Date: September 22, 2006 :
To: The Commissioner
From: Inspector General
Subject: Assessing Social Security Administration's Efforts to Protect Sensitive Information (A-14-07-27068)
The attached report summarizes our assessment of the Social Security Administration's
(SSA) actions taken to protect sensitive information, as required by the Office
of Management and Budget (OMB) Memorandum M-06-16, Protection of Sensitive Agency
Information.
OMB M-06-16 requires the Office of the Inspector General to perform a review
of SSA's efforts to comply with the requirements specified in the memorandum.
Based on our assessment, SSA has taken a number of steps to comply with the requirements of OMB M-06-16. We believe the observations outlined in our report will assist SSA management in strengthening its security program to better protect the Agency's Personally Identifiable Information. Please comment on corrective action taken or planned on each recommendation. If you wish to discuss the final report, please call me or have your staff contact Steven L. Schaeffer, Assistant Inspector General for Audit, at (410) 965-9700.
Patrick P. O'Carroll, Jr.
Assessing Social Security Administration's Efforts to Protect Sensitive Information
September 2006 A-14-07-27068
Patrick P. O'Carroll, Jr. - Inspector General
Mission
By conducting independent and objective audits, evaluations and investigations, we inspire public confidence in the integrity and security of SSA's programs and operations and protect them against fraud, waste and abuse. We provide timely, useful and reliable information and advice to Administration officials, Congress and the public.
Authority
The Inspector General Act created independent audit and investigative units, called the Office of Inspector General (OIG). The mission of the OIG, as spelled out in the Act, is to:
Conduct and supervise independent and objective audits and investigations relating
to agency programs and operations.
Promote economy, effectiveness, and efficiency within the agency.
Prevent and detect fraud, waste, and abuse in agency programs and operations.
Review and make recommendations regarding existing and proposed legislation
and regulations relating to agency programs and operations.
Keep the agency head and the Congress fully and currently informed of problems
in agency programs and operations.
To ensure objectivity, the IG Act empowers the IG with:
Independence to determine what reviews to perform.
Access to all information necessary for the reviews.
Authority to publish findings and recommendations based on the reviews.
Vision
We strive for continual improvement in SSA's programs, operations and management by proactively seeking new ways to prevent and deter fraud, waste and abuse. We commit to integrity and excellence by supporting an environment that provides a valuable public service while encouraging employee development and retention and fostering diversity and innovation.
MEMORANDUM
Date: September 22, 2006
To: The Commissioner
From: Inspector General
Subject: Assessing Social Security Administration's Efforts to Protect Sensitive Information (A-14-07-27068)
OBJECTIVE
Our objective was to assess the Social Security Administration's (SSA) actions to ensure that Personally Identifiable Information (PII) is safeguarded in accordance with the Office of Management and Budget (OMB) Memorandum M-06-16, Protection of Sensitive Agency Information.
BACKGROUND
In response to numerous incidents involving the compromise or loss of sensitive
personal information, OMB issued several memoranda to provide Federal agencies
guidance on the protection of PII entrusted to them.
OMB defined Sensitive PII as:
any information about an individual maintained by an agency, including, but not limited to, education, financial transactions, medical history, and criminal or employment history and information which can be used to distinguish or trace an individual's identity, such as their name, social security number, date and place of birth, mother's maiden name, biometric records, etc., including any other personal information which is linked or linkable to an individual.
Information systems can be either electronic or manual.
OMB issued Memorandum M-06-16, on June 23, 2006. The Memorandum specifies measures
that agencies need to have in place to ensure protection of sensitive remote
information by August 7, 2006. M-06-16 requires Federal agencies to comply with
the Security Checklist provided by National Institute of Standards and Technology
(NIST) and recommends four additional actions that agencies should take for
the protection of remote sensitive information. The intent is to compensate
for the lack of physical security controls when information is removed from,
or accessed from outside the agency location.
The security controls and assessment procedures in the NIST Security Checklist were taken from NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems, February 2005 and NIST Special Publication 800-53A, Guide for Assessing the Security Controls in Federal Information Systems (Second Public Draft), April 2006. The controls and assessment methods/procedures in the checklist are a subset of what is currently required for moderate and high impact information systems.
SCOPE AND METHODOLOGY
Our work was limited to assessing SSA's efforts to protect sensitive information as prescribed by OMB Memorandum M-06-16. To meet our objective, we interviewed appropriate Agency staff and reviewed relevant Agency policies and procedures and controls' documentation. We used the review guide and the Data Collection Instrument developed by the President's Council on Integrity and Efficiency/Executive Council on Integrity and Efficiency. See Appendix B for more details on our Scope and Methodology.
SUMMARY OF RESULTS
Our assessment showed that SSA has taken a number of steps to comply with OMB Memorandum M-06-16 requirements. Based on our assessment, we found that the Agency has taken the following actions to protect its sensitive personal information;
SSA has initiated projects to encrypt all laptop computers and mobile devices.
On June 6, 2006, SSA's Chief Information Officer (CIO) issued a message to all
SSA employees, contractors and Disability Determination Service employees to
remind them of their responsibilities to properly safeguard PII entrusted to
them.
SSA has also created a web page Safeguarding Personal Information, where PII
is defined and PII protection issues are discussed.
SSA computers and applications are set to time out after 15 minutes of inactivity.
SSA continues to make progress in the protection of the PII. However, to fully comply with OMB Memorandum M 06-16 and to better protect remote PII, SSA needs to improve in the following areas:
SSA policy for the protection of PII;
Encryption of removable media;
Encryption of sensitive data on mobile computers and devices;
Two-factor authentication when remotely accessing PII; and
Logging data extracts.
SSA Policy for the Protection of PII
SSA's information security policy is documented in its Information Systems Security Handbook (ISSH). During our review, we identified Agency policies and procedures regarding the protection of PII. For example, the memorandum issued by the CIO states "Mainframe access from the alternate duty station for those employees on flexiplace is prohibited." However, a number of important points in OMB Memorandum M-06-16 are not addressed. For example, SSA does not explicitly state whether downloading of PII is allowed. Also, the policy does not clearly state what remote access methods should be used. To comply better with OMB Memorandum M 06-16, SSA needs to revise and consolidate its security policy.
Encryption of Removable Media
OMB Memorandum M-06-16 recommends encryption for PII being transported and/or stored offsite. SSA routinely sends its systems and data back-up tapes to off-site storage facilities (OSSF). There are about 20,000 tapes stored at its primary OSSF which contain PII. Currently, these tapes are not encrypted before they are sent for off-site storage. However, there are numerous compensating controls to protect these tapes such as storage in a secured vault, guards, and video monitoring. SSA is also in the process of evaluating an off-site data encryption solution to address this issue. In addition, SSA has implemented stringent physical security controls to protect these tapes during transportation to and within the storage facility.
Encryption of Sensitive Data on Mobile Computers and Devices
OMB Memorandum M-06-16 recommends encryption of all data on mobile computers and devices that carry sensitive agency data. SSA has actively pursued the encryption of data on all mobile devices and has initiated a project to encrypt the hard drives of all laptop computers. All new laptops should have been encrypted by August 31, 2006 and all older laptops should be encrypted by October 31, 2006. In the future, SSA plans to decommission unencrypted laptops.
Additionally, SSA's Outlook Web Access (OWA) enables employees to access their SSA mailboxes from any computer which has Internet access. Employees can use their home computers to obtain full access to e-mail attached files through OWA. Although SSA requires password protection for such files, it does not ensure files containing PII are encrypted. SSA is working on a solution that will increase the security of data accessed through OWA. See section on two-factor authentication.
Two-Factor Authentication When Remotely Accessing PII
OMB Memorandum M-06-16 recommends that agencies allow remote access only with two-factor authentication where one of the factors is provided by a device separate from the computer gaining access. SSA employees can access PII remotely through two methods, a virtual private network (VPN) and OWA. SSA's VPN can only be used on SSA computers configured to use SSA's VPN. The VPN technology uses two-factor authentication method: Smartcard (separate from the computer gaining access) and a password.
To access OWA, an individual uses his/her SSA network Personal Identification Number and password. However, the Office of Telecommunications and Systems Operations is developing and testing improved authentication methods to meet the requirements set forth by OMB Memorandum M-06-16.
Logging Data Extracts
OMB Memorandum M-06-16 recommends that agencies "log all computer-readable data extracts from databases holding sensitive information and verify each extract including sensitive data has been erased within 90 days or its use is still required." SSA acknowledged that it has not logged all of its data extracts nor verified that they were erased within 90 days.
SSA stated that this OMB recommendation poses a significant business concern and has serious implications for many existing SSA business processes. SSA routinely and extensively extracts data from its databases that contain PII and shares this information with both internal and external entities. Internally, SSA components use the data extracts within the organization for its core business processes and various reviews. Externally, SSA provides data extracts to other Federal, state and local government partners and trusted-third parties to assist in cross-agency program delivery and coordination.
Due to the large number of the data extracts created daily, SSA stated that
it cannot log and track this information in accordance with OMB Memorandum M-06-16.
However, the Agency has other compensating controls to protect the PII contained
in the data extracts. They include access controls, certain logging activities,
internal and external security audits, and the implementation of a new confidentiality
notice transferring custodial responsibilities for protecting PII. SSA should
continue to pursue its efforts to protect data extracts involving PII.
CONCLUSIONS AND RECOMMENDATIONS
Our assessment showed that SSA has taken a number of steps to comply with OMB Memorandum M-06-16 requirements and has made progress in the protection of the PII. SSA has initiated projects to encrypt all laptop computers and mobile devices and has issued a reminder to its employees to remind them of their responsibilities to properly safeguard PII entrusted to them. SSA has also created a web page Safeguarding Personal Information, where PII is defined and PII protection issues are discussed. However, there are a few areas in the protection of remote PII that need to be addressed. To fully comply with OMB M-06-16, we recommend SSA:
1. Revise and consolidate Agency policy to better protect PII;
2. Continue to investigate methods to encrypt PII stored off-site and implement technologies that meet recommended NIST standards;
3. Complete on-going projects to encrypt all mobile computers and devices;
4. Implement stronger authentication solutions for OWA; and
5. Continue efforts to log and protect data extracts involving PII per NIST standards.
Patrick P. O'Carroll, Jr.
Appendices
APPENDIX A - Acronyms
APPENDIX B - Scope and Methodology
APPENDIX C - OIG Contacts and Staff Acknowledgments
Appendix A
Acronyms
DCI Data Collection Instrument
FIPS Federal Information Processing Standards
FISMA Federal Information Security Management Act of 2002
ISSH Information Systems Security Handbook
NIST National Institute of Standards and Technology
OMB Office of Management and Budget
OSSF Off-site Storage Facility
OWA Outlook Web Access
PII Personally Identifiable Information
SP Special Publication
SSA Social Security Administration
VPN Virtual Private Network
Appendix B
Scope and Methodology
The following is taken from the review guide developed by the President's Council
on Integrity and Efficiency/Executive Council on Integrity and Efficiency.
Various laws and regulations have addressed the need to protect sensitive information
held by government agencies including the Federal Information Security Management
Act (FISMA), the E-Government Act of 2002, the Privacy Act of 1974, and the
Office of Management and Budget's (OMB) Circular A-130, Management of Federal
Information Resources. FISMA requires agencies to have a security program and
controls for systems to protect their sensitive information.
FISMA also requires agencies to implement standards and guidelines developed
by the National Institute of Standards and Technology (NIST). Relevant standards
are:
Federal Information Processing Standards (FIPS) Publication 199, Standards
for Security Categorization of Federal Information and Information Systems,
February 2004;
FIPS Publication 200, Minimum Security Requirements for Federal Information
and Information Systems, March 2006; and
FIPS Publication 201, Personal Identity Verification of Federal Employees and
Contractors, February 2005.
Additional guidance on protecting PII and other sensitive information is described
in NIST Special Publication (SP) 800 series. Among them, SP 800-53, Recommended
Security Controls for Federal Information Systems, provides key criteria for
assessing compliance with FISMA requirements. This guidance forms the basis
for the OMB Memorandum M-06-16 Security Checklist covering protection of remote
information. OMB's memorandum conveys the intent of implementing the checklist
and specific recommended actions to be taken by Federal agencies for the protection
of sensitive information to compensate for the lack of physical security controls
when information is removed from, or accessed from outside the agency location.
The following documents were considered with this review:
OMB Memorandum M-03-22, OMB Guidance for Implementing the Privacy Provisions
of the E-Government Act of 2002, September 2003;
OMB Memorandum M-03-18, Implementation Guidance for the E-Government Act of
2002, August 2003;
OMB Memorandum M-06-19, Reporting Incidents Involving Personally Identifiable
Information and Incorporating the Cost for Security in Agency Information Technology
Investments, July 2006;
OMB Memorandum M-06-15, Safeguarding Personally Identifiable Information, May
2006;
OMB Memorandum M-06-20, FY 2006 Reporting Instructions for the Federal Information
Security Management Act and Agency Privacy Management, July 2006;
FIPS 199, Standards for Security Categorization of Federal Information and Information
Systems, February 2004;
FIPS 200, Minimum Security Requirements for Federal Information and Information
Systems, March 2006;
NIST SP 800-53, Recommended Security Controls for Federal Information Systems,
February 2005;
NIST SP 800-53A, Guide for Assessing the Security Controls in Federal Information
Systems (Second Public Draft), April 2006;
NIST SP 800-60, Guide for Mapping Types of Information and Information Systems
to Security Categorization Levels, June 2004;
Public Law 107-347, E-Government Act of 2002, Titles II and III;
OMB Circular A-130, Management of Federal Information Resources, November 2000;
and
The Privacy Act of 1974; 5 U.S.C. 552a.
To meet our objectives, we interviewed appropriate Agency staff and reviewed
relevant Agency policies and procedures and controls documentation. We completed
our work in August and September 2006 in accordance with the review guide developed
by the President's Council on Integrity and Efficiency/Executive Council on
Integrity and Efficiency.
Appendix C
OIG Contacts and Staff Acknowledgments
OIG Contacts
Kitt Winter, Director, Data Analysis and Technology Audit Division (410) 965-9702
Phil Rogofsky, Audit Manager, Network Security and Telecommunications Branch(410)
965-9719
Acknowledgments
In addition to the persons named above:
Grace Chi, Auditor-in-Charge
Mary Ellen Fleischman, Senior Program Analyst
Harold Hunter, Senior Auditor
Evelyn Chao, Auditor
Annette DeRito, Writer/Editor
For additional copies of this report, please visit our web site at www.socialsecurity.gov/oig
or contact the Office of the Inspector General's Public Affairs Specialist at
(410) 965-3218. Refer to Common Identification Number A-14-07-27068.
Overview of the Office of the Inspector General
The Office of the Inspector General (OIG) is comprised of our Office of Investigations
(OI), Office of Audit (OA), Office of the Chief Counsel to the Inspector General
(OCCIG), and Office of Executive Operations (OEO). To ensure compliance with
policies and procedures, internal controls, and professional standards, we also
have a comprehensive Professional Responsibility and Quality Assurance program.
Office of Audit
OA conducts and/or supervises financial and performance audits of the Social
Security Administration's (SSA) programs and operations and makes recommendations
to ensure program objectives are achieved effectively and efficiently. Financial
audits assess whether SSA's financial statements fairly present SSA's financial
position, results of operations, and cash flow. Performance audits review the
economy, efficiency, and effectiveness of SSA's programs and operations. OA
also conducts short-term management and program evaluations and projects on
issues of concern to SSA, Congress, and the general public.
Office of Investigations
OI conducts and coordinates investigative activity related to fraud, waste,
abuse, and mismanagement in SSA programs and operations. This includes wrongdoing
by applicants, beneficiaries, contractors, third parties, or SSA employees performing
their official duties. This office serves as OIG liaison to the Department of
Justice on all matters relating to the investigations of SSA programs and personnel.
OI also conducts joint investigations with other Federal, State, and local law
enforcement agencies.
Office of the Chief Counsel to the Inspector General
OCCIG provides independent legal advice and counsel to the IG on various matters,
including statutes, regulations, legislation, and policy directives. OCCIG also
advises the IG on investigative procedures and techniques, as well as on legal
implications and conclusions to be drawn from audit and investigative material.
Finally, OCCIG administers the Civil Monetary Penalty program.
Office of Executive Operations
OEO supports OIG by providing information resource management and systems security.
OEO also coordinates OIG's budget, procurement, telecommunications, facilities,
and human resources. In addition, OEO is the focal point for OIG's strategic
planning function and the development and implementation of performance measures
required by the Government Performance and Results Act of 1993.