels, exploitation\n of insufficient system authentication (e.g., no login required), SQL injection, remote file\n inclusion, and abuse of functionality. In addition, the exploitation of zero-day vulnerabilities\n and drive-by Web attacks are on the rise.75\n\n\n\n 72\n A URL is an Internet address, identifying the location of a file on the Internet, consisting of the protocol, the\n computer on which a file is located, and a file\'s location on a specific computer.\n 73\n Command and control servers are centralized machines that are able to send commands and receive outputs of\n machines as part of a botnet.\n 74\n A botnet is a collection of Internet -connected programs communicating with other similar programs in order to\n perform tasks.\n 75\n A zero-day vulnerability is one that was previously unknown in a computer application. A zero-day attack or\n threat is one that exploits the previously unknown vulnerability, meaning that the attack occurs on "day zero" of\n awareness of the vulnerability. It also means that developers have had zero days to address and patch the\n vulnerability. Zero-day exploits (the software and/or strategies that use a security hole to carry out a successful\n attack) are used or shared by attackers before the developer of the targeted software knows about the\n vulnerability.\n\n\nwww.oig.dhs.gov 71\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 3.\t Social Engineering/Social Tactics: Deception, manipulation, and intimidation, and savvy\n threat agents know how to use this to their advantage. Social networks, including Facebook\n and LinkedIn, are about connecting people, and a convincing-looking profile of a company\n or person followed by a friend or connection request can be enough to get a social\n engineering scam rolling. These threats include: pretexting (classic social engineering),\n solicitation/bribery, various phishing techniques (or any type of *ishing), and elicitation\n (subtle extraction of information through conversation).\n\n 4.\t Misuse: Use of entrusted organizational resources or privileges for any purpose or in a\n manner contrary to that which was intended. These actions can be malicious or non-\n malicious in nature. They include: embezzlement, skimming, and related fraud, use of\n unapproved hardware/devices, abuse of system access/privileges, misappropriation of\n private knowledge, and inappropriate web/Internet usage.\n\n 5.\t Advanced Persistent Threats/Targeted Attacks: Threats that are highly sophisticated and\n carefully constructed. The intention behind the attacks is to gain access to a network and\n steal information quietly. They take a low-and-slow approach that often makes them\n difficult to detect, giving them a high likelihood of success.\n\n An advanced persistent threat is really is a team of skilled hackers that have been given a\n target and work day and night to penetrate that account. Several of these types of threats\n are supported by their military (like China and Iran), which is essentially industrial espionage\n by nation-states, go after both civilian and military targets.\n\n In first half of 2013, targeted attacks demonstrated their effectiveness in achieving their\n objectives. The biggest innovation in targeted attacks was the emergence of watering hole\n attacks, which involve compromising a legitimate website that a targeted individual might\n visit and using it to install malware on their computer.\n\n Cyber espionage attacks, in particular, reached a dimension that went far beyond\n expectations. The proliferation of mobile devices delivers a wide exploitation surface for\n these kinds of threats. Toolkits exist for creating a variety of malware and for attacking\n websites. Mobile spyware applications might become strong tools for advanced persistent\n threats targeting bring-your-own-device environments.\n\n 6.\t Bring-Your-Own-Device Trend: Users are increasingly using their devices as they would\n their personal computers, and by doing so are opening themselves up to web-based attacks\n the same as they would if they were operating a desktop computer. All this means is that\n the flood of iPhones, Google Android phones and other devices making their way into the\n workplace are opening up another potential gateway for attackers that needs to be\n secured. For attackers, it is likely as well that there will be more attempts to circumvent the\n\n\n\nwww.oig.dhs.gov 72\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n application review and detection mechanisms mobile vendors use to guard their application\n markets.\n\n 7.\t Cloud Computing: With more organizations putting more information in public cloud\n services, those services become large targets, and can represent a single point of failure for\n the enterprise. Security must continue to be an important part of the conversation with\n cloud providers, and the needs of the business should be made clear.\n\n 8.\t Code Injection: The exploitation of a computer bug that is caused by processing invalid\n data. Code injection can be used by an attacker to introduce (or "inject") code into a\n computer program to change the course of execution. A notable issue with regard to this\n threat is attacks against popular Content Management Systems.76 Due to their wide use,\n popular sites make up a considerable attack surface that has drawn the attention of cyber\n criminals. Cloud service provider networks are used increasingly to host tools for\n automated attacks, thus implementing an important step in code injection attack vectors.\n\n 9.\t HTML 5: HTML 5\'s cross-platform support and integration of various technologies opens up\n new possibilities for attack, such as abusing Web Worker functionality. Even with an\n increasing amount of attention being paid to HTML 5 security, the newness of it means that\n developers are bound to make mistakes as they use it, and attackers will look to take\n advantage. So, there may be a surge in HTML 5 oriented attacks in 2013, then followed by a\n gradual decline as security improves over time.\n\n 10. Botnets: Although there is a shift to URLs for malware infection (see malware section),\n there are developments with regard to this threat. For example, there is increased use of\n peer-to-peer botnets. Such botnets are difficult to locate and take down. Botnets have\n high availability and are widely distributed.\n\n It is easy is to create botnet infrastructures by misusing weaknesses in the security of\n massively deployed devices. Browser-based botnets are another example on how easy is to\n create a very large botnet infrastructure. Browser-based attacks still remain the most\n reported threats, whereas Java remains the most exploited software for the materialization\n of this threat.77\n\n 11. DNS Reflection Attacks: Also known as DNS amplification attacks, these are a type of\n distributed denial-of-service attacks that take advantage of the fact that a small DNS query\n can generate a much larger response. When combined with source address spoofing, an\n attacker can direct a large volume of network traffic to a target system by initiating\n\n 76\n A content management system is a system used to manage the content of a website; it is a computer program\n\n that allows publishing, editing, modifying, and maintenance of content from a central interface.\n\n 77\n As of August 22, 2013, research shows that Java was the most targeted endpoint technology for cyber attacks. \n\n\n\nwww.oig.dhs.gov 73\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n relatively small DNS queries. Attackers seem to have adopted the DNS reflection technique\n to launch amplification attacks, an old technique that has made a come-back.\n\n 12. Identity Theft: This threat led to some of the most successful attacks by abusing Short\n Message Service (SMS) forwarders to achieve significant financial fraud.78 These attacks\n were based on known financial trojans (e.g., Zeus, SpyEye, Citadel) that have been\n implemented on mobile platforms and attack two-factor authentication. A significant\n source for applying this threat remains social media. It is worth mentioning that an increase\n in malicious browser extensions has been registered, aimed at taking over social network\n accounts.\n\n 13. Search Engine Poisoning: Exploits the use of search engines (i.e., Google, Yahoo, Bing) to\n spread malware and viruses. As with many other threats, search engine poisoning has gone\n mobile; there are some reports of malicious mobile applications performing search engine\n functions. Search engine optimization poisoning attacks have been identified primarily on\n popular websites using cross-site scripting or cross-server scripting.\n\n 14. Malvertising: Malvertising means that legitimate websites can be impacted without being\n compromised. It opens an avenue of attack that hackers can use to compromise a website\n without having to directly hack the website itself. Using malicious advertisements,\n attackers silently infect users, often by installing dynamically created malware that antivirus\n programs alone are unable to detect.\n\n\n\n\n 78\n SMS is a text messaging service component of phone, Web, or mobile communication systems. SMS forward is\n an application that allows an individual to send a notification of a received or missed call to a specified phone or\n e-mail.\n\n\nwww.oig.dhs.gov 74 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix C\n Sample ROE79\n\n\n\n Audit of X\n\n\n Job Code\n\n\n Date\n\n\n\n\n Agency Logo\n\n\n\n\n\n Rules of Engagement \n\n\n\n\n Agency Name\n Office of Inspector General\n City/State/Zip Code\n\n 79\n All bolded wording in this appendix should appropriately be completed by the representative OIG. References\n to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body. The source of this ROE is DHS OIG.\n\n\nwww.oig.dhs.gov 75 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Table of Contents\n\n 1.0 Background and Objective X\n\n 2.0 Methodology X\n\n 3.0 Scope X\n\n 4.0 Type of Scans X\n\n 4.1 Any Additional Type of Scans X\n\n 4.2 X Penetration Testing Objective X\n\n 5.0 General Rules of Engagement X\n\n 6.0 Documentation Guidelines X\n\n 7.0 Confidentiality and Data Security X\n\n 8.0 Dispute Resolution X\n\n 9.0 Approval X\n\n\n Appendix A \xe2\x80\x93 Agency Sites Where Testing Will Be Performed X\n\n Appendix B \xe2\x80\x93 Termination of Testing Memorandum X\n\n Agency OIG X\n\n Agency Management X\n\n Appendix C \xe2\x80\x93 List of Security Testing Tools Available for the OIG\xe2\x80\x99s Use X\n\n\n\n\n\nwww.oig.dhs.gov 76 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 1.0 Background and Objective\n\n The agency, Office of Inspector General (OIG), has initiated an audit of the agency\xe2\x80\x99s\n computers/networks/devices. As part of this audit, we will perform testing to ensure X is\n adequately protected. Security testing is an important element in evaluating information\n technology (IT) security controls because it helps determine whether those controls have been\n implemented and are operating as intended.\n\n The overall objective of this security testing is to determine X according to agency guidelines\n and requirements. This Rules of Engagement (ROE) document outlines the specific plans and\n testing efforts for the evaluation. This ROE contains information on the OIG\xe2\x80\x99s information\n security testing methodology and identifies steps that the OIG and the agency will take to\n minimize the risk of disrupting operations during testing. Specifically:\n\n \xe2\x80\xa2\t The OIG will make every reasonable effort to limit the operational impact of testing.\n \xe2\x80\xa2\t The agency should make every reasonable effort to facilitate the testing to help ensure the\n timely completion of the review.\n \xe2\x80\xa2\t The OIG and the agency will comply with this ROE to ensure minimal impact on the agency\n operations and business activities.\n\n 2.0 Methodology\n\n We will use software tools to perform security controls testing by connecting a testing\n computer to the agency network. The software tools will collect data from selected agency\n computers/networks/devices and the data will be analyzed to determine system\n vulnerabilities, security patch installation, and configuration settings. Settings for individual\n software testing tools will be provided to the agency upon request.\n\n The agency should note that firewalls, intrusion prevention systems, disabled remote registry\n services, and host-based security can prevent scans from completing. A testing location will be\n selected to minimize the impact of these security controls while still providing full access to the\n agency\xe2\x80\x99s computers/networks/devices located on the network under review. If adequate\n network access cannot be resolved from the designated testing location, the agency will\n provide direct access for local testing of the agency\xe2\x80\x99s computers/networks/devices.\n\n Staff from the OIG will perform all testing. All personnel and technical specialists assigned to\n the audit hold relevant security clearances. Testing will be performed using software tools.\n Information on testing tools can be found in Appendix C.\n\n\n\n\nwww.oig.dhs.gov 77\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 3.0 Scope\n\n The general scope of the testing may include selected agency computers/networks/devices\n that process or contain sensitive information. Domain and root-level administrative access is\n needed to perform the testing.\n\n 4.0 Type of Scans\n\n The OIG will evaluate selected agency computers/networks/devices for adherence to X\n requirements. X (testing tool) will be used to perform these X (type of scans). More\n information on the testing tools to be used can be found in Appendix C.\n\n 4.1 Any Additional Type(s) of Scans\n\n The OIG will use X (testing tool) to determine X. In addition, these scans will be used to identify\n X. \tMore information on this tool can be found in Appendix C.\n\n 4.2 X Penetration Testing Objective\n\n Upon the discovery of significant or multiple vulnerabilities, the OIG will use X (testing tool)\n to identify and isolate specific exploits that could put systems and data at risk. Testing will\n be performed on singular agency computers/networks/devices only. More information on\n this tool can be found in Appendix C.\n\n 5.0 General Rules of Engagement\n\n 1.\t This ROE document is compulsory and will not be departed from without first obtaining\n written concurrence from the OIG and an authorized representative from the agency\xe2\x80\x99s\n Office of the Chief Information Officer (OCIO).\n\n 2.\t Scans may only be postponed or suspended as directed by OIG or agency\xe2\x80\x99s ROE signatory\n official. Such termination and justification will be documented in accordance with\n Appendix B of this ROE. In the event that testing causes a service outage, the agency\n monitor may alert the agency Chief Information Security Officer (CISO) or its designated\n representative to suspend testing.\n\n 3.\t Personnel from the agency and other applicable IT or security personnel are encouraged to\n observe the OIG\xe2\x80\x99s testing.\n\n 4.\t The agency is responsible for ensuring that system backups have been performed prior to\n the start of the security testing and that recovery procedures are in place should an\n inadvertent outage require system restoration.\n\n\nwww.oig.dhs.gov 78\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 5.\t Prior to commencing the scans, the agency will appoint an authorized representative to act\n as \xe2\x80\x9cmonitor\xe2\x80\x9d of the OIG\xe2\x80\x99s activities. The monitor will be the agency\xe2\x80\x99s primary point of\n contact for the OIG team during the testing. The OIG team will rely on the monitor to\n answer any questions concerning systems and related IT devices, give final authorization to\n test any vulnerabilities discovered on agency computers/networks/devices, and provide\n any additional information needed on unanticipated factors affecting the audit that may\n arise during the testing.\n\n 6.\t The monitor(s) for the testing are:\n\n Name Phone number(s) Email address\n\n\n\n\n 7.\t The OIG\xe2\x80\x99s testing will be conducted at the agency facilities identified in Appendix A.\n\n 8.\t The OIG will conduct testing on the dates and at the times specified and agreed to by the\n parties. The dates and times will be closely coordinated with the agency. The monitor will\n coordinate and ensure, as appropriate, the involvement of agency officials and adherence\n to applicable agency policies and standard operating procedures that could have an impact\n on the scan activities and the information systems being tested.\n\n 9.\t The OIG will perform testing using OIG-owned laptop computers. Under no circumstances\n will OIG-owned equipment be relinquished from the control of OIG for any reason. The\n agency may scan the OIG testing laptop for vulnerabilities prior to network connection to\n verify operating system and software patch status.\n\n 10. The agency will provide office workspace with AC power and at least one internal network\n drop at the identified facility. In accordance with the testing methodology, after obtaining a\n network connection and other information about the agency\xe2\x80\x99s internal IT environment, the\n OIG team will begin testing.\n\n 11. The OIG will require administrator access to the systems being tested. \tAdministrator access\n will be provided by (1) the agency establishing a separate administrator account for testing\n (e.g., IGTest), or (2) through the use, under the agency\xe2\x80\x99s supervision and control, of an\n existing administrator account. If possible, any separate testing accounts will be established\n prior to the arrival of the OIG team to the testing site.\n\n 12. Under no circumstances will the OIG testers modify any system configuration without prior\n written consent from the agency\xe2\x80\x99s OCIO.\n\n\n\nwww.oig.dhs.gov 79\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 13. If the OIG team inadvertently views user files or any other data contained in the agency\xe2\x80\x99s IT\n environment that are part of a government agency system of records on individuals, this\n information will be kept confidential in a manner consistent with the Privacy Act (5 U.S.C.\n \xc2\xa7552a) and any other applicable agency regulations.\n\n 14. To avoid disruption to agency IT operations, in addition to the above precautions, the OIG\n team will:\n\n A.\t Ensure that agency or system personnel identify potentially sensitive devices prior\n to testing.\n B.\t Keep a journal of comments in text and screen-shots documenting the OIG\xe2\x80\x99s\n activities and times during the testing.\n C.\t Only disseminate discoveries to the authorized representative(s) of the OIG and the\n agency.\n\n 15. During testing, audit logs will be used to monitor the testers\xe2\x80\x99 activities.\n\n 6.0 Documentation Guidelines\n\n The OIG will provide the agency with an exit briefing of the assessment activities.\n\n 7.0 Confidentiality and Data Security\n\n All audit evidence collected by the OIG will be held at the OIG facility at X (OIG office location).\n The OIG will not disclose any information related to this testing to any unauthorized parties.\n\n 8.0 Dispute Resolution\n\n In the event disagreement(s) should arise between the agency and OIG during testing, the\n following individuals will determine the final resolution:\n\n \xef\xbf\xbd OIG \xe2\x80\x93 Name and title\n \xef\xbf\xbd Agency \xe2\x80\x93 Name and title\n\n\n\n\nwww.oig.dhs.gov 80\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 9.0 Approval \n\n\n\n\n Signature:\n ____________________________________________________ _______________________\n Date\n Name\n Title\n Agency, OIG\n\n\n\n Signature:\n ____________________________________________________ _______________________\n Date\n Name\n Title\n Agency\n\n\n\n\nwww.oig.dhs.gov 81 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix A \xe2\x80\x93 Agency Sites Where Testing Will Be Performed \n\n\n List of sites to be visited for agency computers/networks/devices testing: \n\n\n Site Name Address Agency Monitor\n\n\n\n\nwww.oig.dhs.gov 82 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix B \xe2\x80\x93 Termination of Testing Memorandum\n\n This memorandum will establish an understanding between the agency and the OIG to ensure\n that all parties are in agreement on the conditions that may exist and result in the termination\n of this security testing effort.\n\n The OIG test team will notify the designated agency monitor if a significant event should occur\n during testing that results in the test team or the client desiring a termination of the testing.\n The monitor should have the knowledge and understanding of the significant events that would\n lead the agency to direct the OIG to terminate the testing.\n\n The reason for the termination must be documented below. The signatures indicate agreement\n by all parties on the reason for termination of the testing.\n\n Reason for termination of testing:\n\n\n\n\n Agency OIG\n\n Signature:\n ____________________________________________________ __________\n Date\n Name and Title:\n _______________________________________________\n\n\n Agency Management/CIO\n\n Signature:\n ____________________________________________________ __________\n Date\n Name and Title:\n _______________________________________________\n\n\n\n\nwww.oig.dhs.gov 83 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix C \xe2\x80\x93 List of Security Testing Tools Available for the OIG\xe2\x80\x99s Use\n\n List testing tools to be used and brief description.80\n\n\n\n\n 80\n Appendix C of this guide lists the testing tools used within the OIG community and provides brief descriptions of\n each.\n\n\nwww.oig.dhs.gov 84 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix D\n Vulnerability Scanning and Penetration Testing Tools\n Below is a list of vulnerability scanning, penetration testing, and system security software tools\n that are used by the OIG Community.81 The actual use of the tools will be coordinated with the\n audit team and site personnel to determine the most appropriate tool for the platform\n assessed. This list does not represent all of the tools available for use, since such tools and\n scripts frequently change.\n\n Acunetix\n Acunetix Web Vulnerability Scanner automatically checks an organization\xe2\x80\x99s web applications for\n Structured Query Language (SQL) Injection, cross-site scripting, and other web vulnerabilities.\n\n Aircrack-ng\n Aircrack-ng is a set of tools for auditing wireless networks. Aircrack-ng is an 802.11 Wired\n Equivalent Privacy (WEP) and Wi-Fi Protected Access-Pre-shared key-cracking program that can\n recover keys once enough data packets have been captured. It implements the standard\n Fluhrer-Mantin-Shamir attack along with some optimizations like KoreK attacks82, as well as the\n new PTW attack, thus making the attack much faster than other WEP cracking tools.83\n\n AirMagnet\n Fluke Networks\xe2\x80\x99 AirMagnet delivers a complete solution portfolio to ensure security,\n performance, and compliance of wireless networks to mitigate any issue that threatens an\n organization\xe2\x80\x99s business. Fluke Networks delivers the most accurate solutions for designing,\n deploying, and optimizing 802.11 a/b/g/n WLANs for maximized performance, security, and\n compliance. Expert planning and design tools ensure that the wireless network is built to\n accommodate the highest capacity of users, meet the needs of demanding wireless\n applications, and perform optimally in the most challenging environments. The AirMagnet\n Enterprise system provides complete visibility and control of the entire wireless environment,\n automatically remediating threats and vulnerabilities, proactively alerting on performance\n problems, and providing detailed compliance reports for regulatory standards such as those for\n the Payment Card Industry and the Health Insurance Portability and Accountability Act.\n\n\n\n\n 81\n This list of licensed vulnerability scanning, penetration testing, and system security software tools used by the \n\n OIG Community was obtained from the CIGIE IT Committee report entitled \xe2\x80\x9cSurvey of Vulnerability and \n\n Penetration Testing Usage within the Office of Inspector General Community,\xe2\x80\x9d and DHS OIG. \n\n 82\n A KoreK WEP attack is a statistical cracking method for the recovery of a WEP Key.\n\n 83\n A \xe2\x80\x9cPTW\xe2\x80\x9d attack decreases the number of initialization vectors needed to decrypt a WEP key.\n\n\n\nwww.oig.dhs.gov 85 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n AppDetective\n AppDetective, developed by Application Security, Inc., is a network-based vulnerability\n assessment scanner that locates and assesses the security strength of major applications such\n as web servers and databases for vulnerabilities. AppDetective will also recommend steps for\n mitigation.\n\n AppScan\n IBM Security AppScan (formerly IBM Rational AppScan) delivers application vulnerability testing\n and management across the application life cycle for web and mobile apps, including dynamic\n application security testing and static application security testing, as well as innovative\n technologies like glass-box testing and run-time analysis that keep up with the latest threats\n and drive precise, actionable results. AppScan is intended to test web applications for security\n vulnerabilities during the development process, when it is least expensive to fix such problems.\n\n Burp Suite\n Burp Suite is an integrated platform for attacking web applications. Burp Suite allows an\n organization to combine manual and automated techniques to enumerate, analyze, scan,\n attack, and exploit web applications.\n\n Cain & Abel\n Cain & Abel is a password recovery utility that allows easy recovery of various kinds of\n passwords by sniffing the network; cracking encrypted passwords using dictionary, brute-force,\n and cryptanalysis attacks; recording voice over IP conversations; decoding scrambled\n passwords; revealing password boxes; uncovering cached passwords; and analyzing routing\n protocols.\n\n Cain & Abel is made of two major components: Cain is the front-end application that recovers\n passwords and the password sniffing part; Abel is a Windows NT service that must be installed\n (locally or remotely) and has the role of scrambling the traffic inside the network, for additional\n protection.\n\n The program does not exploit any software vulnerabilities or bugs that could not be fixed with\n little effort. It covers some security aspects/weakness present in the protocol\'s standards,\n authentication methods, and caching mechanisms; its main purpose is the simplified recovery\n of passwords and credentials from various sources. However, it also ships some\n "non-standard" utilities for Microsoft Windows users.\n\n Cisco Configuration Assurance Solution 2.0\n This product automatically performs regular, systematic audits of the production IP network\n configuration to diagnose device misconfigurations, policy violations, inefficiencies, and security\n gaps. It uses a high-fidelity software model of the network infrastructure, accurately simulating\n the behavior of routers, switches, and protocols, to enable a broad scope of analyses. These\n\n\nwww.oig.dhs.gov 86 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n analyses include network configuration and security baseline and postchange audit and analysis\n functions that are critical to a successful network configuration and change management\n strategy.\n\n Cisco Security Auditor\n Cisco Security Auditor software enables customers to cost-effectively audit their network\n infrastructure against corporate security policies and industry best practices.84 Cisco Security\n Auditor focuses specifically on the problem of determining whether Cisco network devices have\n been configured in accordance with defined security policies. The software is built on a scalable\n and flexible auditing framework that allows auditing on a large number and variety of Cisco\n network devices and allows users to select from a wide range of pre-defined best practice\n policies, customize those policies, and audit the network for compliance to those policies.85\n\n Cisco Password Scanner\n Cisco Scanner is a public domain program that can scan a range of IP addresses to find Cisco\n routers that have not changed the default password.\n\n CiscoWorks Network Compliance Manager\n CiscoWorks Network Compliance Manager tracks and regulates configuration and software\n changes throughout your multivendor network infrastructure (including routers, switches,\n firewalls, load balancers, and wireless access points), improves visibility into network changes,\n and tracks compliance with a broad variety of regulatory, IT, agency governance, and\n technology best practices.\n\n Core Impact\n Core Impact, developed by Core Security Technologies, is a security testing software suite that\n identifies weaknesses and allows exploitation of an enterprise network through a range of\n attack vectors, including endpoint systems, networks, email users, and web applications. It\n allows the user to simulate multi-staged attacks to test both perimeter and internal defenses\n using privilege escalation and pivoting techniques to identify available routes to valuable\n systems and data.\n\n Core Impact Pro\n Core Impact Pro is a commercial-grade, automated penetration security testing software\n solution designed to allow organizations of all sizes to conduct comprehensive penetration\n testing across their infrastructure and applications.\n\n\n\n 84\n Note that this product is currently in \xe2\x80\x9cmaintenance mode\xe2\x80\x9d with no further releases planned. \n\n 85\n Cisco Security Auditor server is supported on Microsoft Windows 2000 and 2003 and Sun Solaris 8 and 9. The \n\n Cisco Security Auditor client is web browser-based and supported on Windows, using Internet Explorer 6.0 or \n\n Netscape Navigator 7.1.\n\n\n\nwww.oig.dhs.gov 87 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Cryptcat\n Cryptcat is a lightweight version of Netcat with integrated transport encryption capabilities.\n\n DirBuster\n DirBuster is a multithreaded Java application designed to brute force directories and file names\n on web/application servers.\n\n Dnsmap\n Dnsmap is a passive network mapper and normally known as subdomain brute forcer. Dnsmap\n turns DNS Mapping on or off. Originally released on 2006, it was used by penetration testers\n during the information gathering/enumeration phase of infrastructure security assessments.\n After identifying a target company\'s IP netblocks, domain names, phone numbers, and the like,\n the tool enables the discovery of all subdomains associated to a given domain. For example,\n from google.com, it is possible to discover mail.google.com, earth.google.com,\n sketchup.google.com, desktop.google.com, and so on. Subdomain brute-forcing is another\n technique that should be used in the enumeration stage, as it is especially useful when other\n domain enumeration techniques such as zone transfers do not work.\n\n Enum\n Enum unifies traditional telephony and next-generation IP networks, and provides a critical\n framework for mapping and processing diverse network addresses. It transforms the telephone\n number\xe2\x80\x94the most basic and commonly used communications address\xe2\x80\x94into a universal\n identifier that can be used across many different devices and applications (voice, fax, mobile,\n E-mail, text messaging, location-based services, and the Internet).\n\n Ettercap\n Ettercap is a comprehensive suite for man-in-the-middle attacks. It features sniffing of live\n connections, content filtering on the fly, and many other tricks. It supports active and passive\n dissection of many protocols and includes many features for network and host analysis.\n\n Fierce\n Fierce domain scan is a reconnaissance tool. Fierce is a practical extraction and report language\n script that quickly scans domains (usually in just a few minutes, assuming no network lag) using\n several tactics. Fierce is not an IP scanner. When IP ranges are nowhere near one another,\n huge chunks of networks can be missed with an IP scanner. Fierce is meant specifically to\n locate likely targets both inside and outside an organization\xe2\x80\x99s network. Only those targets are\n listed (unless the -nopattern switch is used). No exploitation is performed (unless you do\n something intentionally malicious with the\n -connect switch).\n\n\n\n\nwww.oig.dhs.gov 88 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n FirePAC\n Athena\xe2\x80\x99s FirePAC automates the optimization and clean-up of firewall configurations. Rule\n dependencies are analyzed, redundant rules are removed, and most used rules are placed in an\n optimized rule order. Because analysis is performed off-line, no direct connection to an\n organization\xe2\x80\x99s firewall is required and what/if modeling can be undertaken without posing any\n risk to perimeter or internal security, or network availability. The risks posed by dangerous\n firewall rules represent a critical vulnerability to an organization\xe2\x80\x99s overall security.\n\n Firewalk\n Firewalking is a technique that employs trace route-like techniques to analyze IP packet\n responses to determine gateway access control list filters and map networks. The Firewalk tool\n employs the technique to determine the filter rules in place on a packet forwarding device.\n\n GFI LanguardTM\n GFI Languard is a network security and vulnerability scanner that gives an organization the\n capability to perform multi-platform scans (Windows, Mac Operating System, and Linux) across\n all environments, including virtual machines, to analyze the organization\xe2\x80\x99s network security\n setup and status. GFI Languard scans computers, as well as a number of network devices such\n as printers, routers, and switches; identifies and categorizes security vulnerabilities;\n recommends a course of action; and provides tools that can be used to resolve problems. The\n scanning software integrates with more than 2,500 critical security applications in the following\n categories: antivirus, anti-spyware, firewall, anti-phishing, backup client, VPN client, patch\n management, web browser, instant messaging, peer-to-peer, disk encryption, data loss\n prevention, and device access control. GFI Languard\xe2\x80\x99s network auditing capability gives a\n comprehensive view of an organization\xe2\x80\x99s network: what USB devices are connected, what\n software is installed, any open shares, open ports and weak passwords in use, and hardware\n information.\n\n John the Ripper\n John the Ripper is a fast password cracker, currently available for many distributions of UNIX,\n Windows, Disk Operating System, BeOS, and OpenVMS. Its primary purpose is to detect weak\n UNIX passwords. Besides several crypt(3) password hash types most commonly associated with\n various UNIX systems, supported out of the box are Windows LM hashes, plus lots of other\n hashes and ciphers in the community-enhanced version.\n\n Kismet\n Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system.\n Kismet will work with any wireless card that supports raw monitoring (rfmon) mode, and (with\n appropriate hardware) can sniff 802.11b, 802.11a, 802.11g, and 802.11n traffic. Kismet also\n supports plug-ins that allow sniffing other media. Kismet identifies networks by passively\n collecting packets and detecting standard named networks, detecting (and given time,\n\n\n\nwww.oig.dhs.gov 89 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n decloaking) hidden networks, and inferring the presence of nonbeaconing networks via data\n traffic.\n\n LANScanner\n LANScanner is designed for searching local network for files (i.e., movies, music, documents).\n While scanning, the program memorizes the network\'s structure. Using a multithreading\n technique, searching operations are much faster. Features include IP ranges\n (inclusion/exclusion), network neighborhood scanning, file/folder download, download\n resumption after connection break, saving search results as text or Hypertext Markup Language\n (HTML) file, skipping selected shares (floppy drives), folders exploration, and advanced search\n options.\n\n LSADump\n LSADump is an application that is used to gather Windows password hashes from computers\n running Windows.\n\n Maltego\n Maltego is an open source intelligence and forensics application. Maltego is a unique platform\n developed to deliver a clear threat picture to the environment that an organization owns and\n operates. Maltego\xe2\x80\x99s unique advantage is to demonstrate the complexity and severity of single\n points of failure as well as trust relationships that exist within the scope of your infrastructure.\n The unique perspective that Maltego offers to both network- and resource-based entities is the\n aggregation of information posted all over the Internet. Whether it is the current configuration\n of a router poised on the edge of your network or the current whereabouts of your\n vice-president on his international visits, Maltego can locate, aggregate, and visualize this\n information.\n\n Metasploit\xc2\xae\n A collaboration of the open source community and Rapid7, Metasploit software helps security\n and IT professionals identify security issues, verify vulnerability mitigations, and manage\n expert-driven security assessments. The software also helps security and IT professionals\n prevent data breaches by efficiently conducting broad-scope penetration tests, prioritizing\n vulnerabilities, and verifying controls and mitigations.\n\n Microsoft Baseline Security Analyzer\n Microsoft Baseline Security Analyzer is a free scanning tool that provides a streamlined method\n to identify missing security updates and common security misconfigurations within Microsoft\n Windows, Windows components (i.e., Internet Explorer), and other Microsoft products. To\n assess the security state of an organization\xe2\x80\x99s Windows machines, the Analyzer includes 64-bit\n installation, security update and vulnerability assessment checks, and support for the latest\n Windows Update Agent and Microsoft Update technologies. Microsoft Baseline Security\n Analyzer will not scan or report missing non-security updates, tools, or drivers.\n\n\nwww.oig.dhs.gov 90 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n ModemScan\n ModemScan is a graphical user interface for Microsoft Windows software, which facilitates the\n auditing and discovery of modems and fax machines. This type of software is commonly\n referred to as a wardialer or war dialer.86\n\n Nbtdump\n Nbtdump lists NetBIOS information from Windows and *NIX Samba servers such as shares, user\n accounts with comments, and the password policy.\n\n Nbtenum\n Nbtenum is a command prompt Win32 information enumeration utility. Using null sessions,\n Nbtenum can retrieve user lists, machine lists, share lists, name lists, group and member lists,\n and password and local security authority policy information. This tool is used at the command\n prompt and the output is an HTML file.\n\n Nessus (Professional Feed)\n Tenable Network Security\xe2\x80\x99s Nessus performs network vulnerability assessment scans to identify\n hosts and selected vulnerabilities at operating system and application levels for a pre-defined\n range of IP addresses. Commercial organizations that use the Tenable Nessus vulnerability\n scanner must purchase a Professional Feed subscription to scan their network, obtain support,\n receive updates to their database of vulnerability checks, and perform compliance auditing.\n Subscribers to the professional feed receive immediate access to:\n\n \xe2\x80\xa2\t The newest Tenable Nessus plug-ins as soon as they are released.\n \xe2\x80\xa2\t Perform an unlimited amount of complete Payment Card Industry Data Security Standard\n compliance audits.\n \xe2\x80\xa2\t Perform web application audits of custom and embedded applications to test for cross-site\n scripting, SQL injection, and more.\n \xe2\x80\xa2\t Conduct application, router, and SQL database configuration audits against CERT, CIS, DISA\n STIGs, Gramm\xe2\x80\x93Leach\xe2\x80\x93Bliley Act, Health Insurance Portability and Accountability Act, NIST\n Security Content Automation Protocol, Federal Desktop Core Configuration, NSA, and\n Payment Card Industry standards.87\n \xe2\x80\xa2\t Conduct content audits such as adult content, personally identifiable information (credit\n cards, Social Security numbers, etc.) in corporate spreadsheets, and more.\n \xe2\x80\xa2\t Security Content Automation Protocol vulnerability checks to detect and audit control\n system devices.\n\n\n 86\n Wardialing (also known as telephone scanning or war dialing) is the practice of dialing all the phone numbers in a\n range in order to find those that will answer with modem or fax tones.\n 87\n The Federal Desktop Core Configuration is a list of security settings recommended by NIST for general-purpose\n computers that are connected directly to the network of a U.S. Government agency. It applies only to Windows XP\n and Vista desktop and laptop computers.\n\n\nwww.oig.dhs.gov 91\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n \xe2\x80\xa2\t Virtual Appliance \xe2\x80\x93 access to a download of a Nessus 4 VMware Virtual Appliance, which\n works with VMware ESX, Server, Workstation, and Fusion.\n\n Netcat\n Netcat is a computer networking service for reading from and writing network connections\n using Transmission Control Protocol (TCP) or User Datagram Protocol (UDP). Netcat is designed\n to be a dependable "back-end" device that can be used directly or easily driven by other\n programs and scripts. At the same time, it is a feature-rich network debugging and\n investigation tool since it can produce almost any kind of correlation you would need and has a\n number of built-in capabilities.\n\n NetStumbler\n NetStumbler (also known as Network Stumbler) is a tool for Windows that facilitates detection\n of WLANs using the 802.11b, 802.11a, and 802.11g WLAN standards.\n\n Newt\n Newt is the Nessus vulnerability assessment scanner for a Windows platform.\n\n NeXpose\n NeXpose is a vulnerability scanner used to identify vulnerabilities across all of an organization\xe2\x80\x99s\n IT assets and entire environment by leveraging one of the largest vulnerability databases. It\n conducts more than 85,000 vulnerability checks for more than 28,000 vulnerabilities across\n physical and virtual networks, operating systems, databases, and web applications. NeXpose\n identifies all assets within physical and virtual networks, identifies exploits and malware attacks\n that can breach vulnerabilities identified in an organization\xe2\x80\x99s environment, mimics an attack to\n find vulnerabilities, and validates whether vulnerabilities are exploitable in an organization\xe2\x80\x99s\n environment. The results of these vulnerability scans are then translated into a Real Risk score\n to help understand an organization\xe2\x80\x99s true risk exposure.\n\n NGS SQuirreL\n NGS SQuirreL is a vulnerability assessment tool for relational database management system\n infrastructures. Not only does it identify the weak points in security stature, but it allows\n systems professionals and database administrators to assess the level of security vulnerabilities\n quickly and accurately and fix those vulnerabilities identified. NGS provides several SQuirreL\n tools, including those on the following platforms: Microsoft SQL Server, Oracle, MySQL, IBM\n Informix, IBM DataBase2, and Sybase ASE.\n\n Nikto\n Nikto is an open source web server scanner that performs comprehensive tests against web\n servers for multiple items, including more than 6,500 potentially dangerous files/Common\n Gateway Interfaces, checks for outdated versions of more than 1,250 servers, and version-\n specific problems on more than 270 servers. It also checks for server configuration items such\n\n\nwww.oig.dhs.gov 92\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n as the presence of multiple index files and Hypertext Transfer Protocol (HTTP) server options,\n and will attempt to identify installed web servers and software. Scan items and plug-ins are\n frequently updated and can be automatically updated.\n\n Nmap\n Nmap is a free and open source utility for network exploration, network inventory, and security\n auditing. Nmap crafts and transmits network traffic to determine what hosts are available on a\n network, as well as running services, operating systems, and port information for each host.\n\n N-Stalker\n N-Stalker is a web application security scanner used to search for vulnerabilities such as SQL\n injection, cross-site scripting, and known attacks.\n\n Open Vulnerability Assessment System\n The Open Vulnerability Assessment System is a framework of several services and tools offering\n a comprehensive and powerful vulnerability scanning and vulnerability management solution.\n It is available as free software and maintained on a daily basis. Its dedicated contributors and\n sponsors include penetration testers, power users, security researchers, and academia.\n\n Oracle 8i Benchmark Tool\n A CIS product, the Oracle 8i Benchmark Assessment Tool operates on Windows, Linux, and\n Sparc Solaris platforms and evaluates Oracle 8i instances against CIS Oracle 8i Benchmark\n v1.2.0.\n\n Oracle Password Checker (Cracker)\n Checkpwd 1.23 is one of the fastest dictionary-based password checkers for Oracle databases.\n This is a useful tool for database administrators to identify Oracle accounts with weak or\n default passwords. Version 1.23 contains a version that only shows that a password is weak but\n not the password itself. Checkpwd reads the password hashes from the view dba_users and\n compares the hashkeys with the hashkeys calculated from a dictionary file.\n\n Proxychains\n Proxychains is a Linux dynamically loadable library that will intercept any TCP and UDP traffic\n from a specific process and tunnel it over HTTP, SOCKS4, or SOCKS5 proxy.\n\n PSTools\n This tool is a set of command line utilities that allow an individual to manage local and remote\n systems.\n\n\n\n\nwww.oig.dhs.gov 93 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n PuTTY\n PuTTY is a free implementation of Telnet and Secure Shell for Windows and UNIX platforms,\n along with an xterm terminal emulator. Use of PuTTY, PuTTy Secure Copy Program, PuTTy\n Secure File Transfer Program, and Plink is illegal in countries where encryption is outlawed.\n\n Pwdump\n Pwdump is the most popular password dumping utility for Microsoft Windows\n 2000/XP/2003/Vista.\n\n RainbowCrack\n RainbowCrack is a computer program that generates rainbow tables used for password\n cracking. It differs from conventional brute force crackers in that it uses large pre-computed\n tables called rainbow tables to drastically reduce the length of time needed to crack a\n password. RainbowCrack-Online enables businesses and individuals to assess their password\n policies by providing access to pre-generated hash tables\n\n Router Auditing Tool (RAT)\n RAT is a free command line configuration scanner for Cisco routers, switches, and PIX firewalls.\n It can log into Cisco devices to pull the configuration file directly or it can be given a\n configuration file. It generates HTML reports detailing all configuration items that were\n checked, highlighting the items that failed. RAT gives detailed information regarding each\n configuration item for which it checks, including instructions to implement a fix.\n\n Sandstorm Phonesweep\n Phonesweep telephone scanner is a wardialer software written to identify modems on a phone\n line. Phonesweep is a robust multi-line scanner that can dial every number in an organization.\n Through this process, it will:\n\n \xe2\x80\xa2\t Identify computers running remote access software that bypass corporate firewalls.\n \xe2\x80\xa2\t Identify authorized or unauthorized modems that accept incoming calls.\n \xe2\x80\xa2\t Evaluate password settings by attempting to log in with easily guessable usernames and\n passwords.\n\n Samba\n Samba is a free software re-implementation of the Server Message Block/Common Internet File\n System networking protocol. Samba provides file and print services for various Microsoft\n Windows clients and can integrate with a Windows server domain, either as a primary domain\n controller or as a domain member. It can also be part of an AD domain.\n\n Samba runs on most UNIX and UNIX-like systems, such as Linux, Solaris, AIX, and the BSD\n variants, including Apple\'s Mac OS X Server (which was added to the Mac OS X client in version\n 10.2). Samba is standard on nearly all distributions of Linux and is commonly included as a\n\n\nwww.oig.dhs.gov 94\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n basic system service on other UNIX-based operating systems as well. Samba is released under\n the GNU General Public License. The name Samba comes from Server Message Block, the\n name of the standard protocol used by the Microsoft Windows network file system.\n\n Sam Spade\n Sam Spade is a general-purpose Internet utility package, with some extra features to help trace \n\n the source of spam and other forms of Internet harassment. Sam Spade features include ping, \n\n nslookup, whois, IP block, dig, traceroute finger, SMTP Verify, web browser \n\n keep-alive, DNS zone transfer, SMTP relay check, Usenet cancel check, website download, \n\n website search, E-mail header analysis, E-mail blacklist, and query abuse address. \n\n\n Security Content Automation Protocol Compliance Checker\n The Security Content Automation Protocol Compliance Checker is a tool used to evaluate\n Security Content Automation Protocol content.88\n\n Sid2User/User2Sid\n User2sid and Sid2user are two small utilities for Windows NT that allow the administrator to\n query the Security Accounts Manager to find out a security identifier value for a given account\n name and vice versa. User2sid.exe can retrieve a security identifier from the Security Accounts\n Manager from the local or a remote machine, and then Sid2user.exe can be used to retrieve the\n names of all the user accounts and more. These utilities do not exploit a bug but call the\n functions LookupAccountName and LookupAccountSid, respectively. These tools can be called\n against a remote machine without providing logon credentials except those needed for a null\n session connection. These tools rely on the ability to create a null session in order to work.\n\n SMB Client\n Part of the Samba suite, SMB Client is a client that can \xe2\x80\x9ctalk\xe2\x80\x9d to a LAN Manager server. It offers\n an interface similar to that of the file transfer protocol program. Operations include things like\n getting files from the server to the local machine, putting files from the local machine onto the\n server, and retrieving directory information from the server.\n\n snmpcheck\n Snmpcheck is a free open source utility to get information via Simple Network Management\n Protocols (SNMP). It works fine against Windows, Linux, Cisco, HP-UX, SunOS systems, and any\n devices with SNMP support. It could be useful for penetration testing or systems monitoring.\n Snmpcheck has been tested on GNU/Linux, *BSD, Windows systems, and Cygwin.\n\n\n\n 88\n SNMP is a method for using specific standards to enable automated vulnerability management, measurement,\n and policy compliance evaluation (e.g., FISMA compliance). The NVD is the U.S. Government content repository\n for the Security Content Automation Protocol. The Security Content Automation Protocol combines a number of\n open standards that are used to enumerate software flaws and configuration issues related to security.\n\n\nwww.oig.dhs.gov 95 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n snmpwalk\n Snmpwalk is an SNMP application that uses SNMP GETNEXT requests to query a network entity\n for a tree of information.\n\n Softerra LDAP AdministratorTM\n Softerra LDAP AdministratorTM is a LDAP administration tool designed to work with almost any\n LDAP server, including AD, Novell Directory Services, and Netscape/iPlanet.89 It simplifies\n management of LDAP directories providing advanced directory search facilities, bulk update\n operations, group membership management facilities, and so on. Customizable directory\n reports equip administrative personnel with information necessary for effective monitoring and\n audit. Directory data can be exported and imported in many different formats. LDAP-SQL\n support allows managing LDAP entries using SQL-like syntax and performing LDAP operations\n that cannot be executed via standard LDAP means.\n\n Softerra LDAP Browser\n Softerra LDAP Browser is a freeware product for browsing LDAP directories. It helps to view\n and analyze LDAP directory data, as well as to get specific information about directory\n infrastructure and objects by means of directory reports.\n\n Social Engineering Toolkit\n The Social Engineering Toolkit is specifically designed to perform advanced attacks against the\n human element. This tool has become a standard in a penetration tester\xe2\x80\x99s arsenal. The attacks\n built into the toolkit are designed to be targeted and focused attacks against a person or\n organization used during a penetration test.\n\n sqlmap\n Sqlmap is an open source penetration testing tool that automates the process of detecting and\n exploiting SQL injection flaws and taking over database servers. It comes with a powerful\n detection engine, many niche features for the ultimate penetration tester, and a broad range of\n switches lasting from database fingerprinting, over data fetching from the database, to\n accessing the underlying file system and executing commands on the operating system via out-\n of-band connections.\n\n sqlping3\n Sqlping 3.0 is designed to combine all known means of SQL Server/Microsoft SQL Server Data\n Engine discovery into a single tool, which can be used to identify network servers that an\n organization never knew existed so they can be properly secured. Sqlping also does brute force\n password cracking to identify weak passwords.\n\n\n 89\n LDAP is an application protocol for accessing and maintaining distributed directory information services over an\n IP network.\n\n\nwww.oig.dhs.gov 96 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n tcpdump\n Tcpdump, a free software product, is a common packet analyzer that runs under the command\n line. It allows the user to intercept and display TCP/IP and other packets being transmitted or\n received over a network to which the computer is attached. It works on most UNIX-like\n operating systems: Linux, Solaris, BSD, Mac OS X, HP-UX, and AIX, among others.\n\n tcptraceroute\n Tcptraceroute is a traceroute implementation using TCP packets.90 The more traditional\n traceroute sends either a UDP or an Internet Control Message Protocol (ICMP) echo packet with\n a transistor\xe2\x80\x93transistor logic of one, and increments the transistor\xe2\x80\x93transistor logic until the\n destination has been reached. By printing the gateways that generate ICMP time exceeded\n messages along the way, it is able to determine the path packets are taking to reach the\n destination. However, with the widespread use of firewalls on the modern Internet, many of\n the packets that traceroute sends are often filtered, making it impossible to completely trace\n the path to the destination. However, in many cases, these firewalls will permit inbound TCP\n packets to specific ports on which hosts sitting behind the firewall are listening for connections.\n By sending TCP SYNchronize packets for default port 80 instead of UDP or ICMP echo packets,\n tcptraceroute is able to bypass the most common firewall filters.\n\n THC-Hydra\n THC-Hydra is a fast network logon cracker that supports many different services. It is a login\n hacker for Samba, file transfer protocol, post office protocol 3, Internet message access\n protocol, Telnet, HTTP Auth, LDAP, network news transfer protocol, MySQL, virtual network\n computing, ICQ, Socks5, PC Network File System, Cisco, and more. Software includes secure\n socket layer support and is part of Nessus.\n\n TSEnum\n TSEnum, which stands for Terminal Services Enumeration, is a tool for scanning for the\n presence of Microsoft Windows terminal servers.\n\n TSGrinder\n TSGrinder is a free tool that allows an individual to perform brute force password guessing in a\n terminal server environment. Specifically, it is a dictionary-based attack tool and supports\n multiple attack windows from a single dictionary file.\n\n VNCcrack\n VNCcrack is an offline password cracker for the VNC\xc2\xae challenge/response protocol. If one can\n somehow observe a virtual network computing authentication, then VNCcrack can run a\n dictionary attack against the exchange and attempt to find the password. It works by scanning\n\n 90\n Traceroute is a computer network diagnostic tool for displaying the route (path) and measuring transit delays of\n packets across an IP network.\n\n\nwww.oig.dhs.gov 97 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n a packet capture file (as generated by the common tcpdump tool) for virtual network\n computing challenge/response exchanges, then checks against a preexisting word list.\n\n w3af\n W3af, the Web Application Attack and Audit Framework, is a complete environment for\n auditing and attacking web applications. This environment provides a solid platform for web\n vulnerability assessments and penetration tests.\n\n WebInspect\n HP\xe2\x80\x99s WebInspect performs web application security testing and assessment for complex web\n applications and web services, built on emerging Web 2.0 technologies. WebInspect identifies\n security vulnerabilities that are undetectable by traditional scanners.\n\n WebScarab\n WebScarab is a framework for analyzing applications that communicate using the HTTP and\n HTTP Secure protocols. It is written in Java and is thus portable to many platforms. WebScarab\n has several modes of operation, implemented by a number of plug-ins. In its most common\n usage, WebScarab operates as an intercepting proxy, allowing the operator to review and\n modify requests created by the browser before they are sent to the server, and to review and\n modify responses returned from the server before they are received by the browser.\n WebScarab is able to intercept both HTTP and HTTP Secure communication. The operator can\n also review the conversations (requests and responses) that have passed through WebScarab.\n\n WEPCrack\n WEPCrack is an open source tool for breaking 802.11 WEP secret keys.\n\n Wikto\n Wikto is a tool that checks for flaws in web servers. It provides much the same functionality as\n Nikto but adds various interesting pieces of functionality, such as a back-end miner and close\n Google integration. Wikto is written for the Microsoft .NET environment, and registration is\n required to download the binary or source code.\n\n Windows GoldDisk\n Windows GoldDisk was developed by the military for non-classified systems to assist system\n administrators in securing systems and applications in accordance with the guidance found in\n the DISA STIGs, checklists, and applicable CIS benchmarks. It covers Windows 2000 (Pro,\n Member Server, and Domain Controller), Windows XP, Windows 2003 (member server and\n Domain Controller), IIS 5, IIS 6, Microsoft Office, Netscape Navigator, Internet Explorer, and\n several antivirus products.\n\n\n\n\nwww.oig.dhs.gov 98 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Wireshark\xc2\xae\n Wireshark is a network protocol analyzer for UNIX and Windows. It lets you capture and\n interactively browse the traffic running on a computer network. It has a rich and powerful\n feature set and runs on most computing platforms, including Windows, OS X, Linux, and UNIX.\n Network professionals, security experts, developers, and educators around the world use it\n regularly. It is freely available as open source, and is developed and maintained by a global\n team of protocol experts. (Note: Wireshark used to be known as Ethereal\xc2\xae.)\n\n Yersenia\n Yersenia is a network tool designed to take advantage of some weakness in different network\n protocols. It pretends to be a solid framework for analyzing and testing the deployed networks\n and systems.\n\n\n\n\nwww.oig.dhs.gov 99 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix E\n Objectives for Evaluating an Agency\xe2\x80\x99s Cybersecurity Program\n Overall Objective\n The overall objective of this audit is to determine whether an adequate and effective\n cybersecurity program and partnerships have been established to protect agency information\n technology (IT) systems and critical infrastructure from cyber vulnerabilities and threats.91\n\n Detailed Sub-Objectives\n\n 1.\t Identify the agency\xe2\x80\x99s roles and responsibilities for securing its cyber assets and critical\n infrastructures.\n\n A.\t Determine whether an organizational structure has been established to fulfill the\n agency\xe2\x80\x99s assigned roles and responsibilities as they relate to the protection of its cyber\n assets and critical infrastructure.\n 1) Ensure that the agency has clearly documented its cybersecurity mission and\n program.\n 2) Ensure that personnel clearly understand the agency\xe2\x80\x99s mission as it relates to\n protecting its IT systems or critical infrastructure from cyber threats.\n 3) Determine whether the agency has the resources (i.e., staff and budget) necessary\n to carry out its cybersecurity mission.\n 4) Evaluate whether the agency structure effectively addresses the identification,\n analysis, and mitigation of cyber threats.\n B.\t Interview management officials to identify the roles and responsibilities each office has\n in implementing the actions and recommendations outlined in ThefNationalfStrategyftof\n SecurefCyberspace, National Infrastructure Protection Plan, and Comprehensive\n National Cybersecurity Initiative.\n C.\t Identify agency efforts to comply with actions resulting from the President\xe2\x80\x99s Cyberspace\n Policy Review.\n\n 2.\t Determine whether the agency has implemented an effective strategic cybersecurity\n program to protect its IT systems and critical infrastructure from cyber threats and attacks.\n\n A.\t Determine whether the agency has developed a strategic implementation plan that\n outlines its roles and responsibilities and establishes specific timeframes and milestones\n to provide a clear plan of action for achieving its cybersecurity mission and goals.\n B.\t Ensure that the agency has developed and implemented policies and procedures\n documenting the actions to be taken to comply with applicable cybersecurity guidance.\n\n 91\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 100\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n C.\t Evaluate the adequacy of the policies and procedures developed regarding cyber threats\n and mitigating the risks of an attack.\n D.\t Evaluate whether the agency has adequate processes to identify, analyze, and prioritize\n cyber vulnerabilities and threats.\n E.\t Evaluate whether any identified security incidents have been reported through the\n United States Computer Emergency Readiness Team.\n\n 3.\t Ensure that the agency has established performance metrics and outcome measures for\n implementing the processes and procedures needed to protect its IT systems and critical\n infrastructure from cyber threats and vulnerabilities.\n\n A.\t Identify the performance and outcome measures developed to evaluate the processes\n and procedures needed to protect IT systems and critical infrastructure from cyber\n threats and vulnerabilities.\n B.\t Determine whether performance measures are periodically reviewed and updated.\n C.\t Determine how often the performance measures are updated.\n D.\t Determine who is responsible for the development and approval of performance \n\n measures.\n\n\n 4.\t Determine whether the agency is efficiently overseeing its strategy to protect its IT systems\n and critical infrastructure.\n\n 5.\t Identify agency partnerships with other Federal agencies, State and local governments, and\n cross-sector groups, including private sector and international entities, to determine the\n effectiveness of coordination and awareness activities undertaken to protect cyberspace.\n\n A.\t Identify significant partnerships the agency has developed in protecting cyberspace.\n B.\t Ensure that the agency has a process for coordinating with other government agencies\n and the private sector in responding to cyber security incidents.\n C.\t Ensure that the agency has a plan to warn the public and private sectors adequately and\n timely about possible and actual cyber attacks.\n D.\t Evaluate whether the agency has developed an international cybersecurity information\n sharing policy.\n E.\t Assess the steps taken to strengthen operational collaboration with the agency\xe2\x80\x99s\n international counterparts to reduce cyber vulnerabilities and improve incident\n response and information sharing capabilities.\n 1) Determine whether the agency is participating in bilateral cybersecurity meetings\n and forums to improve operational cybersecurity collaboration efforts.\n 2) Identify whether the agency has established partnerships with international\n organizations, including government and private industry.\n\n\n\n\nwww.oig.dhs.gov 101\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix F\n Objectives for Evaluating Identity Management\n Overall Objective\n The overall objective of this audit is to determine whether an agency is meeting Homeland\n Security Presidential Directive 12 (HSPD-12) implementation requirements.92\n\n Detailed Sub-Objectives\n\n 1.\t Determine whether the agency implementation plan adequately addresses HSPD-12.\n\n A.\t Ensure that the agency\xe2\x80\x99s HSPD-12 implementation plan adequately addresses the\n security and technical interoperability requirements of HSPD-12.\n 1) Compare the agency\xe2\x80\x99s implementation plan to the Office of Management and\n Budget (OMB) Memorandum 05-24 implementing instructions.\n 2) Ensure that the implementation plan complies with Federal Information Processing\n Standard 201 requirements.\n 3) Ensure that the plan contains sufficient information regarding the security,\n interoperability, and deployment of an Enterprise Identity Management System\n (EIMS) in order to address HSPD-12 requirements (if applicable).\n B.\t Ensure that interim milestones have been developed in order to meet the agency\xe2\x80\x99s\n updated HSPD-12 implementation deadline.\n 1) Review agency implementation activities, HSPD-12 Council meeting minutes, and\n status reports submitted to OMB to ensure that projected milestones are being\n achieved.\n 2) Evaluate planned implementation activities with actual status to evaluate whether\n the deadline for issuance of Personal Identity Verification (PIV) cards to all\n employees and contractors will be met.\n 3) Ensure that measures have been developed to track implementation progress.\n C.\t Ensure that the agency\xe2\x80\x99s department-wide cost estimate includes all costs related to the\n HSPD-12 implementation, such as costs related to component rollout, enrollment\n centers, cards readers, and system upgrades.\n\n 2.\t Determine whether physical and system security controls have been implemented and are\n effective in protecting the privacy of personal data collected and processed by EIMS (if\n applicable).\n\n A.\t Evaluate the adequacy of the physical security controls over the personally identifiable\n information (PII) stored at the EIMS contractor facility and enrollment centers.\n\n 92\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 102\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 1) Evaluate the physical access procedures.\n 2) Ensure that visitor sign-in and access logs are being used and stored on at least an\n annual basis.\n 3) Ensure that inspections are conducted of offices and other facilities at least monthly,\n to ensure that proprietary materials are being adequately safeguarded. Obtain and\n review reports from those inspections.\n 4) Ensure that the agency HSPD-12 project management office has developed and\n regularly updates a list of personnel with authorized access to the facilities where\n EIMS resides and that appropriate authorization credentials are being issued.\n a.\t Ensure that there is a process to track lost credentials.\n b.\t Ensure that there are procedures for the return and destruction of credentials\n for personnel who no longer work at those facilities.\n B.\t Evaluate whether agency requirements for database security controls have been\n implemented to protect PII from unauthorized access.\n 1) Review agency policies and best practice guidelines for database configuration.\n 2) Perform manual checks on the EIMS database to ensure that agency policies and\n best practices for databases have been implemented.\n 3) Perform vulnerability testing on the EIMS database to evaluate the effectiveness of\n controls implemented.\n a.\t Ensure that critical security patches and updates have been applied.\n b.\t Perform penetration testing to ensure that critical vulnerabilities discovered\n cannot be exploited and compromise PII data.\n C. Ensure that agency requirements for account management and access control have\n been implemented to restrict and control access to EIMS and PII.\n 1) Review agency policies and best practice guidelines for account management and\n access control.\n 2) Obtain a copy of access request forms for all administrators and a sample of user\n accounts to identify roles and permissions.\n 3) Review the policy for granting and controlling access to the network domain, local\n servers and workstations, and software application.\n 4) Ensure that quarterly firewall testing at the contractor\xe2\x80\x99s facility is being performed.\n 5) Perform manual checks on the local servers and workstations to ensure that agency\n policies and best practices for access controls have been implemented.\n a.\t Evaluate the methods by which PII data is input, exported, viewed, and\n destroyed to ensure restrictions and control measures are in place.\n b.\t Ensure that only authorized users can access PII data.\n c.\t Ensure that only limited access and permissions are granted when PII is accessed\n locally, from the network, and through the software application.\n D.\t Evaluate whether agency requirements for Virtual Private Network (VPN) connections\n have been configured to ensure that PII data is protected when remotely accessed.\n 1) Review agency policies and best practice guidelines for VPN implementation and\n management.\n\n\nwww.oig.dhs.gov 103\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 2)\t Perform manual checks on the EIMS VPN concentrator to ensure that agency\n policies and best practices for VPN management and configuration have been\n implemented.\n a.\t Ensure that the system is accessed remotely only via the VPN or other strong\n authentication mechanism.\n b.\t Ensure that two-factor authentication and adequate encryption mechanisms are\n in place to provide secure VPN connections.\n c.\t Ensure that appropriate access is granted once a connection is established.\n 3)\t Perform vulnerability testing on the VPN concentrator to evaluate the effectiveness\n of controls implemented and to determine whether critical vulnerabilities\n discovered can be exploited (through penetration testing) that can compromise PII\n data.\n E. Evaluate whether agency requirements for log maintenance and review have been\n implemented to ensure the integrity of and accountability for PII data.\n 1) Review agency policies and best practice guidelines for database logging and log\n access.\n 2)\t Perform manual checks on system and network settings and logs to ensure that all\n accesses to the database are being logged as required by agency policies and best\n practice guidelines.\n a.\t Ensure that adequate logs are being kept at the database, software application,\n local, and network levels.\n b.\t Ensure that logs are reviewed on a regular basis (i.e., monthly).\n c.\t Ensure that logs are protected from unauthorized modification, access, or\n destruction.\n\n\n\n\nwww.oig.dhs.gov 104\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix G\n Objectives for Evaluating Network Management and Security\n Overall Objective\n The overall objective of this audit is to determine whether the agency has implemented\n effective controls for protecting its networks.93\n\n Detailed Sub-Objectives\n\n 1.\t Evaluate whether the agency or its organizational components have adequate policies and\n procedures for standard configurations; a patch and vulnerability management process;\n review of audit trails; performance of periodic network testing; identification (ID) and\n authentication mechanisms; and deployment of antivirus software. Ensure that policies and\n procedures address the following:\n\n A.\t Standard configurations for network security devices (Intrusion Detection Systems [IDS],\n firewalls, and encryption devices), network traffic devices (routers, switches), servers\n and workstations, and antivirus software.\n B.\t Change control procedures for network changes.\n C.\t Review and maintenance of audit trails. For example, system and firewall logs are\n frequently reviewed for any failed and unauthorized logon attempts, suspicious\n activities, or unauthoroized or unusual activities on the networks. In addition, the\n policies and procedures should:\n 1) Define security violations (i.e., attempted unauthorized access, unsuccessful logon\n attempts, accesses to sensitive data and resources, privileged access, access\n modifications made by security personnel).\n 2) Describe procedures for responding to security violations.\n 3) Specify procedures for determining the seriousness of violations.\n 4) Describe procedures for investigating violations.\n 5) Define the process for reporting violations to higher levels of management.\n 6)\t Define access trends and deviations from those trends.\n 7) Document disciplinary actions for specific types of violations.\n 8) Propose the notification of the resource owner of any violation.\n 9) Describe procedures for reporting suspected criminal activity to law enforcement\n officials.\n D.\t A patch and vulnerability management process to ensure security patches are tested\n and installed to mitigate security vulnerabilities identified in a timely manner.\n Specifically, the process should:\n\n\n\n 93\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 105\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 1)\t Create and maintain an inventory of hardware and software deployed over the\n network.\n 2) Identify newly discovered vulnerabilities and security patches.\n 3) Prioritize patch application.\n 4) Create an agency/component/device-specific patch database.\n 5) Conduct generic testing of patches.\n 6) Distribute patch and vulnerability information to local administrators.\n 7) Verify patches installation through network and vulnerability scanning.\n 8) Provide training to system administrators to identify new patches and\n vulnerabilities.\n E.\t A routine security-testing program to evaluate the effectiveness of security controls\n implemented on networks. New devices should be scanned for proper configuration\n when they are connected to the network, and servers and network devices should be\n rescanned after a security patch is applied. In addition, routine testing should:\n 1) Reduce the likelihood of unauthorized access by identifying possible security\n vulnerabilities and misconfigurations on networks devices, servers, and\n workstations.\n 2) Include performing network scanning (semi-annually), vulnerability scanning\n (semi-annually), password analysis (same frequency as password expiration policy),\n system log review (weekly), file integrity checkers (monthly), virus detection\n (weekly), war dialing (annually), and penetration testing (annually).\n F.\t Strong ID and authentication mechanisms. For example, strong passwords should be\n used when accessing agency networks. Password policies should:\n 1) Contain a combination of alphabetic, numeric, and special characters, and should\n not contain any dictionary word or be the same as user ID.\n 2) Not be stored in a clear text file.\n 3) Be changed at least every 90 days.\n 4) Ensure that vendor-supplied passwords are replaced immediately.\n 5) Ensure that concurrent logins are not allowed (i.e., one user ID cannot log onto a\n system or application more than once during the same session) and group accounts\n are controlled.\n 6) Ensure that accounts are configured to lock automatically after three consecutive\n failed logon attempts.\n G. Antivirus software installation on servers and workstations. \tAntivirus software should\n be configured to run continuously in the background, and virus signatures should be\n updated at least weekly/daily.\n\n 2.\t Evaluate whether the processes for network administration (e.g., backup, disaster recovery,\n and contingency planning; patch and vulnerability management; user account and password\n administration; network monitoring; and roles and responsibilities) are adequate. Evaluate\n whether the following processes:\n\n\n\nwww.oig.dhs.gov 106\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n A. Ensure that backup, disaster recovery, and contingency planning are adequate by\n interviewing the Information Systems Security Manager or network administrators, and\n determining the following:\n 1) A contingency plan has been developed and tested according to the system\xe2\x80\x99s overall\n security categorization. The contingency plan should be included as one of the\n appendices to the System Security Plan.\n 2) Critical files are backed up to a remote location or removable media (e.g., magnetic\n tapes) periodically and the media stored off-site.\n 3) Arrangements are made for alternate data processing and telecommunication\n facilities.\n 4) Event logs are generated when backup operation is performed.\n 5) Fire extinguishers, smoke detectors, sprinkler systems, and emergency exit signs are\n installed at the network operation center or security operation center visited.\n 6) Uninterrupted power supply or electric generators are available to provide backup\n power in the event of emergency.\n B.\t Ensure that a patch and vulnerability management group is established to create a\n systematic and accountable process for identifying and applying security patches. The\n process should include:\n 1) Creating and maintaining an inventory of existing hardware and software.\n 2) Identifying newly discovered vulnerabilities and security patches.\n 3) Prioritizing security patch application.\n 4) Creating an agency-specific security patch database.\n 5) Conducting generic testing of security patches.\n 6) Distributing security patch and vulnerability information to local administrators.\n 7) Verifying patch installation through network and host vulnerability scanning.\n 8) Training system administrators in using the vulnerability database.\n C. Ensure that user account and password administration includes management processes\n that focus on ID, authentication, and access authorizations, and password\n administration. Determine whether a well-defined process has been implemented by\n ensuring the following:\n 1) Program official (system owner) maintains a list of authorized users, reviews access\n authorization listings, and determines whether users\xe2\x80\x99 access remains appropriate.\n 2) Access authorizations are documented on standard forms and maintained on file.\n 3) Security managers review and approve access authorizations and are notified\n immediately when users are terminated or transferred.\n 4) Users sign an \xe2\x80\x9cacknowledgment statement\xe2\x80\x9d when they are given access. The\n acknowledgment statement details acceptable rules of behavior as well as\n consequences of non-compliance.\n 5) User access permissions are reviewed at least annually. \n\n 6) Inactive accounts are disabled. \n\n 7) Default passwords supplied by the vendors are changed. \n\n 8) Passwords cannot be viewed in clear text when entered.\n\n\n\nwww.oig.dhs.gov 107\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n D.\t Ensure that network traffic is monitored continuously and a follow-up process exists for\n service disruptions, suspicious activities, and ongoing attacks against the network or\n interconnected systems.\n E.\t Ensure that the roles and responsibilities for administrators are documented in their job\n descriptions, which should match the administrators\xe2\x80\x99 duties. In addition, detailed\n written instructions should exist and be followed to guide the administrator in\n perfoming his/her duties.\n F.\t Ensure that all access paths to the networks are identified in the current network\n topology. The access path diagram should be reviewed and updated whenever changes\n are made to the network.\n\n 3.\t Evaluate whether security controls implemented on network security devices (firewalls,\n IDSs, and encryption devices) are effective.\n\n A.\t Firewalls\n 1) Identify and examine the type of firewalls deployed (packet filters, circuit-level\n gateways, application-level gateway, and stateful multilayer inspection).\n 2) Ensure that firewall devices are secured behind locked doors.\n 3) Ensure that firewall logging capabilities are enabled and reviewed frequently.\n 4) Ensure that a firewall policy has been developed and defines how the firewall should\n handle applications traffic such as web, email, or telnet. The policy should describe\n how the firewall is to be managed and updated. The default firewall policy for\n handling inbound traffic should be configured to block all packets and connections\n unless the traffic type and connections have been specifically permitted. In addition,\n the firewall rule set should always block the following types of traffic:\n a.\t Inbound traffic from a non-authenticated source system with a destination\n address of the firewall system itself. (Note: This type of packet normally\n represents some type of probe or attack against the firewall.)\n b.\t Inbound traffic with a source address indicating that the packet originated on a\n network behind the firewall. (Note: This type of packet likely represents some\n type of spoofing attempt.)\n c.\t Inbound traffic containing Internet Control Message Protocol (ICMP) traffic.\n (Note: Since ICMP can be used to map the networks behind certain types of\n firewalls, ICMP should not be passed in from the Internet, or from any untrusted\n external network.)\n d.\t Inbound or outbound traffic from a system using a source address that falls\n within the address ranges set aside in RFC 1918 as being reserved for private\n networks. (Note: RFC 1918 describes a set of network ranges set aside for\n so-called "private" use.)\n e.\t Inbound traffic from a non-authenticated source system containing Simple\n Network Management Protocol (SNMP) traffic. (Note: These packets can be an\n indicator that an intruder is probing a network, but there are few reasons an\n\n\nwww.oig.dhs.gov 108\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n organization or agency might want to allow inbound SNMP traffic, and it should\n be blocked in the vast majority of circumstances.)\n f.\t Inbound traffic containing Internet Protocol (IP) source routing information.\n g.\t Inbound or outbound network traffic containing a source or destination address\n of the local host. (Note: Such traffic is usually some type of attack against the\n firewall system itself.)\n h.\t Inbound or outbound network traffic containing a source or destination address\n of inbound or outbound traffic containing directed broadcast addresses.\n i.\t Ensure that access to the firewall operating system console and any graphic\n management interface is restricted to authorized users only. The use of\n encryption and/or strong user authentication and restricting access by IP address\n can limit access to firewalls.\n j.\t Perform scans with automated tools to evaluate the following:\n 1.\t Firewall internal operating system, firewall engine, and firmware are\n up-to-date.\n 2.\t Firewall configuration.\n 3.\t Firewall notification, reporting, and analysis capabilities are present.\n 4.\t Packets are captured or logged by the firewalls.\n 5.\t All unused networking protocols are not on the firewall operating system\n build (if identified, should be removed).\n 6.\t All unused network services or applications are removed or disabled.\n 7.\t All unused user or system accounts are removed or disabled.\n 8.\t All unused physical network interfaces are disabled or removed from the\n server chassis.\n B.\t IDSs\n 1) Ensure that incident response procedures are developed for security and intrusion\n incidents detected.\n\n 2) Ensure that IDS rules and signatures are updated frequently. \n\n 3) Ensure that access list is maintained for users with administrator access. \n\n 4) Ensure that the IDS is configured for the following: \n\n a.\t Differentiate between normal and abnormal network traffic patterns and\n suspicious user activities.\n b.\t Identify suspicious files and data modified.\n c.\t Monitor user accounts, system files, and log files for tampering.\n d.\t Send alerts (by page, E-mail, or other means) when high-level intrusions occur\n and to minimize alerting resulting from false positives and low-level attacks.\n e.\t A report module exists to aggregate attacks over a period of time (i.e., hourly,\n weekly, monthly).\n C.\t Encryption devices\n 1) Determine the type of encryption devices deployed. (\t Note: Internal network traffic\n is usually not encrypted. If network traffic is transmitted between corporate offices\n\n\n\nwww.oig.dhs.gov 109\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n that are physically separate, whether down the street, to another state, or to\n another country, all traffic must be encrypted.)\n 2) Ensure that the encryption capability is enabled.\n 3) Ensure that the encryption standard (e.g., Triple Data Encryption Algorithm,\n Advanced Encryption Standard) complies with Common Criteria Evaluation\n Assurance Level 4 and/or Federal Information Processing Standard 140-2\n accreditation.\n 4) Ensure that adequate physical security is provided to protect encryption devices\n from unauthorized access and tampering.\n 5) Ensure that the management capabilities are secure by using strong encryption,\n digital certificates, and Digital Signature Standard for strong authentication.\n Management capabilites may also include proprietary interfaces that are SNMP\n based, or they could be physical like RS-232 terminal interface. This also includes\n examination of audit logs, alarm condition detection, and secure download of\n software updates.\n 6) Verify that the encryption device only routes traffic from approved networks. The\n traffic from the encryption device should be sent to a single IP address\xe2\x80\x94the IP\n address of the target network\xe2\x80\x94or there may be a pool of encryption devices.\n\n 4.\t Evaluate whether security controls implemented on network traffic devices (routers and\n switches) are effective.\n\n A.\t Routers\n Ensure the following by reviewing configuration settings, interviewing administrators,\n and performing scans with automated scanning tools:\n 1) Router Internet Operating System is up-to-date.\n 2) Router configuration is maintained off-line and backed up, and access to the router\n is restricted.\n 3) Router configuration is well documented and commented.\n 4) Router users and passwords are configured and maintained.\n 5) Password encryption is in use; enable secret is in use.\n 6) Enable secret is difficult to guess and knowledge of it is strictly limited (if not, change\n enable secret immediately).\n 7) Access restrictions are imposed on Console, Auxiliary, and Virtual Terminal Lines\n (VTL).\n 8) Unneeded network servers and facilities are disabled.\n 9) Necessary network services are configured correctly (e.g., Domain Name System).\n 10) Unused interfaces and VTLs are shut down or disabled.\n 11) Risky interface services are disabled.\n 12) Port and protocol needs of the network are properly identified and checked.\n 13) Access lists to restrict traffic to identified ports and protocols. In addition, access\n lists should block reserved and inappropriate IP addresses.\n\n\nwww.oig.dhs.gov 110\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 14) Static routes are configured where necessary. \n\n 15) Routing protocols are configured to use integrity mechanisms. \n\n 16) Router\xe2\x80\x99s time of day is set accurately, maintained with Network Time Protocol (NTP). \n\n 17) Enable logging capability with time stamp and log recipient hosts are identified and \n\n configured.\n 18) Logs are reviewed and archived in accordance with security policy.\n 19) SNMP protocol is disabled or enabled with good community strings and Access\n Control Lists (ACL).\n B.\t Switches\n Ensure the following by reviewing configuration settings, interviewing administrators,\n and performing scans with automated scanning tools:\n 1) Physical access to switches is restricted to authorize personnel only.\n 2) Latest stable version of the Internetwork Operating System is installed on each\n switch.\n 3) An enable secret password is created.\n 4) Switches are managed out-of-band (separated from data traffic). If out-of-band\n management is not feasible, then dedicate a separate virtual local area network\n (VLAN) number for in-band management. \n\n 5) Switches are configured with session timeouts and access privileges. \n\n 6) A warning banner is displayed to notify users that \xe2\x80\x9cunauthorized access is \n\n prohibited.\xe2\x80\x9d\n 7) Unnecessary network services (e.g., Transmission Control Protocol small servers,\n Hypertext Transfer Protocol) are disabled.\n 8) Only necessary network services are enabled on switches and these services are\n properly configured.\n 9) Secure Shell (SSH) with a strong password is used, instead of using telnet to\n switches.\n 10) If SNMP is necessary, a strong community string is set for SNMP.\n 11) Port security is implemented to limit access based on Media Access Control (MAC)\n address. Auto-trunking on ports is disabled.\n 12) The switch\xe2\x80\x99s port mirroring capability for IDS access is enabled.\n 13) Unused switch ports are disabled, and are assigned a VLAN number when not in use.\n 14) Trunk ports are assigned a native VLAN number that is not in use by any other port.\n 15) The VLANs that can be transported over a trunk are limited to those that are\n necessary.\n 16) Static VLAN configuration is used.\n 17) If possible, disable VLAN Trunking Protocol (VTP). Otherwise, set the following for\n VTP: management domain, password, and pruning; then set VTP into transparent\n mode.\n 18) ACLs are established when appropriate.\n 19) Logging capability is enabled and event logs are sent to a dedicated, secure log host.\n\n\n\nwww.oig.dhs.gov 111\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 20) Logging is configured to include accurate time information, using NTP and\n timestamps.\n 21) Logs are reviewed for possible incidents and archived in accordance with the\n security policy.\n 22) Authentication, authorization, and accounting features are used for local and\n remote access to switch.\n 23) Switch configuration files are maintained off-line, and their access is restricted to\n authorized administrators. The configuration file should contain descriptive\n comments for the different settings to provide perspective.\n\n 5.\t Evaluate whether security controls implemented on servers and workstations are effective.\n Ensure the following by reviewing configuration settings, interviewing administrators, and\n performing scans with automated scanning tools:\n\n A.\t Unnecessary ports and services are disabled.\n B.\t Latest security patches are installed to mitigate vulnerabilities.\n C.\t Servers and workstations are properly configured.\n D.\t Security backdoors are created on servers and workstations to guard against\n unauthorized or rogue peripherals (modems, wireless access points), and programs are\n installed.\n E.\t Strong passwords are used.\n\n 6.\t Evaluate whether adequate physical security controls have been established to restrict\n access to network resources. Specifically, evaluate whether physical access to network\n security devices, network traffic devices, servers, and workstations is restricted to\n authorized users. Access should be limited to personnel with a legitimate need for access to\n perform their duties. Management should regularly review the list of personnel authorized\n to have physical access to its sensitive facilities. Physical security controls may include:\n\n A.\t Manual door or cipher key locks.\n B.\t Magnetic door locks that require the use of electronic keycards.\n C.\t Biometrics authentication.\n D.\t Security guards.\n E.\t Photo IDs.\n F.\t Entry logs.\n G. Logs and authorization for removal and return of tapes and other storage media to the\n library.\n H. Electronic and visual surveillance systems.\n I.\t Perimeter fences around sensitive buildings.\n J.\t Perimeter intrusion alarms.\n K.\t Computer terminal locks.\n\n\n\nwww.oig.dhs.gov 112\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix H\n Objectives for Evaluating Laptop Security\n Overall Objective\n The overall objective of this audit is to determine whether the agency has established and\n implemented adequate and effective security policies and procedures related to the physical\n security of and logical access to government-issued laptop computers.94\n\n Detailed Sub-Objectives\n\n 1.\t Evaluate whether the agency has established adequate policies and procedures for\n inventory management and physical security of government-issued laptops.\n\n A.\t Ensure that the agency has established adequate and effective procedures for inventory\n management.\n 1) Assess whether the agency has established a process to ensure that newly acquired\n laptop computers are immediately entered into a property management system.\n 2) Verify that the inventory includes all of the following required items:\n a.\t Serial and/or seat number of laptop. (Note: A seat is a node on a network that\n can communicate using interprocess communication services. A seat is where\n entities and ports reside.)\n b.\t Name of owner or user of laptop.\n c.\t Purpose or use of laptop.\n d.\t Location of laptop.\n e. Laptop asset tag number.\n 3) Ensure that the laptop computer inventory includes information on the software\n (including version number) of each laptop or group of laptops.\n 4) Evaluate the accuracy of inventory records by verifying that correct information is on\n file for the subset of laptops included in the manual checks. Include a list of any\n identified inaccuracies.\n 5) Assess whether employee and contractor exit procedures include the return of\n laptops to the local property administrator.\n 6) Ensure that the agency has policies and procedures regarding corrective or\n disciplinary actions resulting from lost or stolen laptops.\n 7) Assess whether the agency is aware of any lost or stolen laptops. If so:\n a.\t Ensure that the incident was reported and investigated.\n b.\t Identify whether appropriate corrective actions were taken regarding the\n responsible employee(s) (e.g., disciplinary action, remedial training).\n\n\n\n 94\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 113\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 8) Evaluate whether the agency has established adequate procedures for maintaining\n inventory records, conducting inventory reviews, and employee exit processing.\n B. Ensure that the agency has established adequate and effective procedures for\n appropriately disposing of unneeded laptops.\n 1) Verify that excess laptops are secured while awaiting preparation for disposal.\n 2) Analyze whether the agency has a process for ensuring that the hard drives and\n memory (e.g., random access memory [RAM], synchronous dynamic random access\n memory [SDRAM]) of laptops scheduled for reuse have been cleared, including the\n use of an acceptable clearing process.\n (Note: Clearing a hard drive requires overwriting all locations with a pseudo-random\n pattern twice, overwriting all locations with a known pattern, and then verifying the\n procedure by randomly re-reading [a minimum of 1 percent recommended] the\n overwritten information.)\n 3) Identify whether the agency has a process for sanitizing hard drives and memory\n (e.g., RAM, SDRAM) of laptops scheduled for disposition (including return to\n manufacturer for repair or return to vendor upon completion of lease).\n 4) Assess that the agency uses an acceptable sanitizing process.\n (Note: Sanitizing a hard drive requires incineration or degaussing [see approved\n degausser list at http://www.nsa.gov/ia/_files/government/MDG/NSA_CSS-EPL-9-\n 12.pdf].)\n 5) Ensure that the agency removes all labels or markings prior to disposal.\n 6) Verify that the agency properly disposes of its drives through incineration in an\n Environmental Protection Agency-approved facility, burial in a landfill, or recycling.\n 7) Ensure that the agency maintains records of the clearing, sanitization, and\n disposition of laptop computers.\n 8) Verify that degaussing equipment (automatic degausser or degaussing wand), where\n used, is periodically tested to verify that the equipment is functioning properly.\n 9) If available, judgmentally select a sample of cleared and/or sanitized laptops to\n verify that data cannot be accessed. Alternatively, review available documentation\n to verify that disposed laptops were properly cleared and/or sanitized.\n C. Ensure that the agency has developed sufficient physical security safeguards.\n 1) Conduct a tour of the facility to determine, through observation, whether assigned\n laptops are secured when unattended via a locking cable, locked office, or locked\n cabinet or desk.\n 2) Assess whether unused laptops are stored in a secure location with adequate access\n controls to prevent unauthorized access, disclosure, damage, modification, or\n destruction when the laptops are not in use.\n 3) For the subset of laptops included in the manual checks, determine whether asset\n tags have been attached to each laptop computer.\n 4) For the subset of laptops included in the manual checks, determine whether the\n laptops are marked with the highest level of classification of information that has\n ever been processed or stored on the device.\n\n\nwww.oig.dhs.gov 114 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 5) Ensure that employees obtain written approval from the office director before\n taking a laptop overseas.\n 6) Identify any anti-theft measures that may serve as best practices, such as travel hard\n drives and tracking hardware.\n\n 2.\t Evaluate whether adequate logical access controls and wireless security measures are\n adequate for sensitive data contained on government-issued laptops.\n\n A.\t Establish and use adequate model systems to ensure that laptops are appropriately\n configured prior to issuance, and that software is updated as necessary.\n 1) Ensure that a model system or standard build is used for laptop software\n installation. \n\n 2) If a model system is used, ensure that it addresses: \n\n a.\t Hardware type and/or model.\n b.\t Operating system version and patch level.\n c.\t Major installed applications (version and patch level).\n d.\t Standard configuration settings.\n 3) If a model system is used, ensure that the model system or laptop configuration is\n based on agency, National Institute of Standards and Technology (NIST), or other\n guidelines. Specify which guidelines are used.\n 4) Ensure that a personal firewall product is installed on devices with wireless\n capabilities or that access the network remotely.\n 5) If a personal firewall is installed, ensure that it is periodically updated and reviewed.\n 6) Identify whether antivirus software is installed. If yes, determine whether the:\n a.\t Product is periodically updated.\n b.\t Software employs resident (as opposed to on-demand) scanning, to include\n boot-up and installation of new software.\n (Note: A resident virus scanner runs constantly, and automatically checks files\n for viruses as they are opened. An on-demand scanner requires a specific action\n to begin scanning.)\n b.\t The laptop used to connect to the agency\xe2\x80\x99s network remotely has Virtual Private\n Network (VPN) software installed. If VPN software is installed, ensure that it\n complies with Federal Information Processing Standard (FIPS)\n 140-2, Security Requirements for Cryptographic Modules.\n 7) Test a subset of laptops to ensure that they are configured to lock automatically\n after 5 minutes of inactivity.\n 8) Conduct scans, such as Internet Security Systems Internet Scanner scans and\n Superscan Scans.\n 9) For any deviations from agency configuration baseline guides, determine if an\n exception or waiver has been submitted and approved by the agency.\n B.\t Evaluate whether appropriate encryption measures have been implemented to protect\n sensitive data on the laptop computers.\n\n\nwww.oig.dhs.gov 115\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 1) Identify whether encryption has been implemented on all laptops. If yes, ensure\n that the encryption used Advanced Encryption Standard and FIPS 140-2, Security\n Requirements for Cryptographic Modules.\n 2) For agencies using approved wireless technologies, ensure that strong data and\n transmission encryption have been implemented.\n a.\t Assess whether an Encryption Key Management Plan consistent with agency\n public-key infrastructure policy authority requirements has been implemented\n and enforced.\n b.\t Review whether the Encryption Key Management Plan has been reassessed\n annually.\n C.\t Ensure that inappropriate files and programs are not stored or installed on laptop\n computers.\n 1) Review whether access to each laptop\xe2\x80\x99s system software and hardware is limited to\n authorized personnel (i.e., ensure that the user does not have administrative or\n unnecessary privileges on the laptop).\n 2) Identify whether the agency conducted reviews, at least semi-annually, of all\n equipment and software in its offices to ensure that only government-licensed\n software and equipment are being used, or that appropriate exceptions have been\n documented. Provide the date of the last official review.\n 3) Ensure that inventory reviews are conducted. Determine the adequacy of the\n review process by comparing the results of the last review with any findings\n identified during testing.\n 4) Assess whether laptops not authorized for classified processing have an external\n label affixed stating that \xe2\x80\x9cThis machine is not authorized for classified processing.\xe2\x80\x9d\n 5) Verify that passwords are not stored on or with the laptop, such as cached domain\n logon credentials.\n 6) Examine a sample of laptops to determine whether any suspicious or unusual\n programs or files are present.\n\n 3.\t Ensure that any built-in wireless, Bluetooth, or infrared devices are disabled or\n appropriately controlled.\n\n A.\t Assess whether the agency received approval for the use of wireless technologies.\n B.\t Identify whether quarterly security assessments are conducted on approved wireless\n systems.\n C.\t Verify that risk mitigation and security plans have been developed to address wireless\n security vulnerabilities on approved wireless systems.\n D.\t Evaluate whether appropriate countermeasures been implemented to strengthen the\n security of wireless laptops, including antivirus software and installation of relevant\n security patches.\n E.\t Review whether the following built-in wireless technologies have been disabled if not\n specifically approved. Check for the presence of each of the following: Windows Device\n\n\nwww.oig.dhs.gov 116\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Manager, Communications Devices, Human Interface Devices, Network Adapters, and\n Universal Serial Bus Controllers.\n\n\n\n\nwww.oig.dhs.gov 117 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix I\n Objectives for Evaluating Wireless Security\n Overall Objective\n The overall objective of this audit is to determine whether the agency has implemented\n effective controls to ensure that sensitive information processed by its wireless networks and\n devices are protected from potential exploits.95\n\n Detailed Sub-Objectives\n\n 1.\t Evaluate whether the agency has implemented adequate policies and procedures to\n mitigate the inherent risks associated with the use of wireless networks and devices.\n\n A.\t Assess whether the agency has developed requirements, policies, and procedures for its\n wireless network and devices to adequately address inherent security risks.\n B.\t Verify whether the agency is in compliance with agency and National Institute of\n Standards and Technology (NIST) wireless security policies and procedures.\n 1) Obtain copies of the agency and NIST wireless security policies and procedures.\n 2) Identify the information security standards and requirements for wireless networks\n and devices.\n 3) Assess whether the agency\xe2\x80\x99s wireless security policies and procedures are in\n compliance with applicable agency and NIST guidance.\n C.\t Ensure that the agency addresses known, reported security risks and vulnerabilities\n from previous Office of Inspector General (OIG) and Government Accountability Office\n GAO) audit reports.\n 1) Obtain specific GAO and OIG reports related to wireless security at the agency.\n 2) Identify any common vulnerabilities or threats that were reported.\n 3) If applicable, evaluate whether the agency has addressed and closed the\n recommendations.\n\n 2.\t Evaluate whether the agency has implemented an effective process to account for its\n wireless networks and devices and the physical protection of these networks and devices\n from unauthorized access.\n\n A.\t Assess the agency\xe2\x80\x99s process for issuing and deactivating wireless devices.\n 1) Determine who is responsible for maintaining the agency\xe2\x80\x99s inventory and ensuring\n that it is accurate.\n 2) Obtain the agency\xe2\x80\x99s policies and procedures for issuing and deactivating its wireless\n and handheld devices.\n\n 95\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 118\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n B.\t Review the agency\xe2\x80\x99s inventories for its laptops, Blackberries, and Bluetooth devices and\n determine whether the agency can account for the devices issued and assigned to\n authorized users (Federal and contractor personnel).\n 1) Obtain lists of system inventories and users from the agency property office or\n program management officials.\n 2) Obtain inventory review schedules or logs, including when and how often the\n inventory is updated.\n 3) Review and compare a random sample of system inventories with devices held and\n stored by agency users.\n 4) Evaluate whether devices are issued/returned based on user employment status.\n 5) Compare equipment issued/received with list of active/departed users and identify\n whether all equipment issued can be accounted for.\n C.\t Analyze whether the physical security controls over the facilities where the agency\xe2\x80\x99s\n wireless network servers, laptops, and devices are housed are adequate.\n 1) Perform on-site physical security assessments of the agency facilities that house its\n wireless network equipment, access points, and devices, including server rooms and\n storage closets, to evaluate whether the agency has provided adequate physical\n security controls.\n 2) Evaluate whether the agency is in compliance with agency policies and best\n practices for the protection of its network equipment, access points, and devices.\n 3) Ensure that visitor sign-in and access logs are being utilized and maintained, to track\n access to system equipment and devices, where appropriate.\n 4) Ensure that inspections are conducted of offices and other facilities, at least\n quarterly, to safeguard physical access to the systems. Obtain and review reports\n from those inspections.\n\n 3.\t Evaluate whether system security controls have been effectively implemented and properly\n configured on the agency wireless network and selected devices.\n\n A.\t Ensure that agency requirements for account management and access control have\n been implemented to restrict access to the agency\xe2\x80\x99s wireless networks and devices.\n 1) Review agency policies and best practices for account management and access\n control.\n 2) Obtain a list of network and BlackBerry server administrators.\n 3) Ensure that only authorized users have administrator access to wireless networks\n and devices.\n 4) Sample user accounts to identify roles and permissions.\n 5) Evaluate the effectiveness of account management, access control settings, and\n separation of duties.\n B.\t Perform wireless scans on selected wireless network equipment and devices, as well as\n Bluetooth capabilities, to determine whether adequate controls have been\n implemented.\n\n\nwww.oig.dhs.gov 119\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 1) Assess whether system settings and configurations on applicable servers are in\n accordance with agency and NIST wireless and Bluetooth security policies.\n 2) Analyze network connections and the agency\xe2\x80\x99s wireless security architecture to\n evaluate the effectiveness of system security controls.\n 3) Ensure that agency and NIST encryption requirements are implemented on the\n agency\xe2\x80\x99s wireless networks and devices.\n 4) Assess whether Media Access Control configurations are enabled in accordance with\n applicable agency and NIST policies.\n 5) Ensure that Service Set Identification broadcasting configurations are in accordance\n with agency and NIST policies.\n 6) Scan to detect any signal leakage from the wireless network or devices.\n 7) Scan to identify whether any rogue networks or access points are detected.\n C.\t Identify the status of patches deployed on selected agency network equipment, \n\n including laptops.\n\n 1) Obtain and review agency policies and procedures for patch management of \n\n information systems, specifically wireless networks and devices.\n 2) Identify who is responsible for implementing patches on selected agency wireless\n network servers and devices.\n 3) Obtain patch logs and schedules.\n 4) Examine when and how often the agency implements patches on its wireless\n network equipment or devices.\n 5) Perform system security vulnerability assessments on the agency\xe2\x80\x99s wireless network\n servers, including BlackBerry servers and laptops.\n 6) Ensure that critical security patches and updates have been applied.\n D.\t Review configuration and access control settings for laptops, BlackBerry, and Bluetooth\n devices to ensure compliance with applicable guidance.\n 1) Obtain configuration and access control settings for laptops from domain controllers\n or through manual checks.\n 2) Utilize software tools, such as BlueAuditor, to obtain configuration settings for\n BlackBerry and Bluetooth devices.\n 3) Compare settings on BlackBerry and Bluetooth devices with security configuration\n checklists.\n 4)\t Evaluate whether the agency\xe2\x80\x99s laptops, BlackBerry, and Bluetooth devices comply\n with applicable agency and NIST policies.\n\n 4.\t Evaluate whether the agency actively monitors its wireless networks and devices to enforce\n wireless security policy.\n\n A.\t Review and evaluate applicable agency and NIST policies regarding wireless system\n monitoring and scanning requirements.\n 1) Obtain applicable agency and NIST policies regarding system monitoring and\n scanning requirements for its wireless networks and devices.\n\n\nwww.oig.dhs.gov 120\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 2) Identify the requirements for system wireless monitoring or scanning. \n\n 3) Evaluate whether the agency is in compliance with applicable monitoring \n\n requirements. \n\n B.\t Assess whether the agency performs site surveys to minimize the risks of eavesdropping\n and signal leakage and identify whether rogue devices are connected to its wireless\n network.\n 1) Identify who is responsible for performing site visits and security assessments on the\n agency\xe2\x80\x99s wireless network or devices. \n\n 2) Interview agency personnel to verify whether the agency performs security\n\n assessments on its wireless network as part of site visits.\n 3) Obtain site visit logs or schedules.\n 4) Obtain site security assessments, reports, and security test logs to verify monitoring\n activities.\n 5)\t Document what was determined, including any reports of eavesdropping or signal\n leakage, and what actions, if needed, were or are being taken to address issues\n identified.\n C.\t Ensure that boundary protection devices such as firewalls and intrusion detection\n systems (IDS) have been implemented and are working properly.\n 1) Obtain an inventory of boundary protection devices, including firewalls and IDSs.\n 2) Obtain and review configuration settings.\n 3) Ensure that firewall or IDS testing has occurred on selected wireless networks.\n 4) Obtain and review firewall and IDS logs to ensure that systems are working properly.\n D.\t Assess whether vulnerabilities identified through testing are being addressed.\n 1) If applicable, obtain a list of known vulnerabilities resulting from the agency\xe2\x80\x99s\n security scans or tests.\n 2) Identify remediation steps or plans of action to ensure that known weaknesses and\n vulnerabilities are being addressed.\n 3) Ensure that weaknesses identified are being documented and steps are being taken\n to address known security vulnerabilities.\n 4) Analyze whether the actions being taken to address weaknesses are adequate.\n\n\n\n\nwww.oig.dhs.gov 121\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix J\n Objectives for Evaluating Database Security\n Overall Objective\n The overall objective of this audit is to determine whether the agency provides adequate\n system security, integrity, and control over its databases.96\n\n Detailed Sub-Objectives\n\n 1.\t Determine whether the databases are protected from unauthorized modification, loss, or\n disclosure by evaluating the controls that establish and update access to databases.\n\n A.\t Ensure that the classification of computing resources has been identified and is\n consistent with Federal guidelines.\n 1) Ensure that written policies and procedures are established, implemented, and\n approved regarding the classification (criticality and/or sensitivity) of resources,\n including databases.\n 2) Verify that current risk assessments have been performed for database operations.\n 3) Ensure that systems processing data have been certified and accredited to provide\n for security safeguards over sensitive data.\n B.\t Ensure that the agency has established logical access rules and has consistently assigned\n and implemented these rules in accordance with Office of Management and\n Budget A-130 requirements.\n 1) Determine whether security policies and procedures have been established. Ensure\n that these policies and procedures address access controls (to include emergency\n and temporary access).\n 2) Ensure that the Information Systems Security Manager for the agency is identified.\n 3) Determine whether the agency maintains a current list of users and their authorized\n level of access.\n 4)\t Determine whether policies and procedures exist regarding the administration of\n user identifications and passwords. Identify who is responsible for determining and\n assigning user access levels.\n 5)\t Ensure that user access rules are defined and reviewed periodically to determine\n whether they are still appropriate and updated as necessary (i.e., when privileges\n change).\n 6) Ensure that a formal process for transmitting system authorizations, including the\n use of standardized access request forms that are retained, has been established to\n reduce the risk of mishandling, alterations, and misunderstandings. Ensure that\n management approval granting access is documented.\n\n 96\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 122\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 7)\t Determine whether access is authorized and denied according to the established\n procedure. Ensure that access was:\n a.\t Authorized for a sample of users.\n b.\t Removed for terminated employees.\n c.\t Authorized and removed for users having emergency access.\n d.\t Authorized and removed for contractors with short-term access.\n 8)\t Review the password settings at the application level. Ensure that applications\n enforce the following:\n a.\t Passwords must be changed every 30 to 90 days.\n b.\t Passwords must be at least six alphanumeric characters.\n c.\t Passwords are prohibited from being reused for at least 180 days (six\n generations).\n d. Three failed logon attempts lock the user identification (ID).\n 9) Review the list of application user accounts to ensure that generic user IDs are not\n being used. Determine whether application users share IDs and passwords.\n 10) Obtain a list of all application responsibilities. \tDetermine whether users are\n appropriately assigned to responsibilities based on their job function and access\n needed.\n\n 2.\t Determine whether audit trails for protecting the database are effective. Examine\n management\xe2\x80\x99s actions to establish, maintain, and evaluate the audit trail reports at the\n operating system, application, and database levels. The completeness and value of the\n audit trails will be only as good as the entity\xe2\x80\x99s ability to identify the critical processes and\n related information they may need to deter and detect unauthorized access. (Note: This\n objective should address audits trails over the operating system level as a whole, and the\n application and database level for selected systems.)\n\n A.\t Ensure that the audit trails are properly established.\n 1) Verify that security and database activity logs are being generated.\n 2) Ensure that written policies and procedures are established, implemented, and\n approved by management regarding the generation and examination of security and\n database activity logs. Determine whether the policies and procedures are\n periodically evaluated to ensure their appropriateness and effectiveness.\n 3) Ensure that the procedures for responding to security violations include:\n a.\t Defining and documenting offenses (i.e., attempted unauthorized access,\n unsuccessful logon attempts, access to sensitive data and resources, privileged\n access, access modifications made by security personnel).\n b.\t Determining the seriousness of violations.\n c.\t Defining access trends and deviations from those trends.\n d.\t Reporting violations to higher levels of management.\n e.\t Investigating violations.\n f.\t Imposing disciplinary action for specific types of violations.\n\n\nwww.oig.dhs.gov 123\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n g.\t Notifying the resource owner of the violation.\n h.\t Reporting suspected criminal activity to law enforcement officials.\n B.\t Ensure that access controls over audit trail records are established and limited to system\n administrators and security administrators. Ascertain whether an employee\n independent of security and database administration reviews the log for security\n violations.\n 1) Identify whether audit logs record who accessed what database as well as the\n individual rows or columns of a table that were read, changed, or deleted, in\n addition to recording the execution of the database program. Determine whether\n Oracle auditing is turned on.\n 2) Verify that logs are reviewed daily and whether procedures have been established\n requiring this review.\n C.\t Ensure that audit trails are properly maintained and evaluated.\n 1) Verify whether responsibility has been assigned for receiving notification that audit\n logs are near capacity.\n 2) Determine whether write-once devices are utilized to protect the integrity of the\n audit trail data against modification.\n 3) Verify that only authorized modifications are being made to the security database by\n administrators.\n 4) Review audit logs to ensure that actual or attempted unauthorized, unusual, or\n sensitive access is monitored. Ensure that security violations are being summarized\n and reported to senior management.\n\n 3.\t Determine whether the operating system access control program and the database\n application control program limit and monitor access to law enforcement databases by\n controlling access to computer hardware and securing database applications supported by\n the system.\n\n A.\t Ensure that operating system controls provide a secure environment in which to run law\n enforcement database applications.\n 1) Determine that passwords are protected. Ensure that access control software\n enforces the following:\n a.\t Passwords must be changed every 30 to 90 days.\n b.\t Passwords must be at least six alphanumeric characters.\n c.\t Passwords a prohibited from being reused for at least 180 days (six generations).\n d.\t Three failed logon attempts lock the user identification.\n e.\t User IDs and passwords are unique to specific individual users and not to groups.\n f.\t Security administrators are using password analyzers to determine whether\n password conventions are being followed.\n g.\t Password files are encrypted.\n h.\t Security administrators identify inactive IDs and passwords and have\n implemented a procedure for deletion of inactive IDs and passwords.\n\n\nwww.oig.dhs.gov 124\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n i.Vendor-supplied passwords are replaced. Review for generic, guest, and user\n IDs with unusual names. Ensure the appropriateness of these types of UNIX IDs.\n 2) Ensure that security software is restricted to security administrators.\n 3) Review UNIX users who have the ability to logon as superusers and determine\n whether this type of access is appropriate.\n\n 4) Review directory and file level permissions settings. Ensure that: \n\n a.\t Access to critical files, application source code file, databases, load libraries,\n security files, and operating system files is limited to those individuals requiring\n access.\n b.\t Appropriate access control software parameters are implemented.\n c.\t Access control software files are secured from unauthorized use.\n d.\t Access to the database management system (DBMS) software is controlled.\n 5) Ensure that access to job scheduling is secure. Review appropriateness of current\n automated jobs scheduled (i.e., commands that are to run according to a regular or\n periodic schedule; for example, a job will automatically run every night to back-up all\n critical files to tapes that will be shipped off-site).\n 6) Ensure that security features cannot be modified during start-up.\n B.\t Ensure that database controls provide a secure environment for law enforcement data\n contained within the databases.\n 1) Determine whether the passwords for vendor-supplied user accounts have been\n changed. Examples include:\n a.\t INTERNAL \xe2\x80\x93 password ORACLE.\n b.\t SCOTT \xe2\x80\x93 password TIGER.\n c.\t SYSTEM \xe2\x80\x93 password MANAGER.\n d.\t SYS \xe2\x80\x93 password CHANGE_ON_INSTALL.\n e.\t DEMO \xe2\x80\x93 password DEMO.\n f. P08 \xe2\x80\x93 password P08. \n\n 2) Ensure that database user IDs are appropriately assigned. \n\n a.\t IDs are assigned to individual users and not to groups.\n b.\t Application users are not assigned multiple IDs.\n c.\t Operating System authenticated Oracle IDs are valid and current.\n d.\t DBMS owner ID and group are restricted to authorized system administration\n personnel and processes.\n 3)\t Review the Oracle user account profiles to ensure that password controls are \n\n implemented: \n\n a.\t Passwords must be changed every 30 to 90 days.\n b.\t Passwords must be at least six alphanumeric characters.\n c.\t Passwords may not be reused for at least 180 days (six generations).\n d.\t Three failed logon attempts lock out user ID.\n 4) In systems that grant users interactive database access through query tools and\n database tools (e.g., sqlplus and sqldba), ensure that user access is properly\n restricted through assignment of roles and privileges.\n\n\nwww.oig.dhs.gov 125\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n a.\t Ensure that the use of the DBMS utilities is limited.\n b. Ensure that the UTL_FILE_DIR profile variable is configured appropriately.\n 5) Ensure that DBMS and data dictionary controls restrict access to application data\n (for selected systems) at the logical data view, field, or field-value level.\n 6) Ensure that access is controlled to the data dictionary (for selected systems).\n 7) Ensure that access to the security profiles in the data dictionary and security tables\n in the DBMS is limited.\n 8) Ensure that appropriate data dictionary and DBMS parameters are implemented.\n C.\t Determine whether security support and operations job functions are performed by\n separate entities (i.e., job function).\n\n 4.\t Determine whether database administration for change control procedures is adequate by\n ascertaining whether the agency has instituted policies and implemented controls to ensure\n that all database modifications are properly authorized, tested and approved. Also,\n determine whether procedures are in effect to protect databases from unplanned system\n interruptions by ascertaining whether backup and recovery practices are properly in effect.\n\n A.\t Ensure that database change control policies, procedures, and practices provide\n assurance that only authorized changes are made and implemented.\n 1) Identify the process used and authorizing officials for initiating, approving, testing,\n and implementing changes to the database.\n 2) Examine a sample of database changes for proper authorization and approval (for\n selected systems).\n 3) Determine whether a separation of duties exists for implementing changes to law\n enforcement data by ensuring that:\n a.\t Application programmers do not have access to the production programs (for\n selected systems).\n b.\t Application programmers cannot access operating system software.\n c.\t Movement of programs and data (for selected systems) between libraries is\n controlled by an organization segment independent of both the user and\n programming staff.\n B.\t Ensure that a security specialist reviews the changes to the database prior to the change\n to determine whether (and if so, how) changes will affect security.\n C.\t Ensure that law enforcement data (for selected systems) can be restored in the event of\n an unplanned system interruption or when corruption of a database occurs.\n 1) Ensure that the agency Disaster Recovery Plan, Continuity of Operations Plan,\n and/or Business Resumption Plan provide for the ability to recover law enforcement\n data and provide service to meet the minimal needs of users of the system.\n 2) Review the contingency plan and compare its provisions with the most recent risk\n assessment and with current description of computer operations.\n 3) Ensure that the plan identifies all critical data files.\n\n\n\nwww.oig.dhs.gov 126\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 4) Ensure that a copy of a current contingency plan, which includes restoration of the\n database, is held off-site.\n 5) Ensure that plan reassessments are made as changes to the applications and \n\n databases supporting law enforcement data are conducted. \n\n 6) Ensure that plans that support the recovery of law enforcement data are tested and\n updated based on the test results.\n 7) Ensure that data and program back-up procedures exist and have been \n\n implemented. \n\n a.\t Ensure that written policies and procedures for backing-up the operating system,\n database, and application software exist. (Verify that all audit logs and data\n dictionary are part of the back-up procedure.)\n b.\t Ensure the adequacy of security and environmental controls at the back-up\n storage site.\n c.\t Ensure that database software being utilized is stored at an off-site location.\n Ensure that current data is being maintained by comparing inventory records\n with the database files (programs and data) maintained off-site and determining\n the age of these files.\n d.\t Ensure that the database administrator is responsible for planning the back-up\n and recovery of databases, and that data center personnel are responsible for\n routinely backing up files.\n e.\t Ensure that the agency has tested the recovery of the database using the\n back-up files.\n f.\t Ensure that security settings cannot be modified during the recovery start-up\n process.\n D.\t Ensure that controls exist over data dictionary modifications, such as additions and\n deletions (for selected systems). At a minimum, identify the following:\n 1) Ownership of the data dictionary.\n 2) The person authorized to make changes to the data dictionary.\n 3) Whether the most recent copy of the data dictionary is kept off-site for recovery\n purposes. \n\n 4) How often it is updated. \n\n 5) Whether old versions of the data dictionary are archived.\n\n E.\t Ensure that the agency\'s standard naming conventions for its resources, such as\n database files, program libraries, individual programs, and applications, are\n implemented and that security controls cannot be bypassed (for selected systems).\n F.\t Ensure that controls exist over database reorganization for selected systems\n (i.e., frequency based on volume, modifications, and deletions).\n G. Ensure that database performance (for selected systems) is monitored and evaluated.\n 1) Identify what maintenance is routinely performed on the database.\n 2) Verify whether exception reports are utilized in monitoring and evaluating database\n performance.\n\n\n\nwww.oig.dhs.gov 127\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 5.\t Determine whether controls exist for remote users utilizing data and data distribution.\n\n A.\t Ensure that access controls exist over data contained on laptops and other portable\n devices (e.g., personal digital assistant) utilized by users.\n 1.\t Ensure that there are policies and procedures regarding the protection of data\n contained on laptops and other portable devices.\n 2.\t Ensure that the policies and procedures provide for:\n a.\t Data encryption.\n b.\t Data to be password protected.\n c.\t Utilizing the key lock on the laptop.\n d.\t The hard drive containing data to be removed when not in use and stored in a\n secure location.\n e.\t Data contained on CD-ROM to be encrypted and stored in a secure location\n when not in use.\n B.\t Determine whether the distribution of output, which includes data and sensitive\n reports, is controlled. Further, determine whether encrypted fax systems are used to\n send sensitive information.\n C.\t Verify that report listings from personnel management systems contain appropriate\n sensitivity identifiers.\n D.\t Determine whether the remote access configuration for the operating system deters\n unauthorized access.\n 1) The /etc/hosts.equiv file and the .rhosts file in a user\'s home directory contain the\n names of remote hosts and users that are equivalent to the local host or user. An\n equivalent host or user is allowed to access a local non-superuser account without\n having to supply a password. Review these files for appropriateness.\n 2) The /etc/services file associates Internet service names and aliases with the port\n number and protocol used by the service. Review each service running for\n appropriateness.\n 3) The etc/inetd.conf and etc/inetd.conf.local files determine how to handle Internet\n service requests. Review for appropriateness.\n 4)\t The UNIX-to-UNIX-Copy (UUCP) utility is a group of programs that enable you to\n connect to remote systems using a modem and telephone lines. Perform the\n following:\n a.\t Execute cat/usr/lib/uucp/Devices and document what ports and modem devices\n are set up for dialing out. Review for appropriateness.\n b.\t Execute cat/usr/lib/uucp/Systems and document. Review for appropriateness\n each remote system defined and what systems it is set up to call.\n c.\t Execute cat/usr/lib/uucp/Permissions to identify what permissions remote\n machines have with respect to login, file access, and command execution.\n Determine the appropriateness of the settings.\n d.\t Determine the appropriateness of the remote.unknown program setting\n (enabled or disabled), which is usually found in /usr/lib/uucp/remote.unknown.\n\n\nwww.oig.dhs.gov 128\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n E.\t Determine whether the remote access configuration for the Oracle database deters\n unauthorized access.\n 1) Obtain the current parameter values (V$PARAMETER) and review the following:\n a.\t Determine appropriateness of protocols defined by MTS_LISTENER_ADDRESS.\n b.\t Determine whether Oracle is set to check passwords in the password file by\n reviewing REMOTE_LOGIN_PASSWORDFILE.\n c.\t Determine the appropriateness of allowing authentication of remote clients by\n reviewing REMOTE_OS_AUTHENT.\n d.\t Determine the appropriateness of allowing operating system roles for remote\n users by reviewing REMOTE_OS_ROLES.\n\n\n\n\nwww.oig.dhs.gov 129\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix K\n Objectives for Evaluating UNIX Operating System Security\n Overall Objective\n The overall objective of this audit is to determine whether the agency has implemented\n controls to effectively manage UNIX operating system security.\n\n Detailed Sub-Objectives\n\n 1.\t Determine whether system controls have been properly implemented. (Note: These steps\n will apply to all UNIX and Linux versions.)\n\n A.\t Assess whether the UNIX host is configurable and bootable in single-user mode, without\n a password.97\n B.\t Ensure that single-user mode incompatibility is documented.\n C.\t Verify whether a UNIX host that is not configured to require a password when booted to\n single-user mode is located in a controlled accessed area only by system\n administrators.98\n D.\t Determine whether UNIX system equipment is located in a controlled-access area.\n E.\t Determine whether the UNIX operating system version is a supported release.\n F.\t Assess whether vendor-recommended and security patches are installed and not \n\n out-of-date. \n\n G. Identify whether a system baseline was created and maintained.99\n H. Verify whether system baseline backups are stored on write-protected media.\n I.\t Determine the frequency of file systems checked for unauthorized system libraries or\n binaries or unauthorized modification to authorized system libraries or binaries.\n J.\t Identify whether a non-local/non-authoritative time server (protocol) is used.\n\n 2.\t Determine whether access controls have been properly implemented. (Note: These steps\n will apply to all UNIX and Linux versions.)\n\n A.\t Identify whether shared accounts are documented and justified.\n B.\t Verify whether a shared account is logged onto directly.\n C.\t Determine whether assigned accounts are unique.\n 1) Ensure that accounts have not been assigned the same user identification (ID).\n 2) Identify whether a user ID reserved for system accounts is used.\n\n 97\n A UNIX system is in a single-user mode when applications and third party software are not actively running. \n\n During this state, the system is vulnerable to configuration changes if a password is not present.\n\n 98\n An access-controlled area is defined as requiring two different checks of an individual\xe2\x80\x99s identity and authority\n\n before gaining access to the system. \n\n 99\n A system baseline includes cryptographic hashes of files in the baseline. \n\n\n\nwww.oig.dhs.gov 130\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 3) Ensure that only the root user is assigned a user ID of 0.\n D.\t Identify whether all accounts with a Group ID (GID) of 99 and below (499 and below for\n Linux) are used by a system account. All groups should have an individual and unique\n GID.100\n E.\t Ensure that a group referenced in the /etc/passwd file is not in the /etc/group file.\n F.\t Verify that a logon banner is displayed prior to a logon attempt.\n 1) Ensure that login banners are configured for all services that allow login access to\n the system.\n 2) Identify whether the login banner contains the required notice and consent\n information.\n G. Verify that successful and unsuccessful logins and logouts are logged.\n 1) Ensure that an account is disabled after three consecutive unsuccessful login\n attempts.\n 2) Verify that the delay between login prompts after a failed login is set to at least four\n seconds.\n 3) Identify whether the inactivity timeout/locking feature is configured for 15 minute\n intervals.\n 4) Determine whether the UNIX system is running under continuous display mode.\n H. Assess the password controls that are used. \n\n 1) Determine whether passwords can be changed once every 24 hours. \n\n 2) Identify whether there are accounts with blank passwords. \n\n 3) Verify that a password contains a minimum of 14 characters. \n\n 4) Verify that a password contains at least 1 upper and 1 lower case alphabetic \n\n character, 1 numeric character, and 1 special character.\n 5) Ensure that a password does not contain information.\n 6) Assess whether passwords are changed every 60 days.\n 7) Verify whether non-interactive/automated processing account passwords are\n changed.\n 8) Identify whether an account is locked or disabled after 35 days of inactivity.\n 9) Determine whether easily guessed passwords are used.\n 10) Ensure passwords cannot be reused within the last 5 changes.\n 11) Determine whether passwords are configured according to guidelines.\n I.\t Ensure that access to the root account is limited to security and administrative users\n and are documented.\n J.\t Verify whether administrative passwords are changed when an individual with access to\n the root password is reassigned.\n K.\t Identify whether the root account home directory has not been changed from \xe2\x80\x98/\xe2\x80\x99.\n 1)\t Determine whether the root account home directory (other than \xe2\x80\x98/\xe2\x80\x99) is more\n permissive than 700.\n\n\n 100\n Shared GID numbers could lead to undesirable file and directory access.\n\n\nwww.oig.dhs.gov 131\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 2) Identify whether the root account\xe2\x80\x99s search path contains a \xe2\x80\x98.\xe2\x80\x99, \xe2\x80\x98::\xe2\x80\x99, or starts or ends\n with a \xe2\x80\x98:\xe2\x80\x99.\n 3)\t Ensure that the root account has world writable directories in its search path.\n 4)\t Determine whether the root account can be directly logged into from somewhere\n other than the system console.\n 5) Verify whether remote consoles are defined.\n 6) Assess whether the root account is logged onto directly.\n 7) Verify whether successful and unsuccessful accesses to the root account are logged.\n 8) Verify whether the root shell is located in /usr, and /usr is partitioned.\n 9) Assess whether the root password is passed over a network in clear text form.\n 10) Perform the following to determine whether root has logged in over an unencrypted\n network connection:\n a)\t Determine whether root was logged in over a network.\n b)\t Check to ensure that Secure Shell (SSH) is installed.\n 11) Assess whether an encrypted remote access program, such as SSH, does not disable\n the capability to logon directly as root.\n L.\t Assess whether there are files or directories with uneven access permissions.101\n M. Identify whether there are unowned files.\n N. Assess whether network services daemon files, the system command, and the library\n file are more permissive than 755.102\n O. Ensure that system files, programs, and directories are owned by a system account and\n system group.\n P.\t Verify whether the system log file is more permissive than 640.\n Q. Verify whether the manual page file is more permissive than 644.\n R.\t Assess whether NIS/NIS+/yp files are owned by root, sys, or bin.\n 1) Verify that NIS/NIS+/yp files are not group-owned root, sys, bin, or other.\n 2) Verify whether the NIS/NIS+/yp command file is more permissive than 755.\n 3) Verify whether the /etc/passwd file is more permissive than 644.\n 4) Verify that the /etc/passwd and /etc/shadow (or equivalent) file is not owned by\n root.\n 5) Verify whether the /etc/shadow (or equivalent) file is more permissive than 400.\n S.\t Determine whether a home directory defined in the /etc/passwd file exists.\n 1) Determine whether users are assigned a home directory in the /etc/passwd file.\n 2) Verify whether the user home directory(s) is more permissive than 750.\n 3) Verify whether the user home directories contain files/directories more permissive\n than 750. \n\n 4) Verify whether users own their home directory.\n\n\n\n 101\n Uneven file permission exists if the file owner has less privileges than the group or world users, and when the \n\n file is owned by a privileged user or group (such as root or bin). \n\n 102\n In multitasking computer operating systems, a daemon is a computer program that runs as a background \n\n process, rather than being under the direct control of an interactive user. \n\n\n\nwww.oig.dhs.gov 132\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 5) Verify whether home directories are group-owned by the home directory owner or\n primary group.\n 6) Assess whether user home directories contain files/directories owned by the home\n directory owner.\n\n 3.\t Determine whether general controls have been properly implemented. (Note: These steps\n will apply to all UNIX and Linux versions.)\n\n A.\t Verify whether the NIS protocol is used while the NIS+ protocol is available.\n B.\t Determine whether NIS/NIS+ is implemented under User Datagram Protocol.\n C.\t Identify whether NIS maps are protected through hard-to-guess domain names.\n D.\t Determine whether the NIS+ server is operating at security level 2.\n E.\t Assess whether the .rhosts, .shosts, hosts.equiv, or shosts.equiv are used, not justified,\n and documented with the Information Assurance Officer (IAO).\n F.\t Identify whether the shell files have the suid bit set.\n G. Identify whether the finger service is enabled.\n H. Evaluate whether Anonymous File Transfer Protocol (FTP) has been configured using all\n security recommendations.\n I.\t Identify whether FSP is enabled.\n J.\t Determine whether the Trivial File Transfer Protocol (TFTP) daemon is running in secure\n mode.\n 1) Identify whether the TFTP daemon has the suid or sgid bit set.\n 2) Assess whether TFTP is active.\n 3) Verify whether TFTP that is active is justified and documented with the IAO.\n K.\t Identify whether a system is exporting X displays to the world.\n L.\t Ensure that the Simple Network Management Protocol (SNMP) community strings have\n been changed from the default.\n M. Identify whether remote login or remote shell is enabled.\n N. Identify whether the rexec service is enabled.\n O. Assess whether an audio device is: \n\n 1) More permissive than 644. \n\n 2) Not owned by root. \n\n 3) Not group-owned by root, sys, bin, or audio.\n\n P.\t Identify whether the ownership, permissions, and location of files with the suid bit set\n are documented with the IAO.\n 1) Assess whether the system is checked weekly against the system baseline for\n unauthorized suid files as well as unauthorized modification to authorized suid files.\n 2) Identify whether the user file systems, removable media, or remote file systems are\n mounted with the nosuid option invoked.\n 3) Identify whether the ownership, permissions, and location of files with the sgid bit\n set are documented with the IAO.\n\n\n\nwww.oig.dhs.gov 133\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 4) Assess whether the system is checked weekly against the system baseline for\n unauthorized sgid files as well as unauthorized modification to authorized sgid files.\n Q. Determine whether the public directories are not owned by root or an application user.\n R.\t Ensure that the public directories are not group-owned by root, sys, bin, other or an\n application group.\n S.\t Evaluate whether development systems are subject to the same security requirements\n as production systems.\n T.\t Ensure that default accounts have been disabled.\n U. Determine whether access to the cron utility is controlled via the cron.allow and/or\n cron.deny file(s).103\n 1) Identify whether the cron.allow file is more permissive than 600.\n 2) Evaluate whether cron executes group or world writable programs.\n 3) Assess whether cron executes programs in or subordinate to world writable\n directories.\n 4) Ensure that the crontabs are owned by root or the crontab creator.\n 5) Identify whether the default system accounts (with the possible exception of root)\n are listed in the cron.allow file or excluded from the cron.deny file if cron.allow does\n not exist.\n 6) Identify whether the crontab files are more permissive than 600 (700 for some Linux\n files).\n 7) Identify whether the cron or crontab directories are more permissive than 755.\n 8) Ensure that the cron or crontab directories are not owned by root or bin.\n 9) Ensure that the cron or crontab directories are group-owned by root, sys, or bin.\n 10) Verify whether cron logging is implemented.\n a.\t Assess whether the cronlog file is more permissive than 600.\n b.\t Assess whether the cron.deny file is more permissive than 700.\n c.\t Identify whether the cron.allow file is not owned and group-owned by root, sys\n or bin.\n d.\t Identify whether the cron.deny file is not owned and group-owned by root, sys,\n or bin.\n V.\t Determine whether access to the at utility is controlled via the at.allow and/or at.deny\n file(s).\n 1) Identify whether the at.deny file exists and is empty.\n 2) Ensure that the default system accounts (with the exception of root) are listed in the\n at.allow file or excluded from the at.deny file if at.allow does not exist.\n 3) Assess whether the at.allow or at.deny file(s) is more permissive than 600.\n 4) Identify whether the at executes group or world writable programs.\n 5) Identify whether the at executes programs in or subordinate to world writable\n directories.\n\n 103\n The cron utility is the time-based job scheduler in Unix-like computer operating systems. Cron enables users to\n schedule jobs (commands or shell scripts) to run periodically at certain times or dates.\n\n\nwww.oig.dhs.gov 134\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 6) Assess whether the at (or equivalent) directory is more permissive than 755. \n\n 7) Ensure that the at directory is not owned by root, sys, bin, or daemon. \n\n W. Determine whether there are any at jobs by viewing a long listing of the directory. \tIf\n there are at jobs, perform the following to check for any programs that may have an\n unmask more permissive than 077:\n 1) Assess whether the at.allow file is not owned and group-owned by root, sys, or bin.\n 2) Identify whether the at.deny file is not owned and group-owned by root, sys, or bin.\n 3) Evaluate whether the executable stack is disabled.\n X.\t Determine whether random Transmission Control Protocol sequence numbers are used. \n\n Y.\t Evaluate whether network parameters are securely set.\n\n Z. Identify whether logging is implemented for the root file system. \n\n AA. Determine whether authentication and informational data is logged. \n\n BB. Determine whether the run control scripts execute world writable programs or scripts. \n\n Also: \n\n 1) Identify whether the run control scripts are more permissive than 755. \n\n 2) Determine whether the run control scripts PATH variable contains a \xe2\x80\x98.\xe2\x80\x99 or a \xe2\x80\x98::\xe2\x80\x99, or \n\n starts or ends with a \xe2\x80\x98.\xe2\x80\x99.\n 3) Evaluate whether the run control scripts have the sgid or the suid bit set.\n 4) Ensure that the run control scripts are not owned by root or bin.\n 5) Ensure that the run control scripts are not group-owned by root, sys, bin, other or\n the system default.\n 6) Evaluate whether the run control scripts execute programs owned by neither a\n system account nor an application account.\n CC. Assess whether the global initialization files are more permissive than 644.\n 1) Ensure that global initialization files are not owned by root.\n 2) Ensure that global initialization files are not group-owned by root, sys, bin, other, or\n the system default.\n 3) Determine whether the global initialization files PATH variable contains a \xe2\x80\x98.\xe2\x80\x99 or a \xe2\x80\x98::\xe2\x80\x99,\n or starts or ends with a \xe2\x80\x98:\xe2\x80\x99.\n 4) Identify whether the global initialization files contain the command mesg \xe2\x80\x93n.\n DD.Assess whether the default skeleton \xe2\x80\x98.\xe2\x80\x99 files are more permissive than 644.\n EE. Ensure that the default skeleton \xe2\x80\x98.\xe2\x80\x99 files are not owned by root or bin.\n FF. Identify whether the local initialization files are owned by the user or root.\n 1) Assess whether the local initialization files are more permissive than 740.\n 2) Determine whether the local initialization files PATH variable contains a \xe2\x80\x98.\xe2\x80\x99 or a \xe2\x80\x98::\xe2\x80\x99, or\n starts with a \xe2\x80\x98.\xe2\x80\x99.\n 3) Identify whether the local initialization files have the suid or the sgid bit set.\n 4) Determine whether the local initialization files execute world writable programs or\n scripts. \n\n 5) Identify whether the local initialization files contain the mesg -y or mesg y \n\n command. \n\n\n\n\nwww.oig.dhs.gov 135\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n GG. Evaluate whether the .rhosts, .shosts, hosts.equiv, shosts.equiv, /etc/passwd, \n\n /etc/shadow, and/or /etc/group files contain a plus (+) and define entries for NIS+ \n\n netgroups. \n\n 1) Identify whether an A .netrc file exists. \n\n 2) Determine whether the .rhosts, .shosts, hosts.equiv, or shosts.equiv files contain \n\n other than hostname-user pairs, are justified, and documented with the IAO.\n 3) Identify whether the .rhosts, .shosts, hosts.equiv, shosts.equiv, or .netrc files are\n accessible by users other than root or the owner.\n 4) Evaluate whether the .rhosts file is supported in PAM.\n 5) Determine whether the /etc/shells (or equivalent) file does not exist.\n 6) Identify whether the A shell referenced in /etc/passwd is not listed in the shells file.\n 7) Determine whether the shell files have the sgid bit set.\n 8) Identify whether shell files are owned by root or bin.\n 9) Assess whether the shell files are more permissive than 755.\n HH.Determine whether the device file directories are writable by users other than a system\n account or as configured by the vendor.\n II.\t Identify whether the device files used for backup are writable by users other than root\n or a pseudo backup user.\n JJ. Assess whether the Network File System(NFS) exported system files and system \n\n directories are not owned by root. Evaluate whether: \n\n 1) The NFS server is configured to deny client access requests that do not include a \n\n userid.\n 2) The NFS server is configured to restrict file system access to local hosts\n 3) The sec option is set to none (or equivalent); additionally the default authentication\n is set to none.\n 4) The root access option for NFS has been justified and documented with the IAO.\n 5) The nosuid and nosgid options are not enabled on a NFS Client.\n 6) NFS file systems exported as writable have been justified and documented by the\n IAO.\n KK. Identify whether a public instant messaging client is installed.\n LL. Identify whether a peer-to-peer file-sharing application is installed and, if so, ensure\n that it is authorized and documented with the designated accreditation authority.\n MM. Evaluate whether Samba is running and is not operationally required.\n NN. Determine whether the Samba Web Administration tool is not used with SSH\n port-forwarding.\n OO. Determine whether network analysis tools are enabled.\n PP. Determine whether the /etc/server message block (smb).conf file is: \n\n 1) Not owned by root. \n\n 2) Not group-owned by root. \n\n 3) More permissive than 644. \n\n QQ.\t Determine whether the /etc/samba/smbpasswd file is:\n 1) Not owned by root.\n\n\nwww.oig.dhs.gov 136\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 2) Not group owned by root.\n 3) More permissive than 600.\n RR. Determine whether the smb.conf file is not configured to:\n 1) Set the hosts allow option to contain only the local network subnet masks and the\n loopback address. \n\n 2) Set the security option to user. \n\n 3) Set the encrypt passwords option to yes. \n\n 4) Enter the path to the smbpasswd utility in the smb password file option. \n\n SS. Ensure that all guest entries in the shares definition section of the smb.conf file are set\n to no.\n TT. Identify whether an Internet network news server is justified and documented by the\n IAO.\n 1) Assess whether the /etc/news/hosts.nntp file is more permissive than 600.\n 2) Assess whether the /etc/news/hosts.nntp.nolimit file is more permissive than 600.\n UU.\t Identify whether the system is a print server/client, and the configuration is\n documented with the IAO.\n 1) Assess whether the /etc/news/nnrp.access file is more permissive than 600.\n 2) Assess whether the /etc/news/passwd.nntp file is more permissive than 600.\n 3) Determine whether the files contained in the /etc/news directory are not owned by\n root or news.\n 4) Determine whether the files contained in the /etc/news directory are not group-\n owned by root or news.\n VV. Identify whether the hosts.lpd file (or equivalent) contains a \xe2\x80\x98+\xe2\x80\x99 or \xe2\x80\x98_\xe2\x80\x99 character.\n 1) Assess whether the hosts.lpd (or equivalent) file is not owned by a root, sys, bin, or\n lp.\n 2) Assess whether the hosts.lpd (or equivalent) file is more permissive than 664.\n WW. Identify whether the traceroute command is not owned by root.\n 1) Ensure that the traceroute command is not group owned by root, sys, or bin.\n 2) Assess whether the traceroute command is more permissive than 700.\n XX. Determine whether all inetd/xinetd services are disabled, and inetd (xinetd for Linux) is\n not disabled.\n 1) Assess whether the inetd.conf (xinetd.conf for Linux) file is more permissive than\n 440.\n 2) Identify whether the Linux xinetd.d. directory is more permissive than 755. \n\n YY. Determine whether the services file is not owned by root or bin. \n\n ZZ. Ensure that the ftpusers file does not exist\n\n 1) Assess whether the ftpusers file contains account names not allowed to use FTP. \n\n 2) Identify whether the ftpusers file are not owned by root. \n\n 3) Assess whether the ftpusers file is more permissive than 640. \n\n 4) Assess whether the services file is more permissive than 644. \n\n 5) Determine whether the FTP daemon is configured for logging or verbose mode. \n\n 6) Identify whether there is an anonymous FTP account with a functional shell. \n\n\n\nwww.oig.dhs.gov 137\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 7) Ensure that an FTP user\xe2\x80\x99s unmask is not 077.\n AAA. Determine whether TFTP is configured to vendor specifications, including the following:\n 1) A TFTP user will be created.\n 2) The default shell will be set /bin/false, or equivalent.\n 3) A home directory owned by the TFTP user will be created.\n BBB. Determine whether an X Windows host writes .Xauthority files (or equivalent).\n 1) Identify whether Xauthority files are more permissive than 600.\n 2) Evaluate whether authorized X clients are not listed in the X*.hosts (or equivalent)\n file(s) if the .Xauthority utility is not used.\n 3) Ensure that an authorized X clients are not listed in the X*.hosts (or equivalent)\n file(s) if the .Xauthority utility is not used.\n 4) Assess whether the X window system connections are not required, but the\n connections are not disabled.\n CCC. Identify whether the Unix-to-Unix Copy service is enabled.\n\n DDD. Identify whether the snmpd.conf file is more permissive than 700. \n\n EEE. Assess whether the management information base (mib) files are more permissive than \n\n 640. \n\n FFF. Identify whether the snmpd.conf and .mib files are not owned by root and group-\n\n owned by sys or the application.\n GGG. Identify whether SNMP runs on dedicated hardware.\n HHH. Determine whether SSH, or a similar utility, is running and SSHv1 compatibility is used.\n III. Evaluate whether encrypted communications are configured for Internet Protocol (IP)\n filtering and logon warning banners.\n JJJ. Ensure that the system is not a router and has no defined default gateway.\n 1) Identify whether a system used for routing also uses other applications and/or\n utilities.\n 2) Determine whether IP-forwarding is disabled.\n KKK. Assess whether a system running Squid Web Proxy Cache is vulnerable to the MSNT\n auth helper buffer overflow exploit.\n LLL. Identify whether NFS port monitoring is enabled.\n MMM. Determine whether the export configuration file is owned by root.\n NNN. To determine whether the NIS protocol is in use and not justified and documented with\n the IAO. \n\n OOO.Identify whether there is a host-based intrusion detection tool. \n\n PPP. Identify whether a system vulnerability assessment tool is being run on the system \n\n monthly.\n QQQ.\t Verify whether the system vulnerability assessment tool, host-based intrusion detection\n tool, and file system integrity baseline tool notify the systems administrator and the\n information awareness office of a security breach or a suspected security breach.\n RRR. Identify whether an access control program is being used.\n 1) Determine whether the access control program logs each system access attempt.\n\n\n\nwww.oig.dhs.gov 138\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 2) Assess whether the access control program is configured to grant or deny system\n access to specific hosts.\n SSS. Identify whether an approved virus scan program is used and updated.\n 1) Check for the existence of the MacAfee command line scan tool to be executed\n weekly in the cron file.104\n 2) Ensure that the definitions file is not older than 14 days. \n\n TTT. Identify whether the sticky bit is set on public directories.\n\n UUU. Ensure that the system and user default unmask are not 077. \n\n 1) Assess whether the applications requiring an unmask more permissive than 077 are\n justified and documented with the IAO.\n 2) Assess whether the Cron programs requiring an unmask more permissive than 077\n are justified and documented with the IAO.\n VVV. Identify whether core dumps are disabled.\n WWW. Ensure that the core dump data directory is not owned or group-owned by root or is\n more permissive than 700.\n XXX. Evaluate whether separate file system partitions are used for /home, /export/home,\n and /var and are justified and documented with the IAO.\n YYY. Determine whether the system is checked weekly against the system baseline for\n extraneous device files.\n ZZZ. Evaluate whether network services required for operations are not disabled or\n documented with the IAO.\n AAAA. Ensure that the inetd.conf file (xinetd.conf file and the xinetd.d directory for Linux) is\n not owned by root or bin.\n BBBB. Determine whether Inetd (xinetd for Linux) logging/tracing is enabled.\n CCCC. Determine whether a Lotus Domino 5.0.5 Web Application was found vulnerable to the\n .nsf, .box, and .ns4 directory traversal exploit.\n DDDD. Evaluate whether a system running Squid Web Proxy Cache server is vulnerable to the\n authentication header forwarding exploit. If so, verify whether the systems\n administrator will ensure the Squid Proxy Cache server is not a vulnerable version.\n EEEE.\t Determine whether an iPlanet web server was found with the search engine NS-query-\n pat file viewing vulnerability.\n FFFF. Identify whether the export configuration file is more permissive than 644.\n\n 4.\t Determine whether audit log controls have been properly implemented. (Note: These\n steps will apply to all UNIX and Linux versions.)\n\n A.\t Identify whether auditing is implemented.\n B.\t Ensure that unauthorized users cannot access system audit logs.\n C.\t Assess whether system audit logs are more permissive than 640.\n\n 104\n The MacAfee command line scanner is available for most Unix/Linux operating systems. Additional tools\n specific for each operating system are also available and will have to be manually reviewed if they are installed.\n\n\nwww.oig.dhs.gov 139\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n D.\t Identify whether the audit system is configured to audit the following:\n 1) Failed attempts to access files and programs.\n 2) Files and programs deleted by the user.\n 3) All administrative, privileged, and security actions.\n 4) Login, logout, and session initiation.\n 5) All discretionary access control permission modifications.\n E.\t Identify whether audit logs are rotated daily.\n F.\t Determine whether audit data is retained for at least 1 year or synchronized accessible\n media interchange audit data is retained for 5 years.\n G. Assess whether audit data is backed up onto a different system or backup media on at\n least a weekly basis.\n H. Determine whether the audit trails and/or system logs are reviewed on a daily basis for:\n 1) Excessive logon attempt failures by single or multiple users.\n 2) Logons at unusual/non-duty hours.\n 3) Failed attempts to access restricted system or data files indicating a possible pattern\n of deliberate browsing. \n\n 4) Unusual or unauthorized activity by system administrators. \n\n 5) Command-line activity by a user that should not have that capability. \n\n 6) System failures or errors. \n\n 7) Unusual or suspicious patterns of activity. \n\n I.\t Ensure that the /etc/syslog.conf file is not owned by root or is more permissive than\n 640.\n J.\t Ensure that the /etc/syslog.conf file is not group owned by root, sys, or bin.\n K.\t Identify whether local hosts are used as loghosts for systems outside the local network.\n L.\t Ensure that a system using a remote loghost is not documented with the IAO.\n M. Verify that the syslog daemon accepts remote messages and is not an IAO-documented\n loghost.\n\n\n\n\nwww.oig.dhs.gov 140\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix L\n Objectives for Evaluating Remote Access Controls and Security\n Overall Objective\n The overall objective of this audit is to determine whether the agency has provided system\n security, integrity, and control over remote access to its computer systems and data.105\n\n Detailed Sub-Objectives\n\n 1.\t Evaluate whether the agency has developed adequate security policies and procedures for\n granting and controlling remote access to system resources through a Virtual Private\n Network (VPN).\n A.\t Assess whether VPN firewalls: Deny and log all services not expressly permitted.\n 2) Audit and monitor all services.\n 3) Stop passing packets if logging is disabled.\n 4) Do not implement the Dynamic Host Configuration Protocol service.\n 5) Implement and authenticate Network Time Protocol.\n 6) Employ current operating system versions.\n 7) Log sufficient activity to facilitate forensic analysis.\n 8) Authenticate route updates using the MD5 hashing algorithm.\n 9) Implement session timeouts of at most # minutes.\n 10) Modified the Simple Network Management Protocol community strings (passwords)\n from their default values. \n\n 11) Mitigate denial of service.\n\n 12) Back-up logs for at least 1 year or as directed by the records office. \n\n 13) Use encrypted connections to access the firewalls. \n\n B.\t Analyze whether VPN controls comply with agency policy or best practices:\n 1)\t Ensure that all remote access users have unique user identifications, passwords\n comply with complexity requirements, and two-factor authentication is used\n according to Payment Card Industry standards.\n 2) Allow the lowest level of encryption the server will negotiate, ensuring that\n minimum required encryption standards are enforced (Advanced Encryption\n Service/Triple Data Encryption Standard).\n 3) Ensure that client-side software prohibits split tunnels. \n\n 4) Enable client workstation security to address the following:\n\n a.\t Client workstations that do not meet security requirements are quarantined or\n blocked.\n b.\t Determine whether traces of session information are left on remote computer\n after session termination (servers push software to clear client cache).\n\n 105\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 141\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n c. Limit non-ACE client\xe2\x80\x99s network access and perform client configuration checks.106\n 5) Ensure that warning banners are displayed prior to logon.\n 6) Ensure that only ACE workstations have unrestricted access to the agency network.\n 7) Determine whether users are restricted to a specific set of applications through\n WebVPN.\n 8) Ensure that restricted access is provided through an indirect, secure mechanism.\n 9) Determine whether aggressive mode is required for authentication purposes.\n (Note: Used only for Internet Protocol [IP] Security.)\n a.\t If not required, it should be disabled at the server (Cisco configuration\n parameter).\n b.\t If it is required, then:\n i.\t Ensure that digital certificates or other two-factor authentication methods\n are used.\n ii. Ensure that the use of pre-shared keys is prohibited.\n 10) Determine whether VPN infrastructure devices/servers are patched and have the\n current operating system.\n 11) Determine whether the operating system is configured to limit services, and has\n antivirus and all current patches installed.\n C.\t Determine whether management approval controls comply with agency policy or best\n practices:\n 1) Ensure that management controls align with agency policy or best practices.\n 2) Employ statistical sampling to make conclusions regarding user population.\n 3) Ensure that the samples of remote access users for each environment are still active\n employees.\n 4) Ensure that when user accounts are disabled in Active Directory, access is revoked.\n 5) Ensure that electronic access approvals were obtained for each user in the sample.\n 6) Ensure that all users have attended security awareness training or user acceptance\n training prior to obtaining access to remote access environment.\n\n 2.\t Determine whether the agency maintains a computer incident database and whether\n information stored within the computer incident tracking database is sufficiently reliable.\n\n A.\t Data Attribute Definition \xe2\x80\x93 define the data attributes and expected values of the \n\n computer incident tracking database to determine attributes for testing. \n\n B.\t Data Identifiers \xe2\x80\x93 for the attributes defined above, determine whether invalid or \n\n duplicate identifiers exist in the computer incident tracking database. \n\n C.\t Duplicate Records \xe2\x80\x93 determine whether duplicate records exist in the computer incident\n tracking database.\n\n\n 106\n ACE is an embeddable code editor written in JavaScript. It matches the features and performance of native\n editors such as Sublime, Vim, and TextMate.\n\n\nwww.oig.dhs.gov 142\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n D.\t Missing Data \xe2\x80\x93 for the attributes defined above, determine whether missing data values\n or records exist in the computer incident tracking database.\n E.\t Data Values \xe2\x80\x93 for the attributes defined above, determine whether the computer\n incident tracking system contains data values outside of the designated range.\n F.\t Timeliness \xe2\x80\x93 for the attributes defined above, determine whether the incident dates are\n within valid time periods and follow a logical progression.\n G. Data Validation and Edit Checks \xe2\x80\x93 determine whether data validation and edit checks\n exist and work as intended.\n H. Completeness Testing \xe2\x80\x93 select a judgmental sample of incident tickets and trace the\n tickets to the record set to determine whether record sets are complete.\n I.\t Gap Analysis \xe2\x80\x93 determine whether the structure of the incident database follows\n industry suggested practices.\n 3.\t Determine whether the security controls over the agency\xe2\x80\x99s public-facing web infrastructure\n adequately protect the agency applications and data.\n A.\t Agency Documented Web Servers \xe2\x80\x93 determine the IP addresses, Fully Qualified Domain\n Name (FQDN), location, and responsible personnel for all agency public-facing web\n servers.\n 1) Obtain a list from the agency of IP addresses belonging to public-facing web servers. \n\n 2) Request the FQDN for the servers.\n\n 3) Determine which web servers belong to which application(s). \n\n 4) Determine responsible personnel for each group of applications or each web server \n\n and obtain a point of contact.\n 5) Query agency business owners to determine whether there are additional\n public-facing web servers in the environment that do not fall under the\n responsibility of the information technology department.\n B.\t Office of Inspector General (OIG) Discovery \xe2\x80\x93 determine the IP addresses for all agency\n public-facing web servers through OIG scanning tools.\n 1) Use a scanning tool to perform discovery on the agency\xe2\x80\x99s network environment.\n 2) If necessary, perform a scan using Nmap to determine the environment.\n 3) Identify all public-facing web servers belonging to the respective domains known by\n Google.\n 4) Analyze results to determine IP addresses, server name, locations, and hosts that\n belong to all agency public-facing web servers.\n C.\t Test Plan\n 1) Gather information related to applications for web server sample.\n 2) Determine the criticality rating and key contact personnel for each application\n within the audit scope.\n 3) Gather background information for the applications within the audit sample.\n 4) Schedule meetings with key personnel for each application.\n 5) Determine any scope limitations and document the sample.\n D.\t UNIX Systems\n\n\nwww.oig.dhs.gov 143\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 1) Using the scan results from scanning software, such as GFI Languard and Nessus,\n determine whether the UNIX operating systems are consistently patched and\n configured in accordance with agency policy or best practices.\n 2) Using the scan results, determine whether UNIX system accounts:\n a. Store passwords in one-way encrypted format.\n b. Have enabled password shadowing.\n c. Have a minimum password length of # characters.\n d. Have enabled password quality checking to meet policy.\n e. Are subject to password aging on all accounts.\n f. Have a minimum password age of at least 1 day.\n g. Enable account lock-outs after # failed logon attempts.\n h. Automatically suspended after the required maximum number of unsuccessful\n logon attempts.\n 3) Using the scan results, determine whether UNIX system file system security:\n a. Uses \xe2\x80\x9cno s-uid\xe2\x80\x9d Option for non-system partitions.\n b. Disables user-mounted removable file systems.\n c. Configures /var on its own partition.\n 4) Using the scan results, determine whether the UNIX server has the current patches\n installed.\n 5) Using the scan results, determine whether the UNIX server has:\n a. Set password expiration on active accounts.\n b. No accounts with empty password fields.\n c. No user identification 0 accounts other than root.\n d. Eliminate root path containing current directory.\n e. Forbid root to logon remotely.\n f. Set root\'s umask.\n g. Eliminate the use or R commands.\n h. Restrict Ability to run su.\n i. Create an approved security message.\n j. Establish console timed lockout.\n 6) Using the scan results, determine whether the UNIX server has:\n a. Configured Transmission Control Protocol wrappers to limit access.\n b. Disabled File Transfer Protocol.\n c. Disabled rlogin/rsh/rcp.\n d. Disabled Trivial File Transfer Protocol server.\n e. Disabled Kerberized rlogin.\n f. Disabled rquotad.\n g. Disabled Common Desktop Environment related daemons.\n h. Disabled inetd.\n i. Disabled E-mail server.\n j. Disabled Network Information Service Client/Server.\n k. Disabled Network File System Client/Server.\n\n\nwww.oig.dhs.gov 144 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n l.\t\n Disabled graphical user interface logon.\n m.\n Disabled services that are not commonly used.\n n.\t\n Set network configuration settings.\n o.\t\n Disabled unnecessary services and daemons.\n p.\t\n Disabled Secure Sockets Layer/Transport Layer Security Server Support For Weak\n Cipher Algorithm.\n q.\t Disabled telnet service.\n r. Disabled the use of xhost. \n\n 7) Configurations for necessary services: \n\n a.\t Ensure that OpenSSH is up-to-date.\n b. Eliminate Anonymous File Transfer Protocol. \n\n 8) Console Security: Set Password on the Grand Unified Bootloader. \n\n E. Windows Systems\n 1) Using the scan results from scanning software, such as GFI Languard and Nessus,\n determine whether if the Windows operating systems are consistently patched and\n configured in accordance with agency policy or best practices.\n 2) Using the scan results, determine whether Windows Local Server passwords has:\n a.\t Enforced password history.\n b.\t Maximum password age.\n c.\t Minimum password age.\n d.\t Minimum password length.\n e.\t Complexity requirements in accordance with policy.\n f.\t Account lockout duration.\n g.\t Account lockout threshold.\n h.\t Default accounts locked or have their passwords changed from the default\n values.\n 3) Using the scan results, determine whether Windows local server has the current\n patches installed, including:\n a.\t Microsoft service pack level.\n b.\t Required hot fixes and security updates.\n c.\t Non-operating system patches, hot fixes, and security updates.\n 4) Using the scan results, determine if the antivirus and Intrusion Prevention Software\n is up-to-date as required by policy.\n F.\t Using scan results from scanning software, such as Hewlett Packard WebInspect,\n determine whether the web server has:\n 1) Current patches installed as required by policy.\n 2) Passwords that meet agency standards.\n 3) Fields subject to injection flaws.\n 4) Authentication and session management vulnerabilities.\n 5) Insecure direct object references.\n 6) Cross-site request forgery.\n 7) Insecure cryptographic storage.\n\n\nwww.oig.dhs.gov 145\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 8) Fail to restrict Uniform Resource Locator access.\n 9) Insufficient transport layer protection.\n 10) Un-validated redirects and forwards.\n 11) Cross-site scripting.\n\n\n\n\nwww.oig.dhs.gov 146 OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix M\n Objectives for Evaluating Mobile Device Security\n Overall Objective\n The overall objective of this audit is to determine the effectiveness of agency efforts to\n safeguard sensitive information stored or processed on mobile devices.107\n\n Detailed Sub-Objectives\n\n 1.\t Determine whether the agency and its components have developed adequate policies and\n procedures to protect the data processed and stored on mobile devices.\n\n A.\t Evaluate whether the agency and its components have established policies and\n procedures to safeguard and restrict the use of mobile devices and that procedures\n developed are aligned with Office of Management and Budget and National Institute of\n Standards and Technology policy.\n B.\t Assess whether authorized mobile devices are marked to protect information stored\n from mishandling.\n\n 2.\t Determine whether the agency and its components maintain an accurate inventory of\n mobile devices.\n\n A.\t Identify the processes used by the agency to inventory, assign, and dispose of mobile\n devices.\n 1) Identify whether management of the devices is centralized.\n 2) Identify any third party software being used to centrally manage and deploy mobile\n device software (i.e., Apple) in the agency enterprise.\n 3) Determine whether there is a specific program/application used for administration\n of settings on mobile devices.\n 4) Determine whether the device acquisition chain (i.e., supply chain) is vetted before\n government use.\n 5) Determine how devices are secured while in transit or at rest.\n B.\t Review and compare the inventory to the number of mobile devices listed in the\n equipment database and trace information such as make, model, and serial number to\n the equipment database.\n C.\t Analyze the agency\xe2\x80\x99s controls to ensure that mobile devices are sanitized and disposed\n in accordance with applicable procedures.\n D.\t Evaluate the agency\xe2\x80\x99s process for reporting security incidents involving mobile devices\n and sample reported events regarding lost or damaged devices.\n\n 107\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 147\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n E.\t Ensure that stolen and missing mobile devices are reported within the established\n timeframe.\n\n 3.\t Determine the effectiveness of controls implemented to protect the data stored and\n processed on mobile devices that connect to the agency\xe2\x80\x99s network(s).\n\n A.\t Assess the encryption settings used to secure agency data, both in transit and stored,\n when applicable.\n 1) Determine whether the device uses local encryption when data is at rest\n (Data-at-Rest).\n a.\t Identify specifics on where the local device is encrypted, (i.e., local hard drive,\n software, boot sector, Virtual Private Network).\n b.\t Determine whether the device is compliant with Federal Information Processing\n Standards (FIPS) 140-2.\n c.\t Identify the algorithm used (i.e., Advanced Encryption Standard [AES]).\n d.\t Determine whether the device is compliant with agency requirements on\n encryption (e.g., AES-256).\n 2)\t Determine whether the device uses encryption technologies when data is in transit\n (Data-in-Transit).\n a.\t Determine whether the device is FIPS 140-2 compliant.\n b.\t Identify the algorithm used.\n c.\t Determine whether the device is compliant with agency requirements on\n encryption.\n d.\t Identify whether wireless fidelity (Wi-Fi) is enabled on the device to connect to\n an agency network. If yes, determine whether the device requires/is capable of\n Wi-Fi Protected Access-2.\n B.\t Determine whether mobile device users are connecting to the enterprise network via a\n secure connection (Virtual Private Network, Internet Protocol security, or Secure\n Sockets Layer.\n C.\t Identify and evaluate the configuration management controls for mobile devices\n connected to third-party applications, local networks, and back-end servers, to ensure\n that settings comply with agency policies and procedures.\n 1) Identify the common configuration management controls implemented on the\n agency\xe2\x80\x99s mobile devices. For example:\n a.\t User authentication (e.g., two-factor authentication - PIN and RSA token).\n Identify whether user authentication is required on \xe2\x80\x9cpower-on.\xe2\x80\x9d\n b.\t Antivirus software (i.e., AVG, Lookout, or Norton Security). Verify enterprise\n updates to the mobile device antivirus software to prevent the perpetuation of\n malware.\n c.\t Access to camera and video recording functions.\n d. Enabling of audit log functions.\n 2) Determine whether users can save agency data/files to local mobile devices.\n\n\nwww.oig.dhs.gov 148\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 3) Determine whether mobile devices are set to lock automatically after a specified\n amount of time.\n 4) Identify whether devices are wiped after a specific number of failed login attempts.\n 5)\t Determine whether users can download and install applications to a device. If so,\n identify whether applications are vetted before they can be download onto agency\n mobile devices.\n 6) Identify whether there are any location based services being used, allowed, or\n required to track mobile devices. If so, determine whether the mobile devices are\n being tracked or monitored in any way (e.g., remote lockdown, erase, or track).\n 7) Identify whether role-based permissions are assigned to the mobile device\n user/mobile device.\n 8)\t Determine whether the devices authorized for use on the agency\xe2\x80\x99s network are\n government owned or employee (i.e., personally) owned.\n 9) Identify whether device authorization is at the device level (Media Access Control\n address).\n 10) Determine how often the agency/component synchronizes and backs-up all stored\n information.\n D.\t Evaluate the frequency of discovery scans performed for thumb drives, tablets, and\n smartphones to identify whether unauthorized mobile devices are being connected to\n the agency\xe2\x80\x99s network(s).\n 1) Determine whether mobile devices are scanned in any way to help prevent the\n spread of malware, viruses, or known vulnerabilities (i.e., installation of AVG,\n Lookout, or Norton Security).\n 2) Identify how often servers are scanned to find unauthorized Universal Serial Bus\n connections.\n 3) Identify the patching process for application and mobile device operating systems.\n 4) In cases where the agency does not push out security updates/patches, determine\n how often vendor-related or security vulnerability alert sites are monitored.\n 5) Determine how unauthorized portable devices are reported to management.\n E.\t Identify the risks associated with mobile devices that could affect the safeguarding and\n protection of agency and other sensitive data.\n 1) Ensure that agency management\xe2\x80\x99s acceptance of risks, such as privacy risks, is\n documented.\n 2) Analyze any weaknesses or deficiencies listed on a Plan of Action and Milestones for\n portable devices.\n F.\t Determine how the agency is addressing the additional risk of users accessing personal\n social media sites and banking services while using the mobile device for official use.\n\n 4.\t Verify and evaluate the agency awareness program that addresses the importance of\n securing the mobile devices physically and logically. Ensure that the training includes the\n types of information that can and cannot be stored on such devices.\n\n\n\nwww.oig.dhs.gov 149\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix N\n Objectives for Evaluating Portable Storage Device Security\n Overall Objective\n The overall objective of this audit is to determine whether the agency has addressed the\n emerging threat of theft and mishandling of sensitive and classified information as a result of\n the proliferation of portable storage devices through policy and security controls.108\n\n Detailed Sub-Objectives\n\n 1.\t Determine whether the agency has developed adequate policies and procedures to protect\n the data processed and stored on the portable devices.\n\n A.\t Evaluate whether the agency has established policies and procedures to safeguard and\n restrict the use of portable devices and ensure procedures developed are aligned with\n Office of Management and Budget and National Institute of Standards and Technology\n policy.\n B.\t Assess that authorized portable devices are properly marked to protect information\n stored from mishandling.\n\n 2.\t Determine whether the agency maintains an accurate inventory of portable devices.\n\n A.\t Identify the processes used by the agency to inventory, assign, and dispose of portable\n devices.\n B.\t Review and compare inventory to the number of portable devices listed in the\n equipment database and trace information such as make, model, and serial number to\n the equipment database.\n C.\t Analyze the agency\xe2\x80\x99s controls to ensure portable devices are sanitized and disposed in\n accordance with applicable procedures.\n D.\t Evaluate the agency\xe2\x80\x99s process for reporting security incidents on portable devices and\n sample reported events regarding lost or damaged portable devices.\n E.\t Ensure that stolen and missing portable devices are reported within the established\n timeframe.\n\n 3.\t Determine the effectiveness of controls implemented to protect the data stored and\n processed on portable devices that connect to the agency\xe2\x80\x99s networks.\n\n A.\t Assess encryption settings used to secure agency data, both in transit and stored, when\n applicable.\n\n 108\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 150\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n B.\t Review configuration management controls for portable devices connected to\n third-party applications, local networks, and back-end servers, to ensure that settings\n comply with the agency\xe2\x80\x99s policies and procedures.\n C.\t Evaluate the agency\xe2\x80\x99s frequency of discovery scans performed for thumb drives, tablets,\n and smartphones to identify whether unauthorized portable devices were connected to\n the agency\xe2\x80\x99s network.\n D.\t Identify risks associated with portable devices that could affect the safeguarding or\n protection of agency data.\n\n\n\n\nwww.oig.dhs.gov 151\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix O\n Objectives for Evaluating E-mail Security\n Overall Objective\n The overall objective of this audit is to determine the adequacy of agency security controls\n designed for E-mail services to ensure the confidentiality, availability, and integrity of sensitive\n information.109\n\n Detailed Sub-Objectives\n\n 1.\t Obtain background information on the agency\xe2\x80\x99s E-mail services.\n\n A.\t Review appropriate criteria, regulations, guidelines, and recent publications relevant to\n E-mail security.\n B.\t Obtain an understanding of the agency\xe2\x80\x99s E-mail and general system maintenance\n practices.\n C.\t Evaluate the agency\xe2\x80\x99s internal policies and procedures regarding E-mail appropriate use\n for sensitive material and general retention guidelines (e.g., back-up, restoration,\n archiving procedures).\n D.\t Evaluate whether E-mail administrators have a process to enforce and monitor \n\n compliance with policy. \n\n E.\t Evaluate whether the annual E-mail security awareness training is satisfactory.\n\n 2.\t Secure E-mail infrastructure: Determine whether the agency has considered the various\n risks associated with E-mail and taken appropriate actions to harden its E-mail\n infrastructure against known attacks.\n\n A.\t Determine what security precautions were taken during the design of the E-mail \n\n infrastructure. \n\n B.\t Ensure that a risk assessment was performed.\n C.\t Evaluate whether the operating system was hardened. Determine whether any \n\n Windows security templates were used. \n\n D.\t Determine whether allowed services were identified.\n E.\t Obtain an overall diagram of the agency\xe2\x80\x99s E-mail infrastructure. As necessary, develop\n tests over E-mail components, particularly those that are Internet facing.\n F.\t Scan a sample of servers for configuration settings and compare to policy and the\n agency\xe2\x80\x99s baseline configuration.\n G. Identify servers responding to Simple Mail Transfer Protocol (Port 25). T\t est for \n\n unauthorized servers running mail services.\n\n\n 109\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 152\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 3.\t Determine how changes are introduced to the production E-mail infrastructure.\n\n A.\t Testing in this section involves reviewing access privileges for introducing change. On\n the Windows environment, Short Message Service is the primary delivery mechanism.\n For example, ensure that changes to mail routing and other mail options are controlled.\n B.\t Identify controls that would prevent a local area network administrator from \n\n intercepting and reading the E-mail of another individual.\n\n C.\t Determine what controls exist over Public Folders within Exchange. \n\n 1) Review how security permissions are made for the folder. \n\n 2) Determine how Windows Distribution groups are identified, organized, and \n\n disseminated to different groups. \n\n 3) Identify how business owners are involved. \n\n\n 4.\t Determine whether the agency\xe2\x80\x99s encryption policy is adequate. Ensure that necessary\n controls are in place over encrypted E-mail.\n\n 5.\t Determine whether necessary controls exist for the physical security of the E-mail\n infrastructure.\n\n 6.\t Confirm whether the organization approves, controls, and monitors the use of information\n system maintenance tools and maintains the tools on an ongoing basis.\n\n A.\t Determine whether the agency uses any third-party tools to maintain or support its\n exchange infrastructure.\n B.\t Determine what virus scanning software or spam filtering software is installed on the\n exchange servers to scrub E-mails.\n C.\t Determine whether the agency has documented maintenance procedures for its\n exchange infrastructure.\n D.\t Determine whether the following controls are in place (whether maintenance is\n performed from remote locations for any of the platforms being reviewed):\n 1) The agency approves, controls, and monitors remotely executed maintenance and\n diagnostic activities.\n 2) The agency maintains maintenance logs for all remote maintenance, diagnostic, and\n service activities.\n 3) Appropriate agency officials periodically review maintenance logs.\n 4)\t When remote maintenance is completed, the agency (or information system in\n certain cases) terminates all sessions and remote connections.\n 5) If password-based authentication is used during remote maintenance, determine\n whether the agency changes the passwords following each remote maintenance\n service.\n\n 7.\t Timeliness of maintenance: Determine whether the agency:\n\n\nwww.oig.dhs.gov 153\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n\n A.\t Schedules, performs, and documents routine preventative and regular maintenance on\n the components of the information system in accordance with manufacture/vendor\n specifications and/or organizational requirements.\n B.\t Maintains a maintenance log for the information system that includes: \n\n 1) Date and time of maintenance.\n\n 2) Name of the individual performing the maintenance.\n\n 3) Name of escort, if necessary. \n\n 4) A description of the maintenance performed.\n\n\n 8.\t Determine whether the agency has a continuity of operations process.\n\n A.\t Ensure that there is a continuity of operations plan and procedures for the agency\xe2\x80\x99s\n most critical means of communication.\n B.\t Confirm that the agency has tested the recovery of the E-mail system during a disaster\n recovery exercise.\n\n\n\n\nwww.oig.dhs.gov 154\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix P\n Objectives for Evaluating Web Server Security\n Overall Objective\n The overall objective of this audit is to determine whether the agency has implemented\n effective security controls to protect its web servers and applications.110\n\n Detailed Sub-Objectives\n\n 1.\t Determine the Internet Protocol (IP) addresses for all agency public-facing web servers\n through the use of Office of Inspector General scanning tools.\n\n A.\t Use the Nmap scanning tool to perform discovery on the agency\xe2\x80\x99s network \n\n environment. \n\n B.\t If necessary, perform a scan using Nmap to determine the system environment.\n C.\t Identify all public-facing web servers belonging to the respective domains known by\n Google.\n D.\t Analyze results to determine IP addresses, server name, locations, and hosts that belong\n to all agency public-facing web servers.\n\n 2.\t Evaluate whether the agency has implemented effective security controls to protect its web\n servers.\n\n A.\t Assess whether the web server operating systems have been updated and critical\n security patches have been applied.\n B.\t Ensure that unnecessary services have been disabled or removed from web server\n operating systems.\n C.\t Verify whether effective user authentication controls have been implemented on web\n server operating systems.\n D.\t Assess whether effective privileged account controls have been implemented on web\n server operating systems.\n E.\t Ensure that any additional security controls have been implemented to protect web\n server operating systems from unauthorized use.\n F.\t Verify that effective security monitoring, vulnerability testing, and audit log review are\n being performed on web server operating systems.\n\n 3.\t Evaluate whether the agency has implemented effective security controls to protect its\n websites and applications.\n\n\n\n 110\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 155\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n A.\t Ensure that website applications have been updated and critical security patches have\n been applied.\n B.\t Assess whether unnecessary services have been disabled or removed from website\n applications.\n C.\t Verify that effective user authentication controls have been implemented on website\n applications.\n D.\t Ensure that effective privileged account controls have been implemented on website\n applications.\n E.\t Assess whether effective security controls have been implemented on website \n\n application resources and data. \n\n F.\t Verify that effective security monitoring, vulnerability testing, and audit log review are\n being performed on website applications.\n G. Assess whether cross-site scripting and Structured Query Language injection \n\n vulnerabilities have been identified or mitigated on website applications. \n\n H. Ensure that cookies are not being used by website applications.\n\n 4.\t Determine the IP addresses, Fully Qualified Domain Name (FQDN), location, and responsible\n personnel for all agency public-facing web servers.\n\n A.\t Obtain a list of IP addresses belonging to public-facing web servers.\n B.\t Request the FQDN for the servers.\n C.\t Determine which web servers belong to which application(s).\n D.\t Determine responsible personnel for each group of applications or each web server and\n obtain a point-of-contact.\n E.\t Query agency business owners to determine whether there are additional public-facing\n web servers in the environment that do not fall under the responsibility of Information\n Technology.\n\n 5.\t Using scan results, such as WebInspect, identify the following for web servers:\n\n A.\t Current patches are installed as required by policy.\n B.\t Passwords meet agency standards.\n C.\t Contain fields subject to injection flaws.\n D.\t Have authentication and session management vulnerabilities.\n E.\t Have insecure direct object reference.\n F.\t Use cross-site request forgery.\n G. Use of secure cryptographic storage.\n H. Failure to restrict Uniform Resource Locator access.\n I.\t Insufficient transport layer protection.\n J.\t Invalidated redirects and forwards.\n K.\t Use of cross-site scripting.\n\n\n\n\nwww.oig.dhs.gov 156\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix Q\n Objectives for Evaluating DNS Server Security\n Overall Objective\n The overall objective of this audit is to determine whether management and security measures\n are in place over Domain Name System (DNS) servers within the agency.111\n\n Detailed Sub-Objectives\n\n 1.\t Determine the location and ownership of DNS servers throughout the agency.\n\n A.\t Request a list of servers maintained by the agency as well as a list of all organizational\n elements that maintain their own servers.\n B.\t Identify a methodology to select specific DNS servers for audit testing.\n\n 2.\t Evaluate whether the agency has implemented Office of Management and Budget (OMB)\n Memorandum 08-23 DNS Security (DNSSEC) policies.\n\n A.\t Assess whether the DNSSEC Deployment Plan Outline contains:\n 1) Enumerate .gov Domains \xe2\x80\x93 Enumerate the second-level domains beneath .gov\n operated by your agency (or on behalf of your agency). Only the second-level\n sub-domains need to be listed.\n 2)\t Sources of DNS Services \xe2\x80\x93 For each domain, the Outline should describe whether the\n agency DNS administration and server operation are provided in-house, outsourced\n to a commercial provider (e.g., vendor), or delivered by other means (e.g., provided\n by another agency).\n 3) DNS Server Infrastructure Description \xe2\x80\x93 Document the provider, vendor, or source of\n DNS server implementations within your agency (e.g., Berkeley Internet Name\n Domain, Name Server Daemon, and Microsoft Advanced Directory). Include in your\n estimate the number of such servers per source.\n 4)\t Barriers \xe2\x80\x93 Document any perceived technical, contractual, or operational barriers\n impeding deployment of DNSSEC, and milestones for addressing each.\n 5) Training \xe2\x80\x93 Review the activities of the U.S. Government Secure Naming\n Infrastructure Pilot at www.dnsops.gov and your agency\xe2\x80\x99s training workshops.\n 6) Plan of Action and Milestones \xe2\x80\x93 Document your agency\xe2\x80\x99s Plan of Action and\n Milestones to implement the policies described in the OMB memorandum. In\n particular, this plan should detail all key activities (e.g., acquisition if necessary,\n training, testing, deployment, operations plans with priority given to citizen services\n and E-government domains, especially those that collect any personally identifiable\n\n 111\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 157\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n information) and milestones necessary to achieve the goal of fully operating DNSSEC\n signed .gov sub-domains.\n B.\t Request the documentation provided to OMB to verify that it contains the above items.\n\n 2.\t Evaluate whether DNSSEC has been implemented at the agency.gov domain and\n sub-domains.\n\n A.\t Ensure that DNSSEC is deployed at second-level domains (i.e., agency.gov), as required\n by OMB.\n B.\t Ensure that all systems, low, medium, and high, are secured by implementing\n transmission integrity and secure name/address resolution controls, as required by the\n National Institute of Standards and Technology (NIST).\n C.\t Verify whether commercial software is used to determine whether servers have DNSSEC\n implemented.\n\n 3.\t Evaluate whether the DNS servers deployed within the agency adhere to the checklist\n provided in NIST Special Publication 800-81. Select a sample of checklist items that can be\n tested using commercial software to verify that the settings are compliant.\n\n 4.\t Evaluate whether DNS servers in the agency are free from vulnerabilities caused by\n misconfigurations or software flaws.\n\n A.\t Using the agency\xe2\x80\x99s vulnerability assessment and patch management solution \n\n (e.g., BigFix), verify that the server is compliant with NIST requirements.\n\n B.\t Obtain a list of all agency DNS servers and determine whether the assessment tool\n identifies each.\n\n 5.\t Evaluate whether the agency\xe2\x80\x99s DNS servers have been patched or updated as required by\n the agency as a result of a DNS incident.\n\n A.\t Ensure that all vulnerability and weaknesses identified have been reported to the DNS\n servers\xe2\x80\x99 administrators.\n B.\t Verify that the agency has taken corrective actions, conducted proper follow-up on all\n known incidents, and reported on the results.\n\n\n\n\nwww.oig.dhs.gov 158\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix R\n Objectives for Evaluating Firewall Security\n Overall Objective\n The overall objective of this audit is to determine whether agency perimeter firewalls, routers, \n\n and switches are securely configured.112\n\n (Note: The detailed sub-objectives are based on an evaluation of Cisco firewalls.) \n\n\n Detailed Sub-Objectives\n\n 1.\t Review background information about the firewall(s), e.g., segment diagrams, software,\n hardware, routers, version levels, host names, Internet Protocol [IP] addresses, connections,\n any specific policies for an overview of the firewall security.\n\n A.\t Ensure that appropriate filtering exists.\n B.\t Ensure logging is enabled on the firewall. The minimum level should be set to 4.\n C.\t Enable logging as follows: \n\n 1) Define log server \xe2\x80\x93 logging host [in_if_name] ip_address [protocol/port]. \n\n 2) Define type of messages to be logged \xe2\x80\x93 logging trap level.\n\n 3) Issue logging on to start logging. \n\n D.\t Ensure that a syslog server is used to store logged messages.\n E.\t Ensure that logs are generated and stored securely on a separate partition or server.\n F.\t Analyze whether the firewall(s) has compilers, editors, or any other type of \n\n development tool.\n\n G. Run the show central processing unit (CPU) usage command to determine if it is \n\n overworked. It should not be running over 30 percent.\n\n H. Ensure that all firewalls have appropriate login banners.\n\n 2.\t Evaluate whether all firewall-related policies (administration, change control, logging,\n backup and recovery, etc.) are documented.\n\n A.\t Ensure that the stated polices (e.g., administration, change control, logging, backup and\n recovery) have been developed and implemented. These policies should explicitly\n address the periodic review of firewall security and the regular reviewing of audit logs.\n Review the policies for appropriateness.\n B.\t Use Simple Network Management Protocol (SNMP) to evaluate firewall monitoring\n procedures. This is achieved as follows:\n 1) Set the IP address of the SNMP server \xe2\x80\x93 snmp-server host. Set the location, contact,\n and the community password snmp-server options.\n\n 112\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 159\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 2) Use logging trap to set logging level. Use the errors levels to define logging levels.\n 3) Logging on \xe2\x80\x93 command to start sending System Log (syslog) messages to the server.\n No logging on \xe2\x80\x93 to disable sending messages.\n 4)\t A risk of non-detection of system issues exists if the state of the firewall is not\n monitored.\n 5)\t Use show SNMP server to check configurations.\n\n 3.\t Review whether the default firewall ports are open. These ports are for administration and\n should disabled. Attempt to port scan the firewall(s), from both the internal network and\n the Internet, scanning for Internet Control Message Protocol (ICMP), User Datagram\n Protocol, and Transmission Control Protocol.\n\n 4.\t Assess whether a lockdown rule is included at the beginning of the rule base.\n\n A.\t Ensure that administrative access is granted before the lockdown rule is put into place.\n (Note: All other rules should go after the lockdown rule, going from most restrictive to\n general rules.)\n B.\t Review for number of connections. Increase/decrease the number of connections to\n 50,000. This makes it more difficult to fill the connections table.\n C.\t Attempt to test the rule base by scanning secured network segments from other\n network segments.\n D.\t Ensure that the firewall is enforcing organizational expectations and is accepting only\n the traffic that is authorized.\n E.\t Place a system on the demilitarized zone (DMZ) and attempt to penetrate the secured\n segments, as the DMZ is highly vulnerable.\n\n 5.\t Identify accessible resources behind the firewall that are to be encrypted and determine\n that these connections are encrypted.\n\n 6.\t Ensure the accuracy with the show clock command.\n\n A.\t Ensure that Network Time Protocol (NTP) is used to keep accurate time.\n B.\t Configure NTP to allow updates from the internal time servers only. \n\n 1) Disable NTP on the Internet interface inbound and outbound.\n\n 2) Synchronize your Internet Access time with the rest of your network. \n\n\n 7.\t Ensure that web-filtering software is used on the firewall.\n\n 8.\t Identify whether Hypertext Transfer Protocol inspection is enabled.\n\n 9.\t Verify that the following protocols run through the firewall; they should be disabled:\n\n\n\nwww.oig.dhs.gov 160\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n A.\t FTP \xe2\x80\x93 File Transfer Protocol.\n B.\t NIS \xe2\x80\x93 Network Information Services.\n C.\t NFS \xe2\x80\x93 Network File System.\n D.\t UUCP \xe2\x80\x93 Unix-to-Unix Copy.\n E.\t X \xe2\x80\x93 Windows System.\n F.\t Finger.\n\n 10. Ensure that access lists have been applied to control the flow of network traffic.\n\n A.\t Analyze whether the firewall drops active code from incoming web traffic.\n B.\t Ensure that all access lists have been applied to the appropriate interfaces.\n C.\t Ensure that static and conduit statements have been applied to control the flow of\n network traffic.\n\n 11. Ensure that configuration files are stored as back-ups elsewhere and in secure locations.\n\n 12. Ensure that ICMP type 3 and 5 packets have been disabled.\n\n 13. Ensure that the firewall(s) is properly documented.\n\n A.\t Review network diagrams to ensure that all firewalls and network appliances have been\n documented.\n B.\t The following should be listed: \n\n 1) Version number. \n\n 2) Location. \n\n 3) Host name. \n\n 4) Internet connections. \n\n\n 14. Ensure that Network Address Translation is used to hide the IP addresses of the internal\n network from external networks.\n\n 15. Ensure that proxy-Address Resolution Protocols have been disabled.\n\n 16. Ensure that random, longer than 30 character, cryptic secret key is used for manual IP\n Security, where:\n\n A.\t Encryption keys are renewed on a timely manner.\n B.\t Crypto Access Lists are implemented.\n\n 17. Ensure that appropriate session timeout values have been assigned.\n\n\n\n\nwww.oig.dhs.gov 161\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 18. Ensure that SNMP is disabled or non-default community strings are required for SNMP\n access.\n\n 19. Ensure that an enabled password exists on all firewalls.\n\n 20. Review for dial in access directly to the firewall server.\n\n 21. Ensure that adequate physical security controls are in place to restrict access to firewall and\n Domain Name System servers.\n\n 22. Ensure that appropriate disaster recovery arrangements exist for the firewall to reduce\n downtime due to a firewall outage.\n\n A.\t Ensure that the firewall is covered in the agency\xe2\x80\x99s disaster recovery plans.\n B.\t Ensure that failover systems exist. Ensure that failover systems are the same as the\n main firewall to allow for successful failovers.\n C.\t Ensure that a universal power supply exists. Power outages or fluctuations could cause\n disruptions.\n\n\n\n\nwww.oig.dhs.gov 162\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix S\n Objectives for AD Testing\n Overall Objective\n The overall objective of this audit is to determine whether the agency has designed and\n implemented Active Directory (AD) services to effectively manage access to its systems and\n services.113\n\n Detailed Sub-Objectives\n\n 1.\t Evaluate whether the agency has implemented trust zones to ensure security and\n interoperability across domains.\n\n A.\t Verify that the agency maintains a list of all domains (within the forest).114\n B.\t Ensure that the agency maintains documentation of how trusts are configured between\n the agency and all its components. Document:\n 1) Trust type (external, forest, or realm).\n 2) Fully qualified domain names of each party.\n 3) Direction (one-way or two-way).\n C.\t Ensure that trusts are configured as one-way whenever possible.\n D.\t Ensure that the trusted systems are secured according to agency policy.\n\n 2.\t Evaluate whether the agency has designed an enterprise AD solution to support agency\n goals.\n\n A.\t Ensure that the agency maintains accurate design documentation for AD.\n B.\t Assess whether the agency has developed adequate short and long-term plans for the\n following agency-wide programs and initiatives, as they relate to AD:\n 1) Homeland Security Presidential Directive 12 logical access.\n 2) Implementation of agency single sign-on identities for employees.\n 3) U.S. Government Configuration Baseline.\n 4) Domain Name Service (DNS) security.\n\n 3.\t Evaluate whether the agency has implemented effective account management and access\n controls on AD services.\n\n\n 113\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n 114\n The AD framework that holds the objects can be viewed at a number of levels; the forest, tree, and domain are\n the logical divisions in an AD network. At the top of the structure is the forest. A forest is a collection of trees that\n share a common global catalog, directory schema, logical structure, and directory configuration. The forest\n represents the security boundary within which users, computers, groups, and other objects are accessible.\n\n\nwww.oig.dhs.gov 163\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n A.\t Ensure that effective privileged account controls have been implemented for root\n administrators, domain administrators, enterprise administrators, DNS administrators,\n or any others with AD access.\n B.\t Ensure that written procedures exist and followed to identify and disable inactive\n accounts in a timely manner.\n\n 4.\t Evaluate whether the agency\xe2\x80\x99s secure baseline configuration guide has been implemented\n for agency AD services.\n\n\n\n\nwww.oig.dhs.gov 164\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix T\n Objectives for Evaluating Incident Response, Handling, and Reporting\n Overall Objective\n The overall objective of this audit is to determine whether the agency has an effective system\n for detecting, reporting, and responding to security incidents, in accordance with Federal\n regulations, and established standards and guidelines.115\n\n Detailed Sub-Objectives\n\n 1.\t Evaluate whether the agency has implemented a process for its incident response\n capability.\n\n A.\t Assess whether the agency has taken steps to address lessons learned from previously\n detected incidents.\n B.\t Identify whether the agency performed a detailed review to identify and create a\n lessons learned document.\n C.\t Interview officials to determine the status of implementing corrective actions to address\n areas of concern identified.\n D.\t Ensure that incidents are being reported to the:\n 1) Information Systems Security Officer.\n 2) Computer Security Incident Response Center (or agency response team).\n 3) Agency call center.\n 4) Department of Homeland Security\xe2\x80\x99s U.S. Computer Emergency Readiness Team, as\n appropriate.\n E.\t Verify that the agency has tested corrective actions to address the areas of concern\n identified.\n F.\t Determine whether management has implemented controls to address issues identified\n and obtain evidence that shows the implemented controls address vulnerabilities.\n G. Identify any reasons why the agency has not taken actions to address the \n\n recommendations; document the reason(s) for any delays.\n\n H. Analyze whether internal policies and procedures have been updated to incorporate any\n newly implemented actions.\n I.\t Verify that an action plan has been developed or the reason(s) for any delays.\n J.\t Ensure that the agency has tested all corrective actions to verify that the implemented\n controls remediated the issue.\n\n 2.\t Evaluate the tool(s) the agency has implemented to increase its capability to promptly\n identify, analyze, and resolve cybersecurity incidents against the agency\'s network.\n\n 115\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 165\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n\n A.\t Request IT officials to provide the following information from each technical tool(s) that\n is used to help identify and analyze cyber-security incidents on the agency\xe2\x80\x99s network:\n 1) The cost.\n 2) Person responsible for rolling-out the tool(s).\n 3) The project and implementation plan and status.\n B.\t Assess whether there have been any delays in implementing the tool(s). If so, interview\n the management team responsible for implementing the tool to determine the\n reason(s) for any delays.\n C.\t Identify whether the tool(s) will be centrally managed and who is responsible for\n managing and monitoring the tool.\n D.\t Obtain a copy of the agency network diagram and determine whether it complies with\n the National Institute of Standards and Technology (NIST) Special Publication (SP)\n 800-61.\n E.\t Evaluate whether the placement of the tool(s) provides adequate coverage for\n monitoring the agency\xe2\x80\x99s network traffic.\n F.\t Obtain a copy of the agency\xe2\x80\x99s audit logging policy and assess whether the policy\n complies with NIST SP 800-92.\n G. Assess whether other log (event) management tool(s) are being used to capture/log\n network traffic.\n 1) Identify the responsible personnel for the log management (event) tool(s).\n 2) Review how the log management tool(s) is being used and where the tool(s) is\n located.\n 3) Verify the type of auditable events the log management tool(s) is configured to\n capture.\n 4) Identify any concerns or issues with the reliability, capability, or performance of the\n log (event) management tool(s).\n 5) Review a sample of the tool(s) reports to confirm that the log (event) management\n tool(s) is capturing the designated auditable events.\n 6) Assess whether the logging reports are complete or include unfragmented data\n based on the tool(s)\xe2\x80\x99 reporting features.\n 7) Identify who is responsible for reviewing the log management reports and\n documentation.\n 8) Determine how often the reports are reviewed.\n 9) Examine where the reports are maintained and whether the location prohibits\n unauthorized access.\n a.\t Review how access to the reports is controlled.\n b.\t Identify whether controls are in place to restrict access to reports.\n 10) Assess how long the reports are retained or stored and where the reports are\n archived.\n\n\n\n\nwww.oig.dhs.gov 166\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n H. Distribute an E-mail message to all Information Security Officers to identify whether any\n local technical tools were installed on the network to combat cybersecurity incidents. If\n technical tools were installed locally, identify the:\n 1) Cost.\n 2) Tool\xe2\x80\x99s purpose.\n 3) Date the tool was installed.\n 4) Location on the local network.\n 5) Controls in place to limit access to the reports.\n 6) Person responsible for reviewing the tool\xe2\x80\x99s reports.\n 7) Authorization for installing the tool.\n 8) Training or guidance on how to use the tool.\n I.\t Identify whether any local security incidents have been detected using the technical\n tools. If security incidents were detected, identify:\n 1) The individual who identified the security incident.\n 2) The type of incident.\n 3) When the security incident occurred.\n 4) Where the incident occurred.\n 5) How the incident was detected.\n 6) The cause of the security incident.\n 7) Whether corrective action(s) were implemented to secure the vulnerability that\n allowed the incident to occur.\n 8) Whether controls were put in place and tested to ensure that similar incidents\n would not occur.\n J.\t Ensure that the agency\xe2\x80\x99s headquarters was notified of the incident, corrective actions\n were implemented, and the newly implemented controls were tested. Obtain\n documentation.\n\n\n\n\nwww.oig.dhs.gov 167\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix U\n Objectives for Evaluating IPv6\n Overall Objective\n The overall objective of this audit is to determine whether the agency is effectively managing its\n implementation of Internet Protocol, version 6 (IPv6).116\n\n Detailed Sub-Objectives\n\n 1.\t Determine whether the agency is effectively planning for its transition from Internet\n Protocol, version 4 (IPv4) to IPv6.\n\n A.\t Ensure that the agency has established an IPv6 project office with clearly defined roles\n and responsibilities for IPv6 implementation.\n 1) Ensure that the agency has assigned an official to lead and coordinate the agency\xe2\x80\x99s\n transition from IPv4 to IPv6.\n 2) Evaluate whether the project office monitors and oversees the agency components\xe2\x80\x99\n efforts to implement IPv6.\n 3) Ensure that the components have assigned an official or established a project office\n to plan for the transition to IPv6.\n B.\t Determine whether the agency has developed an IPv6 transition plan as part of its\n Enterprise Architecture submission to Office of Management and Budget (OMB). The\n detailed transition plan should be applicable for all agencies and identify the following:\n 1) Network infrastructure.\n 2) Address schema.\n 3) Network topology with routing protocol.\n 4) Transition mechanisms selected for the conversion (i.e., dual-stack, tunnels).\n 5) Training within the multiple disciplines required to transition to IPv6.\n 6) Costs associated with implementing IPv6 on top of IPv4. (Costs will most likely come\n from software and hardware, training, application porting, consulting services, and\n operational costs.)\n 7) A detailed transition schedule with interim milestones to migrate to IPv6.\n C.\t Ensure that a process has been established to monitor the agency and organizational\n components\xe2\x80\x99 progress in meeting these milestones.\n D.\t Identify whether the agency has issued any guidance for its implementation to IPv6.\n Evaluate whether the guidance is adequate.\n E.\t Identify whether OMB has reviewed the implementation plan and approved the \n\n agency\xe2\x80\x99s milestone dates. \n\n\n\n\n 116\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 168\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 2.\t Determine whether the agency has completed an inventory to assess the current level of\n IPv6 capability.\n\n A.\t Ensure that the agency and its components have accurate inventories of devices and\n applications that may be affected by the transition to IPv6.\n 1) Ensure that the agency has conducted an initial agency-wide inventory of existing\n routers, switches, and hardware firewalls.\n 2) Evaluate how the agency verified the accuracy of its initial inventory. Ensure that the\n inventory contains the manufacturer, model, and serial number of the devices.\n 3) Ensure that the agency has conducted a comprehensive inventory to account for all\n existing applications and other devices, not captured in the initial inventory that may\n be affected by the transition to IPv6.\n 4) Ensure that the agency has a process to verify that all new acquisitions for\n information technology (IT) devices and technology procurements that include a\n viable upgrade path are IPv6 compliant.\n 5) Ensure that the agency has developed plans or a process for maintaining its IPv6\n inventory.\n 6) Identify whether components have established a process to ensure that products are\n not counterfeit.\n a.\t Ensure that IPv6 devices are registered with the manufacturers.\n b.\t Ensure that IPv6 equipment uses certificates between devices.\n B.\t Ensure that the agency has identified devices that are not, and never will be, IPv6\n capable.\n C.\t Ensure that the agency has developed an impact analysis to determine fiscal and \n\n operational impacts and risks of migrating to IPv6. \n\n D.\t Ensure that any newly acquired devices or technology are IPv6 compliant.\n\n 3.\t Determine whether the agency has effectively planned for and communicated the interim\n operability between IPv4 and IPv6.\n\n A.\t Ensure that the agency has documented its existing IPv4 network topology and its vision\n for its IPv6 network topology, to include:\n 1) Number of external networks accessed from within the agency and means of access\n to service providers.\n 2) Number of local area networks within the agency.\n 3) Number of devices, nodes, and in general, number of networked entities assigned or\n to be assigned IPv6 addresses.\n B.\t Ensure that the agency has determined the IPv6 address space it will require over the\n next 5-year period and made its request for IPv6 address assignment for deployment\n from the American Registry for Internet Numbers.\n C.\t Evaluate what the agency components are doing regarding the IPv6 transition.\n\n\n\nwww.oig.dhs.gov 169\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n D.\t Ensure that milestones have been established to measure progress in implementing\n IPv6 at the agency headquarters and its components.\n E.\t Ensure that the implementation strategy is considered for future IT investment\n decisions, including ensuring that IT investments appropriately address agency IPv6\n requirements.\n F.\t Ensure that the agency has communicated its IPv6 transition planning to all its \n\n components. \n\n G. Ensure that training materials have been developed to inform stakeholders \n\n (e.g., administrators) about the transition.\n\n\n 4.\t Determine whether the agency is effectively planning for testing the integration of IPv6.\n\n A.\t Identify whether the agency and its components have developed a testing plan to\n evaluate its IPv6 capabilities. Ensure that the plan identifies the following:\n 1) Availability and operability of testing facilities.\n 2) Methods of testing.\n 3) Transition mechanisms, security, conformance, and interoperability between IPv4\n and IPv6 devices.\n B.\t Review test documentation, reports, and conclusions on IPv6 functionality and evaluate\n the quality of the tests.\n C.\t Identify the planning efforts being conducted to test devices and networks not yet\n tested for IPv6 capabilities.\n D.\t Evaluate whether selected network devices are configured properly and ensure the\n following:\n 1) Selected IPv6 features, which are prohibited by the agency IT security policies, are\n disabled (e.g., peer-to-peer services).\n 2) Addressing allocation strategies and scoping rules are used.\n 3) Routers fully comply with NIST IPv6 specifications and are enabled with proper\n routing protocols.\n 4) Transition and co-existence mechanisms are compatible for both IPv4 and IPv6.\n 5) Router interfaces are enabled with IPv6 support Network Layer 2 link technologies.\n 6) IP Security is implemented on all IPv6 stacks and enabled on network devices.\n 7) Cryptographic operations, performed by IP Security and Internet Key Exchange, are\n aligned with Federal Information Processing Standard requirements.\n\n\n\n\nwww.oig.dhs.gov 170\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix V\n Objectives for RFID Testing\n Overall Objective\n The overall objective of this audit is to determine whether the agency has effectively\n implemented Radio Frequency Identification (RFID) to protect its mission critical data.117\n\n Detailed Sub-Objectives\n\n 1.\t Evaluate whether the agency has developed adequate policies and procedures to ensure\n the confidentiality, integrity, and availability of data contained on RFID tags, readers, and\n databases.\n\n A.\t Ensure that policies have been established for implementing RFID technology.\n B.\t Ensure that procedures have been established for each RFID device (tag, reader, and\n database).\n C.\t For RFID systems under development, ensure that security is included during the \n\n development process. \n\n\n 2.\t Evaluate whether security controls implemented on RFID devices are effective.\n\n A.\t Assess the following attributes for each tag:\n 1) Identify the type of tag (passive, semi-passive, active), memory, and frequency used.\n 2) Identify the data that is being stored on the tag.\n 3) Ensure that adequate processes have been established for the:\n a.\t Distribution of tags.\n b.\t Physical security of tags not in use.\n c.\t Destruction of tags.\n d.\t Training of employees on installation and maintenance of tags.\n 4) Ensure that adequate security is implemented on the tag and the transmission of\n data to/from the tag.\n B.\t Assess the following attributes for each reader:\n 1) Identify the storage capacity, processing capacity, and frequency of readers.\n 2) Ensure that adequate physical controls have been established to restrict access to\n the reader.\n 3) Ensure that encryption is used to protect the data that is transmitted to and from\n the reader.\n C.\t Assess the following attributes for the database: \n\n 1) Identify the type of database used. \n\n\n 117\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 171\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 2) Ensure that adequate physical controls have been established to restrict access to\n the database server(s).\n 3) Ensure that adequate security controls are implemented on the database and\n database servers containing RFID data (i.e., scan database and servers for\n vulnerabilities).\n 4) Identify and examine a current list of users and their authorized level of access to\n the database.\n 5) Identify the process for the administration of user identifications and passwords,\n and the level of access to the database.\n 6) Ensure that password settings are adequate and rules are based on agency\n password requirements.\n 7)\t Ensure that user access rules are defined and reviewed periodically to determine if\n they are still appropriate and updated as necessary (i.e., when privileges change).\n 8) Identify whether audit trails are recording who accessed and modified the database.\n 9) Identify whether audit trails are reviewed and maintained. Ensure that access\n controls over audit trail records are established and limited to system administrators\n and security administrators.\n 10) Ensure that backup, disaster recovery, and contingency planning is adequate. Test\n for the following:\n a) Contingency plan has been developed and tested periodically.\n b) Critical files are backed-up to removable media periodically and stored off-site.\n c) Arrangements are made for alternate data processing and telecommunication\n facilities.\n d) Event logs are generated when backup operation is performed.\n\n 3.\t Evaluate whether privacy issues have been addressed in the implementation of RFID.\n\n A.\t Ensure that a privacy impact assessment was performed in accordance with the \n\n E-Government Act of 2002. \n\n B.\t Ensure that individuals are notified about the use of RFID (e.g., signs posted, pamphlets,\n documents informing users).\n C.\t Identify how the agency is using the data collected from the tags (e.g., tracking,\n profiling).\n 1) Ensure that a memorandum of agreement/understanding is established if the data\n collected is shared with other agencies.\n 2) Ensure that individuals have the right to ask whether personal data was shared with\n other agencies and/or businesses.\n 3) Assess whether an individual can request to have data deleted from the tag.\n\n\n\n\nwww.oig.dhs.gov 172\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix W\n Objectives for Evaluating Insider Threats\n Overall Objective\n The overall objective of this audit is to determine how effectively the agency protects its\n information systems and data from the threat posed by employees, especially those with\n special or elevated access to unclassified information technology (IT) systems or information\n based on their job description or function.118\n\n Detailed Sub-Objectives\n\n 1.\t Evaluate whether the agency has established an insider threat program office to address\n the risk agency-wide. Assess whether:\n\n A.\t The agency has established a program office, working group, or other entity responsible\n for addressing insider threat risks agency-wide.\n B.\t The agency has addressed the insider threat risk by establishing roles and \n\n responsibilities, and insider threat-specific policies, procedures, and guidance.\n\n C.\t Policies exist to minimize the potential risk from a malicious insider with regard to loss,\n destruction, or theft of data.\n D.\t The agency has implemented an annual insider threat security awareness program for\n all employees.\n E.\t Employees are given the training/knowledge to assist the organization in recognizing\n and addressing potential or actual insider threat risks or attacks.\n F.\t The agency includes a cross-discipline insider threat incident handling team or working\n group.\n G. There is a process for ensuring that employees are knowledgeable and kept up to date\n regarding insider threat policies.\n\n 2.\t Evaluate whether there is an enterprise risk management process that addresses insider\n threats.\n\n A.\t Identify whether an agency possesses an enterprise risk management plan. If so, obtain\n a copy of that plan and assess how or if insider threat risks are identified, assigned, and\n addressed across the enterprise.\n B.\t Ensure that a risk management process is implemented consistently and continually\n across the agency.\n C.\t Review agency components\xe2\x80\x99 processes for assigning risk to information systems that\n aligns with the latest National Institute of Standards and Technology guidance.\n\n 118\n References to \xe2\x80\x9cagency\xe2\x80\x9d apply to any responsible office, component, or governing body.\n\n\nwww.oig.dhs.gov 173\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n 3.\t Evaluate whether the agency consistently communicates insider threat risk policies and\n procedures across the enterprise. Assess whether:\n\n A.\t Agency organizations work separately or together to identify, prioritize, and address the\n insider threat risk.\n B.\t Communication among all agency organizations is continual and consistent to help\n ensure that new threats, attack vectors, and countermeasures are effectively handled.\n C.\t The agency disseminates and communicates its risk management strategy.\n D.\t The agency includes recognizing and reporting potential indicators of insider threat as a\n part of its security awareness training.\n\n 4.\t Evaluate whether potential candidates for hire are screened for the insider threat risk and\n that the agency performs background checks before determining suitability of a potential\n employee.\n\n 5.\t Evaluate whether the agency has a consistent process for removing system and building\n access when an employee retires, resigns, terminates, transfers, or is put on a leave of\n absence. Assess whether:\n\n A.\t Human Resources, management, and the security office are notified upon termination\n of an individual.\n B.\t The agency retrieves its property and software immediately upon an employee\xe2\x80\x99s exit.\n C.\t All system access is terminated timely when an employee, contractors, or other trusted\n partners terminate employment.\n D.\t Other employees are notified timely when an employee exits.\n\n 6.\t Evaluate whether the agency has the ability to identify and report an employee\xe2\x80\x99s unusual\n behavior. Assess whether:\n\n A.\t Supervisors are trained to monitor and respond to behaviors of concern exhibited by\n employees.\n B.\t Management, Human Resources, and security personnel work together when resolving\n employee conduct issues.\n C.\t Reports of policy violations are systematically recorded so that management, Human\n Resources, and security personnel can reach a fair decision.\n D.\t An employee who notices suspicious behavior by another employee knows how to\n report this behavior.\n\n 7.\t Evaluate how effectively the user account management process prevents unauthorized\n access to critical IT systems. Assess whether:\n\n\n\n\nwww.oig.dhs.gov 174\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n A.\t The agency has a procedure or process to verify against unauthorized backdoor\n accounts. Verify that these accounts do not exist.\n B.\t There are any shared accounts and whether the accounts should be removed.\n C.\t There are any expired or dormant accounts and how long they have been inactive.\n D.\t The highest level of permission(s) granted to the system administrator(s) of that system\n is necessary and whether these permissions were properly approved in a formal\n authorization process.\n E.\t The number of privileged (i.e., administrator or elevated access) accounts is equal to the\n number of formal authorizations that have been granted.\n F.\t The component verifies the instances of unauthorized changes to user accounts or user\n access controls (level of access) on information systems.\n\n\n\n\nwww.oig.dhs.gov 175\t OIG-14-43\n\x0c OFFICE OF INSPECTOR GENERAL\n Department of Homeland Security\n\n\n Appendix X\n Contributors to This Guide\n This guide was prepared by:\n\n Barbara Bartuska, IT Audit Manager, Office of IT Audits, DHS OIG\n Patrick Nadon, Operations Manager, Office of IT Audits, DHS OIG\n\n The following OIGs provided audit plans/programs for consideration:\n\n Department of Defense\n Department of Education\n Department of Health and Human Services\n Department of Housing and Urban Development\n Environmental Protection Administration\n Social Security Administration\n Tennessee Valley Authority\n United States Department of Agriculture\n United States Postal Service\n\n\n\n\nwww.oig.dhs.gov 176 OIG-14-43\n\x0cADDITIONAL INFORMATION\n\nTo view this and any of our other reports, please visit our website at: www.oig.dhs.gov.\n\nFor further information or questions, please contact Office of Inspector General (OIG)\nOffice of Public Affairs at: DHS-OIG.OfficePublicAffairs@oig.dhs.gov, or follow us on\nTwitter at: @dhsoig.\xe2\x80\x9d\n\nOIG HOTLINE\n\nTo expedite the reporting of alleged fraud, waste, abuse or mismanagement, or any\nother kinds of criminal or noncriminal misconduct relative to Department of Homeland\nSecurity (DHS) programs and operations, please visit our website at www.oig.dhs.gov\nand click on the red tab titled "Hotline" to report. You will be directed to complete and\nsubmit an automated DHS OIG Investigative Referral Submission Form. Submission\nthrough our website ensures that your complaint will be promptly received and\nreviewed by DHS OIG.\n\nShould you be unable to access our website, you may submit your complaint in writing\nto:\n\n Department of Homeland Security \n\n Office of Inspector General, Mail Stop 0305 \n\n Attention: Office of Investigations Hotline \n\n 245 Murray Drive, SW \n\n Washington, DC 20528-0305 \n\n\nYou may also call 1(800) 323-8603 or fax the complaint directly to us at\n(202) 254-4297.\n\nThe OIG seeks to protect the identity of each writer and caller.\n\x0c'