Recent events spark new agency reviews

By GCN

| March 3, 2000

The Environmental Protection Agency's move last month to shut down its Web site had a ripple effect across government as agencies re-examined their security procedures.

'What EPA has shown is that this could affect everybody,' Commerce Department CIO Roger W. Baker said. Commerce is requiring that all its offices register their Web sites with the CIO's Office to ensure that effective security plans and firewalls are in place across the department, he said.Although unfortunate, moves such as EPA's generate the attention necessary to strengthen systems security programs in government, Baker said.EPA shut down its site Feb. 17 after a General Accounting Office team succeeded in accessing sensitive data.The action was taken at the request of Rep. Thomas Bliley (R-Va.), chairman of the House Commerce Committee. He had asked GAO to review EPA's systems for security weaknesses.After a briefing on GAO's findings, Bliley sent a letter to EPA Administrator Carol M. Browner directing her to secure sensitive data that might have been available through the site.But the committee's concerns reach beyond the security of the agency's Web operations, the committee's spokesman Eric Wohlschlegel said. 'We're talking about EPA's systems'their accounting systems, trade systems [that contain] sensitive and confidential information that could jeopardize our national and economic security,' he said. 'It's serious.'EPA officials, who spoke on the condition that they not be identified, said they have been working with GAO on security and are establishing firewalls. The agency had expected to complete its work by April 1 but the GAO report accelerated the timetable. EPA officials said they had no choice but to shut down the site.EPA's security practices have been the subject of scrutiny for some time. In 1997 the EPA inspector general reported that the agency had inadequate Internet intrusion protection and poor security planning.This past October, a GAO report identified EPA as one of 22 agencies with significant computer security weaknesses.The report, Critical Infrastructure Protection: Comprehensive Strategy Can Draw on Year 2000 Experiences, has been the basis for several recent security initiatives by agencies.In a statement sent last month to the House Commerce Subcommittee on Oversight and Investigations, GAO's David L. McClure said, 'Our review found serious and pervasive problems that essentially render EPA's agencywide information security program ineffective.'EPA is not adept at using systems access controls to fend off intruders, said McClure, associate director for governmentwide and defense information systems in GAO's Accounting and Information Management Division.He said EPA has taken actions to correct security lapses. At the end of January, EPA's Office of Information Collection began reviewing the agency's information protection policies, and the agency created a technical information security staff.During GAO reviews, McClure said, investigators easily obtained passwords by simply guessing, viewing and recording users' keystrokes, and by using password-cracking software to decrypt password files.'Using widely available software tools, we demonstrated that EPA's network was highly susceptible to intrusions through the Internet and that user and system administrator passwords could be easily accessed, read or guessed,' McClure said.GAO concluded that the weaknesses could let EPA employees, contractors and outside intruders tamper with data, browse sensitive information and use EPA computer resources to launch attacks against other organizations or disrupt computer operations.

By Shruti Dat'

and Christopher J. Dorobek

GCN Staff

The Environmental Protection Agency's move last month to shut down its Web site had a ripple effect across government as agencies re-examined their security procedures.

Many information technology executives acknowledged they had breathed a sigh of relief that it was not their agency in the hot seat. But they also said the IT security issue is complex and requires constant attention. What's more, some said there is not yet a full understanding of exactly how agencies should proceed on making their systems more secure.

'IT security is a never-ending process,' NASA chief information officer Lee Holcomb said.

Although unusual, the EPA decision to temporarily shut down its Web site was not unprecedented.

In 1993, NASA pulled the plug on the Web site of its Dryden Flight Research Center in Edwards, Calif., after officials discovered security lapses. The site was offline for 10 days.

And in 1998, the Defense Department ordered all DOD organizations to shutter their Web sites until they had scrubbed them of sensitive data such as information about military operations and officers' addresses [GCN, Sept. 28, 1998, Page 6].

But the EPA action drew more publicity than the earlier blackouts. In the past two years, the Web has become a common information dissemination tool for agencies, far more so than when DOD and NASA shuttered their sites. Plus, the EPA action immediately followed last month's denial-of-service attacks on large commercial Web sites.

A week after pulling its site offline, EPA began slowly rehosting portions of the site. The agency planned to have the entire site back online by the end of last week.

Federal IT executives said the EPA incident drew more attention to what was already one of the hottest IT issues in government. And some said it focused interest on their efforts to institute security policies across their organizations.

Commerce CIO Roger W. Baker says EPA's move will draw attention to security.

Out of control

NEXT STORY: This presentation tool has the write stuff for the road

This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. / Do Not Sell My Personal Information

Accept Cookies