CYBERSECURITY

NASA info security controls are broken, GAO concludes

Audit finds NASA information security weaknesses put space agency networks, information at risk

Key information technology systems at NASA have weaknesses in several critical areas that could lead to those systems being compromised, according to the Government Accountability Office.

Although controls are being implemented as part of a risk-based information security program, required under the Federal Information Security Management Act, controls were not always adequate or consistently enforced, resulting in security gaps in physical and logical perimeters and leaving vulnerabilities in networks and systems.

“A key reason for these weaknesses was that NASA had not yet fully implemented key elements of its information security program,” GAO said in its report, NASA Needs to Remedy Vulnerabilities in Key Networks. “As a result, highly sensitive personal, scientific, and other data were at an increased risk of unauthorized use, modification, or disclosure.”

The space agency agreed with GAO's recommendations for strengthening and completely implementing security controls.

“Many of the recommendations are currently being implemented as part of an ongoing strategic effort to improve information technology management and IT security program deficiencies previously identified through several NASA internal assessments,” deputy administrator Lori B. Garver wrote.

IT security concerns are not limited to NASA. Agencies across government as well as individuals and private sector organizations across the world have been subjected to a growing number of attacks and intrusions by criminal organizations and, it is believed, by other nations as well. Threats are expected only to become more serious.

“This concern is well-founded for a number of reasons, including the dramatic increase in reports of security incidents, the ease of obtaining and using hacking tools, the steady advance in the sophistication and effectiveness of attack technology, and the dire warnings of new and more destructive attacks to come,” GAO said.

NASA has not ignored its security, but just $15 million — slightly less than 1 percent the agency’s $1.6 billion IT budget — was spent on security in fiscal 2009. In 2007 and 2008, NASA reported 839 cases of malicious code, 209 cases of unauthorized access and 72 denial-of-service attacks to the U.S. Computer Emergency Readiness Team. In February this year, 82 internal devices were found infected with the Seneka Rootkit that had been communicating with malicious servers since January. By March, three NASA centers were infected.

GAO examined information security at NASA headquarters in Washington, as well as at the Goddard Space Flight Center in Greenbelt, Md.; the Jet Propulsion Laboratory in Pasadena, Calif.; the Marshall Space Flight Center in Huntsville, Ala.; and the Ames Research Center in Moffett Field. Calif. Although the space agency has implemented many information security controls, GAO found that some weaknesses persisted.

Among the weaknesses were that the centers did not consistently implement effective electronic access controls. Two centers did not requiring strong passwords and password files were unencrypted. Three centers did not adequately restrict user access to the least privileges needed to perform a mission, allowing unnecessary remote access, shared accounts and group user identifications. Network encryption sometimes used weak algorithms, some network management connections were left unencrypted, and desktops and laptops were not fully encrypted.

Vulnerability scanning was not comprehensive, source code was not being reviewed for vulnerabilities, and not all systems were protected by intrusion detection systems, according to the report. Patch and configuration management also was not up to date. “As a result, NASA may not detect certain vulnerabilities or unauthorized activities, leaving the network at increased risk of compromise or disruption,” GAO said.

System and physical network perimeters also were not adequately protected. Boundary protection between sensitive networks was not adequate, and some centers did not have host-based firewalls and some firewalls could be bypassed. Three centers had e-mail servers that allowed spoofed e-mails to deliver dangerous attachments. Physical access controls were in place at sensitive facilities, but were not properly used.

“Retractable bollards that protect delivery doors, generators, and fuel tanks at the data and communication centers were not operable and were in the ‘open’ retracted position,” GAO found.

Problems were traced to weaknesses in the NASA security program. GAO found that the agency did not always fully assess information security risks and had not fully developed and documented security policies and procedures. Some key information was not included in security plans, comprehensive tests and evaluation of its information system controls had not been conducted and plans to remedy known weaknesses were not being tracked. There also was inadequate planning for service disruptions and for detecting, reporting and responding to security incidents.

GAO recommended that NASA:

  • Develop and implement comprehensive and physical risk assessments that include mission-related systems and applications and known vulnerabilities identified.
  • Develop and implement security policies and procedures for malware, incident handling roles and responsibilities, and physical environmental protection.
  • Include key elements for system security plans such as information from risk assessments and signed system interconnection security agreements.
  • Conduct comprehensive security testing and evaluation of all relevant security controls, including management, operational and technical controls.
  • Develop remedial plans to address deficiencies and ensure that IT system items are tracked and reported to the agency CIO in a timely manner so that corrective actions can be taken.
  • Update contingency plans to include key information, including contact information and approvals, and identify geographically diverse backup sites that are unlikely to be affected by the same disaster event.
  • Implement an adequate incident detection program to include a consistent definition of an incident, incident roles and responsibilities, along with resources to operate the program.

GAO made an additional 179 recommendations separately with limited distribution.

Reader Comments

Fri, Oct 23, 2009 Eirik Iverson Chantilly, Virginia

Infestations by Seneka Rookit variants can be easily prevented. AppGuard and other computer protection solutions stop it cold, without users' having to make a security decision, without some kind of signature or 'pattern' known before hand, without slowing down computers under their protection. It just requires one-time installation: problem solved. The same can be said for nearly anything else NASA and other computer users would likely encounter. The question remaining is why don't these and other computers have computer protection software on them designed to stop these threats? Why keep relying on security software that gets defeated again and again?

Mon, Oct 19, 2009 femtobeam

The GAO is subcontracted to Bechtel who with Battelle manage most of the US Federal Laboratories and together control much of the US network system infrastructure. There was also the Bechtel/Jacobs incident in Houston, where there was a break in, hostages taken and NASA personnel killed who were involved with antennas. In addition, there is the fact that NASA management have opted for Japanese involvement in their space systems over US developed technology, such as Dr. Glenn's superior CMOS based HDMAX cameras. The Japanese program embarrassingly failed in space. Others, such as DARPA, have become involved in NASA systems, bringing with them DOD sharing arrangements like JOE with Israel and involvement with China. Further, NASA's mandate is to share some science and technology with the public, encouraging education in science and public awareness. It seems that NASA's problems are originated from the outside by subcontractors and equipment manufacturers that want control over this critical US Government Agency. NASA has been one of the few agencies, although seriously constrained by budgets that supports individual researchers and small business. Let's hope they can remain the only agency that is not subcontracted to for profit companies who sabotage them and then demand compliance and eventually a management contract with their business associates in Japan, Korea, China, and Israel.

Mon, Oct 19, 2009 oracle2world

As unfortunate as outside attacks are, the REAL threats are inside jobs, especially from the security staff. So was there any concern by GAO about personnel security? Like what kind of wheels some of these computer security jocks drive?

Mon, Oct 19, 2009 Ronald McCullough Kennedy Space Center

Should the omission of Kennedy Space Cener and Johnson Space Center be interpretted as this situation does not exist at either space center?

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above