GAO Slams FBI Network Security

The Government Accountability Office, the federal government's watchdog agency, Thursday released a report critical of the FBI's internal network, asserting it lacks security controls adequate to thwart an insider attack.

In the report, titled "Information Security: FBI Needs to Address Weaknesses in Critical Network," the authors -- Gregory Wilshusen, GAO's director of information security issues, and Chief Technologist Keith Rhodes -- said the FBI lacks adequate network security controls.

The FBI "has an incomplete security plan," the report concluded.

The bureau, which had the opportunity to review the GAO's findings before publication, responded that it wasn't arguing with some of the technical observations expressed in the GAO report, but disagreed that the FBI is open to unacceptable risk of an insider attack.

In a letter of response to the GAO, Dean Hall, the FBI's deputy CIO, and Zalmal Azni, the FBI's CIO, noted, "The FBI concurs with many of the GAO's technical recommendations and the programmatic recommendation to continue the implementation of information security activities in order to fully establish a comprehensive Information Assurance Program."

Hall and Azni defended the FBI's risk-management posture, however, emphasizing, "The FBI does not agree that it's placed sensitive information at an unacceptable risk for unauthorized disclosure, modification or insider threat."

The GAO, however, stated in the report that an evaluation of the effectiveness of the FBI's security controls over routers, switches, servers, network management, firewalls and other IT infrastructure at FBI headquarters, revealed the FBI "did not consistently configure network devices and services to prevent unauthorized insider access."

Among its other findings, the GAO said the FBI did not adequately "identify and authenticate users to prevent unauthorized access." The GAO report also criticized FBI network security in other regards, saying that there was a lack of encryption to protect sensitive data and patch management wasn't being done in a timely manner.

The GAO's analysis of the FBI internal network had been requested by Rep. James Sensenbrenner, chair of the Judiciary Committee in the U.S. House of Representatives.