Forwarded from: William Knowles <erehwon@c4i.org>
http://www.gcn.com/vol1_no1/daily-updates/37525-1.html
By Alice Lipowicz
Contributing Staff Writer
11/08/05
The Federal Emergency Management Agency is not adequately protecting
its core databases containing sensitive disaster relief information,
according to a new report from Homeland Security Department inspector
general Richard L. Skinner.
A redacted copy [1] of the report was posted at the inspector
general's Web site today.
FEMA - which comprises the bulk of DHS' Emergency Preparedness and
Response directorate - has made some improvements in its IT security,
including establishing a process to manage change and a contingency
plan, the report said.
However, FEMA has not implemented effective access controls and
continuity of operations safeguards, nor has it conducted contingency
plan training or testing.
The inadequacies were found in information security controls for the
National Emergency Management Information System (NEMIS), FEMA's core
database system for managing disaster relief funding and resources.
"Due to these database security exposures, there is an increased risk
that unauthorized individuals could gain access to critical EP&R
[Emergency Preparedness and Response] database resources and
compromise the confidentiality, integrity and availability of
sensitive NEMIS data," Skinner wrote in the report. "In addition, EP&R
may not be able to recover NEMIS following a disaster."
FEMA officials agreed with most of the audit findings and were taking
corrective action, according to the report. However, 56 deficiencies
remained unaddressed, Skinner wrote in a summary.
In addition, FEMA has not fully aligned its IT security program with
the department's policies and practices, the report said. Security
controls have not been tested in more than a year, a contingency plan
has not been tested, security control costs have not been integrated
into the lifecycle of the system, and system and database
administrators have not received specialized security training,
according to the report.
NEMIS was developed by Anteon International Corp. of Fairfax, Va., and
became operational in 1998. The system replaced FEMA's legacy IT
infrastructure with a fully integrated architecture consisting of more
than 31 networked servers installed nationwide, according to a fact
sheet posted on Anteon's Web site.
CIS database security also lacking
Separately, the DHS inspector general released another report [2]
stating that the Citizenship and Immigration Services agency has not
developed adequate database security controls for its Central Index
System, including access controls, configuration management procedures
and continuity of operations safeguards.
The Central Index System was established in 1985 to assist in
enforcing immigration laws. It contains biographical and status
information on about 55 million people, including permanent residents,
naturalized citizens, apprehended aliens and others.
-=-
Alice Lipowicz is a staff writer for Government Computer News' sister
publication, Washington Technology.
[1] http://www.dhs.gov/interweb/assetlibrary/OIGr_05-43_Sep05.pdf
[2] http://www.dhs.gov/interweb/assetlibrary/OIGr_05-42_Sep05.pdf
*====================================================================*
"Communications are the nervous system of the entire SAC organization,
and their protection is therefore, of the greatest importance. I like
to say that without communications, all I control is my desk, and that
is not a very lethal weapon." --- General T.S. Power U.S.A.F
----------------------------------------------------------------------
erehwon@c4i.org http://www.c4i.org/erehwon/
*====================================================================*
_________________________________________
Earn your Master's degree in Information Security ONLINE
www.msia.norwich.edu/csi
Study IA management practices and the latest infosec issues.
Norwich University is an NSA Center of Excellence.
