GAO: FinCEN InfoSec Program = Bad

Like most bad news Washington, this GAO report was released on a Friday afternoon. This Friday afternoon happens to be before the Super Bowl of all things. So this is a special Friday where it almost certain to be overshadowed by the drama of the “Big Game”.

This report (that I got to read, believe or not) tells the story of the security posture of the Financial Crimes Enforcement Network (FinCEN). FinCEN is responsible for some important things not the least of which is keeping money laundering to a minimum, stopping terrorist financing and investigating other financial crimes. You may be interested to know that it has ties to many financial institutions, casinos and other places where big money may be. This is also the group that banks notify when you move $10,000 or more.

Ok, so now you know who they are and what they do. Here's the rub:

Although FinCEN, TCS, and IRS have taken important steps in implementing numerous controls to protect the information and systems that support FinCEN’s mission, significant weaknesses existed that impaired their ability to ensure the confidentiality, integrity, and availability of these information and systems. The organizations have implemented many security controls to protect the information and systems. For example, FinCEN employed controls to segregate areas of its network and restrict access to sensitive areas, and IRS controlled changes to a key application in its BSA processing environment. However, weaknesses existed that placed sensitive data at risk of unauthorized disclosure. The organizations did not always consistently apply or fully implement controls to prevent, limit, or detect unauthorized access to devices or systems. For example, the organizations had not consistently or fully (1) implemented user and password management controls for properly identifying and authenticating users, (2) restricted user access to data to permit only the access needed to perform job functions, (3) encrypted data, (4) protected external and internal boundaries, and (5) logged user activity on key systems. Shortcomings also existed in managing system configurations, patching systems, and planning for service continuity. As a result, increased risk exists that unauthorized individuals could read, copy, delete, add, and modify data and disrupt service on systems supporting FinCEN’s mission.

Holy F@%!, Batman!

I would say this is in the category of jobs that you don't want to have. Or at least had. One thing that I think I can infer from the report, is that the system is not classified. Meaning people didn't have clearances to work on the system. But there doesn't appear to be any discussion about that and I am not saying that it needs to be. On this point, I want to say that there is enough documentation and business processes out there to support doing this better.

Now, I am not going to keep writing and lamenting that our data isn't safe. This is a tough job and usually information security is something that gets tacked on. The ST&E portions of the Certifications on the system were probably rushed and people missed things. Some things get rushed out the door, some risks get accepted, whatever.

But seriously, there are some pretty basic things that the Continuous Monitoring efforts should have taken care of: excessive user rights, unused accounts, limited or missing encryption. Read the report for yourself it reads like How not to do Information Security. And now for the moral of the story.

The answers here and with most organizations will not lie with new technology but with leadership, a plan and processes. Some of it, like the mainframe, sounds like it needs an upgrade. The common thing though are operational keeping an eye on user accounts, monitoring the logs, IDS; those are things that need humans with eyes and analytical skills.