Department of Homeland Security �������������������������� Management Advisory Report: A Guide for Assessing Cybersecurity within the Office of Inspector General Community This report was prepared on behalf of Council of the Inspectors General on Integrity and Efficiency. OIG-14-43 February 2014 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 I www.oig.dhs.gov February 24, 2014 MEMORANDUM FOR: Council ofthe Inspectors General on Integrity and n~ONc- FROM: 4arlton I. Mann Chief Operating Officer SUBJECT: Management Advisory Report: A Guide for Assessing Cybersecurity Within the Office of Inspector General Community The Council ofthe Inspectors General on Integrity and Efficiency {CIGIE) tasked the Cybersecurity Working Group with undertaking a review in which it would examine the role of the Inspector General community in current Federal cybersecurity initiatives. CIGIE proposed that the Cybersecurity Working Group work under the auspices of the Information Technology (IT) Committee. As a member of the IT Committee, the Department of Homeland Security (DHS) Office of Inspector General (OIG) was asked to lead and coordinate the Cybersecurity Working Group's efforts in identifying the Inspector Generals' cybersecurity oversight role. I am pleased to provide CIGIE with a high-level audit guide that can be used as a baseline for cyber and IT security-related reviews conducted by the Inspector General community. The guide is based on the subject matter expertise of DHS OIG IT audit managers and specialists, legal research, and a review of applicable websites and audit programs developed within the OIG community. The intent ofthis guide is to provide a foundation for conducting cybersecurity and IT system security-related audits. The guide was developed to the best knowledge available to DHS OIG. We trust that this guide will result in better protecting the integrity of Federal computer systems and networks and minimize the risks associated with cyber vulnerabilities and potential threats. I would like to acknowledge the support provided to this effort by all the participants listed in Appendix X to produce a final document that represents the needs of the Inspector General community. Attachment The Council of the Inspectors General on Integrity and Efficiency (CIGIE) was statutorily established as an independent entity within the executive branch by the Inspectorf GeneralfReformfActfoff2008, Public Law 110-409. The mission of the CIGIE is to— • Address integrity, economy, and effectiveness issues that transcend individual government agencies. • Increase the professionalism and effectiveness of personnel by developing policies, standards, and approaches to aid in the establishment of a well-trained and highly skilled workforce in the Federal Inspector General (IG) community. CIGIE Membership • All IGs whose offices are established under either section 2 or section 8G of the InspectorfGeneralfAct, or pursuant to other statutory authority (e.g., the Special IGs for Iraq Reconstruction, Afghanistan Reconstruction, and Troubled Asset Relief Program). • The IGs of the Office of the Director of National Intelligence (or at the time of appointment, the IG of the Intelligence Community) and the Central Intelligence Agency. • The IGs of the Government Printing Office, the Library of Congress, the Capitol Police, the Government Accountability Office, and the Architect of the Capitol. • The Controller of the Office of Federal Financial Management. • A senior-level official of the Federal Bureau of Investigation, designated by the Director of the Federal Bureau of Investigation. • The Director of the Office of Government Ethics. • The Special Counsel of the Office of Special Counsel. • The Deputy Director of the Office of Personnel Management. • The Deputy Director for Management of the Office of Management and Budget. OFFICE OF INSPECTOR GENERAL Department of Homeland Security CIGIE Information Technology Committee The CIGIE Information Technology (IT) Committee’s mission is to facilitate effective IT audits, evaluations, and investigations by IGs, and to provide a vehicle for the expression of the IG community's perspective on Government-wide IT operations. Under its operating principles, this committee strives to promote participation by the IG community members in its activities, encourage communication and cooperation with colleagues in the IT field (including Federal Chief Information Officers and staff, and security professionals), and promote effective teamwork in addressing Government-wide initiatives, improving IG IT activities, and safeguarding national IT assets and infrastructure. Some of the key activities of this committee include coordinating IT-related activities of the CIGIE, conducting relevant IT educational and training activities, advising the CIGIE on IT issues, and providing for IT information exchange among the IGs, including best practices and current capabilities. The Cybersecurity Working Group was formed under the auspices of the CIGIE IT Committee. OFFICE OF INSPECTOR GENERAL Department of Homeland Security Table of Contents Executive Summary ............................................................................................................. 1 Background ......................................................................................................................... 3 Objective and Scope ........................................................................................................... 5 Federal Agency Responsibilities for Critical Infrastructure ................................................ 6 Cybersecurity Policy ............................................................................................................ 9 System Security and Vulnerability Guidance .................................................................... 14 System Vulnerability Management and Penetration Testing. .......................................... 23 Information Security Continuous Monitoring .................................................................. 29 Cloud Computing .............................................................................................................. 33 Steps for Evaluating a Cybersecurity Program ................................................................. 37 Steps for Conducting Cybersecurity-Related Audits ......................................................... 41 Appendixes Appendix A: Additional References to Relevant Requirements and Guidance……….. ........................................................................... 54 Appendix B: 2013 and Beyond Threat Landscape ........................................... 70 Appendix C: Sample ROE ................................................................................. 75 Appendix D: Vulnerability Scanning and Penetration Testing Tools ............... 85 Appendix E: Objectives for Evaluating an Agency’s Cybersecurity Program 100 Appendix F: Objectives for Evaluating Identity Management ...................... 102 Appendix G: Objectives for Evaluating Network Management and Security……………………. ............................................................... 105 Appendix H: Objectives for Evaluating Laptop Security ................................ 113 Appendix I: Objectives for Evaluating Wireless Security .............................. 118 Appendix J: Objectives for Evaluating Database Security............................. 122 Appendix K: Objectives for Evaluating UNIX Operating System Security ...... 130 Appendix L: Objectives for Evaluating Remote Access Controls and Security……………………. ............................................................... 141 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Appendix M: Objectives for Evaluating Mobile Device Security .................... 147 Appendix N: Objectives for Evaluating Portable Storage Device Security ..... 150 Appendix O: Objectives for Evaluating E-mail Security .................................. 152 Appendix P: Objectives for Evaluating Web Server Security ......................... 155 Appendix Q: Objectives for Evaluating DNS Server Security.......................... 157 Appendix R: Objectives for Evaluating Firewall Security ............................... 159 Appendix S: Objectives for AD Testing .......................................................... 163 Appendix T: Objectives for Evaluating Incident Response, Handling, and Reporting………………….. .............................................................. 165 Appendix U: Objectives for Evaluating IPv6 ................................................... 168 Appendix V: Objectives for RFID Testing ....................................................... 171 Appendix W: Objectives for Evaluating Insider Threats ................................. 173 Appendix X: Contributors to This Guide ........................................................ 176 Abbreviations ACL Access Control List AD Active Directory AES Advanced Encryption Standard ANSI American National Standards Institute CD compact disk CERT/CC Computer Emergency Response Team Coordination Center CIGIE Council of the Inspectors General on Integrity and Efficiency CIKR critical infrastructure and key resources CIO Chief Information Officer CIS Center for Internet Security CISO Chief Information Security Officer CNCI Comprehensive National Cybersecurity Initiative COBIT Control Objectives for Information and related Technology CPR Cyberspace Policy Review CPU Central Processing Unit CVSS Common