United States Government Accountability Office GAO Testimony Before the Subcommittee on Oversight and Investigations Committee on Energy and Commerce House of Representatives For Release on Delivery Expected at 10 00 a m EDT Thursday September 25 2008 NUCLEAR SECURITY Los Alamos National Laboratory Faces Challenges In Sustaining Physical and Cyber Security Improvements Statement of Gene Aloise Director Natural Resources and Environment Nabajyoti Barkakati Chief Technologist Applied Research and Methodology Gregory C Wilshusen Director Information Security Issues GAO-08-1180T September 25 2008 NUCLEAR SECURITY Accountability Integrity Reliability Highlights Highlights of GAO-08-1180T testimony before the Subcommittee on Oversight and Investigations Committee on Energy and Commerce House of Representatives Los Alamos National Laboratory Faces Challenges in Sustaining Physical and Cyber Security Improvements Why GAO Did This Study What GAO Found Los Alamos National Laboratory LANL is one of three National Nuclear Security Administration NNSA laboratories that designs and develops nuclear weapons for the U S stockpile LANL employees rely on sensitive and classified information and assets that are protected at different levels depending on the risks posed if they were lost stolen or otherwise compromised However LANL has experienced several significant security breaches during the past decade Physical security at LANL is in a period of significant improvement and LANL is implementing over two dozen initiatives to better protect its classified assets However while LANL’s current initiatives address many physical security problems previously identified in external security evaluations other significant security problems have received insufficient attention In addition the management approaches that LANL and NNSA intend to use to sustain security improvements over the long term are in the early stages of development or contain weaknesses Furthermore LANL’s ability to sustain its improved physical security posture is unproven because 1 the laboratory appears not to have done so after a significant security incident in 2004 with another significant security breach in 2006 and 2 NNSA’s Los Alamos Site Office—which is responsible for overseeing security at LANL—may not have enough staff or the proper training to execute a fully effective security oversight program GAO’s report made recommendations to help further improve physical security at LANL and ensure that these improvements are sustained over the long term This testimony provides GAO’s 1 views on physical security at LANL as discussed in Los Alamos National Laboratory Long-Term Strategies Needed to Improve Security and Management Oversight GAO-08694 June 13 2008 2 preliminary observations on physical security at Lawrence Livermore National Laboratory and 3 views on cyber security at LANL as discussed in Information Security Actions Needed to Better Protect Los Alamos National Laboratory’s Unclassified Computer Network GAO-08-1001 Sept 9 2008 To conduct this work GAO analyzed data reviewed policies and procedures interviewed laboratory officials and conducted site visits to the two laboratories To view the full product including the scope and methodology click on GAO-08-1180T For more information contact Gene Aloise at 202 512-3841 or aloisee@gao gov Gregory C Wilshusen at 202 512-6244 or wilshuseng@gao gov and Nabajyoti Barkakati at 202 512-6412 or barkakatin@gao gov As a result of poor performance on an April 2008 physical security evaluation conducted by the Department of Energy’s DOE Office of Independent Oversight GAO is reviewing physical security at Lawrence Livermore National Laboratory Livermore GAO’s preliminary observations are that Livermore appears to experience difficulties similar to LANL’s in sustaining security performance Furthermore it appears that NNSA has not always provided effective oversight of Livermore Specifically an NNSA security survey conducted only 6 months prior to the April 2008 DOE evaluation gave Livermore the highest possible rating on its security program’s performance These results differ markedly from those documented by DOE’s Office of Independent Oversight LANL has implemented measures to enhance cyber security but weaknesses remain in protecting information on its unclassified network This network possesses sensitive information such as unclassified controlled nuclear information export control information and personally identifiable information about LANL employees GAO found vulnerabilities in critical areas including 1 identifying and authenticating users 2 encrypting sensitive information and 3 monitoring and auditing security policy compliance A key reason for these information security weaknesses is that the laboratory has not fully implemented an information security program to ensure that controls are effectively established and maintained Furthermore deficiencies in LANL’s policies and procedures raise additional concern particularly with respect to foreign nationals’ accessing the network from the laboratory and remotely Finally LANL cyber security officials told GAO that funding to address some of their security concerns with the laboratory’s unclassified network has been inadequate However NNSA officials asserted that LANL had not adequately justified its requests for additional funds GAO made 52 recommendations to help strengthen LANL’s information security program and controls over the unclassified network United States Government Accountability Office Mr Chairman and Members of the Subcommittee We are pleased to be here today to discuss physical and cyber security at Los Alamos National Laboratory LANL LANL located in Los Alamos New Mexico has a multibillion dollar annual budget and is one of three National Nuclear Security Administration NNSA laboratories responsible for designing and developing a safe secure and reliable nuclear weapons deterrent 1 In fiscal year 2007 LANL budgeted nearly $200 million to provide the laboratory with physical and cyber security to protect the sensitive and classified assets on which laboratory employees rely to conduct their work A successful physical or cyber attack on NNSA sites containing nuclear weapons the material used in nuclear weapons or information pertaining to the people who design and maintain the U S nuclear deterrent could have devastating consequences for the site its surrounding communities and the nation’s security Because of these risks NNSA sites need effective physical and cyber security programs Over the last decade LANL has experienced a series of high-profile security incidents in which sensitive assets and classified information were compromised In October 2006 during a drug raid on a private residence it was discovered that a LANL contract employee had transferred classified information to a USB “thumb drive” and removed the thumb drive as well as a large number of classified documents from the laboratory The Department of Energy’s DOE Inspector General reported that a serious breakdown in core laboratory physical and cyber security controls contributed to the October 2006 thumb drive incident 2 More recently in April 2008 DOE’s Office of Independent Oversight conducted an evaluation of security at Lawrence Livermore National Laboratory Livermore The evaluation included a mock terrorist attack on a sensitive laboratory facility and concluded that Livermore’s security program had significant weaknesses particularly with respect to the performance of Livermore’s protective force and the physical protection of classified resources 1 The other design and development laboratories are Lawrence Livermore National Laboratory in Livermore California and Sandia National Laboratories in Albuquerque New Mexico and Livermore California NNSA is a separately organized agency within the Department of Energy that is responsible for the management and security of the nation’s nuclear weapons nuclear nonproliferation and naval reactors programs 2 U S Department of Energy Office of Inspector General Office of Audit Services Special Inquiry Report to the Secretary Selected Controls Over Classified Information at the Los Alamos National Laboratory OAS-SR-07-01 Washington D C Nov 2006 Page 1 GAO-08-1180T Security at DOE National Laboratories As a result of the October 2006 thumb drive incident and the congressional hearings that followed the Committee asked us to review physical and cyber security at LANL In addition in June 2008 this Committee requested that we review the status of physical security at Livermore Our testimony today discusses 1 physical security at LANL 2 preliminary observations from ongoing work on physical security at Livermore and 3 cyber security at LANL This statement is primarily based on recently issued reports on physical and cyber security at LANL 3 We conducted the performance audit work that supports this statement in accordance with generally accepted government auditing standards Those standards require that we plan and perform the audit to obtain sufficient appropriate evidence to produce a reasonable basis for our findings and conclusions based on our audit objectives We believe that the evidence obtained provides a reasonable basis for our statements today Summary Physical security at LANL is in a period of significant improvement and LANL is implementing over two dozen initiatives to better protect its classified assets However while LANL’s current initiatives address many security problems previously identified in external evaluations other significant security problems have received insufficient attention For example at the time of our review LANL had not implemented complete security solutions to address either the storage of classified nuclear weapons parts in unapproved storage containers or weaknesses in its process for ensuring that actions taken to correct security deficiencies are completed Furthermore management approaches that LANL and NNSA officials told us they would use to sustain security improvements over the long term were in the early stages of development or contained weaknesses In addition LANL’s ability to sustain its improved physical security posture is unproven because 1 the laboratory appears not to have done so after a significant security incident in 2004 and 2 NNSA’s Los Alamos Site Office—which is responsible for overseeing physical security at LANL on a daily basis—may not have enough staff or the proper training for these staff to execute a fully effective security oversight program Our report on physical security at LANL made three recommendations to the Secretary of Energy and the Administrator of 3 GAO Los Alamos National Laboratory Long-Term Strategies Needed to Improve Security and Management Oversight GAO-08-694 Washington D C June 13 2008 and GAO Information Security Actions Needed to Better Protect Los Alamos National Laboratory’s Unclassified Computer Network GAO-08-1001 Washington D C Sept 9 2008 Page 2 GAO-08-1180T Security at DOE National Laboratories NNSA concerning long-term strategic security planning and the use of meaningful financial incentives for effective security performance We believe these recommendations if effectively implemented would help further improve physical security at LANL and ensure that these improvements are sustained over the long term Though our observations on physical security at Livermore are preliminary the laboratory appears to be experiencing difficulties similar to LANL’s in sustaining physical security performance In addition Livermore’s self-assessment and performance assurance programs appear to need improvement For example Livermore and NNSA security officials acknowledged that a lack of comprehensive performance assurance testing was a significant contributing factor to the poor performance of Livermore’s protective forces during their April 2008 exercise Finally it appears that NNSA has not always provided effective security oversight of Livermore Specifically a 2007 NNSA security survey gave Livermore the highest possible rating on its security performance differing markedly from what DOE observed during its evaluation in April 2008 only 6 months later DOE identified multiple areas for significant improvement and gave Livermore the lowest rating possible in two security performance areas Our review of cyber security at LANL found that the laboratory has implemented measures to enhance its information security but weaknesses remain in protecting the confidentiality integrity and availability of information on its unclassified network 4 LANL’s unclassified network contains sensitive information such as unclassified controlled nuclear information export control information and personally identifiable information about laboratory employees LANL has implemented a network security system that is capable of detecting potential intrusions however we found vulnerabilities in several critical areas including identifying and authenticating users encrypting sensitive information and monitoring and auditing compliance with security policies For example LANL has implemented strong authentication measures for accessing its unclassified network but once access is initially gained a user can work around the authentication measures to access certain sensitive information A key reason for LANL’s information security weaknesses is that the laboratory has not fully implemented an 4 We are currently reviewing information security controls over LANL’s classified network for this Committee Page 3 GAO-08-1180T Security at DOE National Laboratories information security program to ensure that controls are effectively established and maintained For example LANL’s most recent risk assessment for its unclassified network generally identified and analyzed vulnerabilities but did not account for risks identified by the laboratory’s own internal vulnerability testing Furthermore we and other external security evaluators have reported concerns about LANL’s policies for granting foreign nationals—particularly those from countries classified as “sensitive” by DOE—access to the unclassified network Finally LANL cyber security officials told us that funding to address some of their security concerns with respect to the laboratory’s unclassified network has been inadequate NNSA officials told us LANL has not adequately justified its request for additional funds and NNSA is developing a process for developing cyber security budgets more systematically We made 52 recommendations to the Secretary of Energy and the Administrator of NNSA that if effectively implemented would improve LANL’s information security program and controls over its unclassified network These recommendations address among other things ensuring that LANL’s risk assessment for its unclassified network evaluates all known vulnerabilities and is revised periodically and strengthening policies with a view toward further reducing as appropriate foreign nationals’ access to the unclassified network Background A basic management objective for any organization is to protect the resources that support its critical operations from unauthorized access use destruction or disruption Organizations accomplish this objective by designing and implementing controls that are intended to among other things prevent limit and detect unauthorized access to computing resources programs information and facilities At LANL these assets include Category I special nuclear material such as plutonium and highly enriched uranium 5 thousands of classified nuclear weapons parts and components millions of classified documents thousands of pieces of classified removable electronic media that contain nuclear weapon design information 6 over 100 vaults and vault-type rooms that store classified assets and computer networks and the hardware on which these 5 Special nuclear material is considered to be Category I when it is weapons-grade such as plutonium and highly enriched uranium and occurs in specified forms and quantities 6 Some classified documents and pieces of removable electronic media such as CDs and thumb drives pose a security risk that requires maintenance of an accountability system to prevent unauthorized access or removal Page 4 GAO-08-1180T Security at DOE National Laboratories networks run that protect classified information as well as sensitive unclassified information LANL is subject to a series of DOE security orders that outline requirements for implementing effective physical and cyber security protection strategies These orders include an assessment of the potential size and capabilities of terrorist forces that could physically attack a laboratory and against which a laboratory must be prepared to defend The orders further describe different levels of physical protection for sensitive and classified assets depending on the risk they would pose if they were lost stolen or otherwise compromised Appropriate physical protection safeguards include locks and keys fences means to detect unauthorized entry perimeter alarms vehicle barriers and armed guards In addition the Congress enacted the Federal Information Security Management Act FISMA in December 2002 to strengthen the security of information and information systems across the federal government 7 FISMA requires each agency to develop document and implement an agencywide information security program that supports the operations and assets of the agency including those provided or managed by another agency or contractor on its behalf Examples of appropriate information security controls include user identification and authentication that allow computer systems to differentiate between users and verify their identities cryptography that ensures the confidentiality and integrity of critical and sensitive information configuration management that identifies and manages security features for all hardware software and firmware components of an information system and controls changes to them and audit and monitoring controls that help establish individual accountability and monitor compliance with security policies LANL is managed and operated by a corporate entity Los Alamos National Security LLC LANS 8 NNSA’s Los Alamos Site Office serves as the primary federal overseer of laboratory security performance Annually the Site Office determines how much money LANS will earn for its 7 FISMA was enacted as title III E-Government Act of 2002 Pub L No 107-347 116 Stat 2946 Dec 17 2002 8 LANS has been the management and operating contractor of LANL since June 2006 LANS is made up of the University of California Bechtel National Washington Group International and BWX Technologies which now operates under the name The Babcock Wilcox Company Page 5 GAO-08-1180T Security at DOE National Laboratories management of the laboratory according to a maximum available performance-based fee established in the laboratory’s contract The Site Office bases its determination on the laboratory’s success in meeting the goals laid out in performance evaluation plans These plans allocate portions of the maximum available performance award fee to NNSA performance objectives including measures related to both physical and cyber security In addition two DOE organizations are required to periodically review physical and cyber security at LANL NNSA’s Los Alamos Site Office is required to conduct security surveys annually These surveys are based on observations of performance including compliance with DOE and NNSA security directives In fiscal year 2008 the results of this survey are directly tied to NNSA’s performance evaluation plan and are therefore a factor in LANS’ ability to earn the maximum available performance award fee DOE’s Office of Independent Oversight also conducts evaluations typically every 18 months for facilities that store Category I special nuclear material These evaluations identify weaknesses in the laboratories’ security programs and produce findings that laboratory officials must take action to correct The reviews overlap substantially but each is required to provide a comprehensive assessment of the laboratory’s security programs Page 6 GAO-08-1180T Security at DOE National Laboratories While Physical Security at Los Alamos National Laboratory Has Improved Management Approaches to Sustain Security Improvements Are in the Early Stages of Development or Contain Weaknesses Physical security at LANL is in a period of significant improvement and LANL is implementing over two dozen initiatives to reduce consolidate and better protect its classified assets as well as reduce the physical footprint of the laboratory by closing unneeded facilities LANL officials believe that these initiatives will reduce the risk of incidents that can result in the loss of control over classified assets For example to reduce and consolidate classified assets and its physical footprint as of March 2008 LANL had 1 reduced from nine to one the number of areas containing Category I special nuclear material 2 reduced the amount of accountable classified removable electronic media from 87 000 pieces to about 4 300 and made information previously accessible on removable media available only through the laboratory’s classified computer network 3 eliminated about 30 000 classified nuclear weapon parts and 4 reduced the number of vault-type rooms from 142 to 111 In addition during fiscal year 2007 LANL reduced the physical footprint of existing facilities by over 500 000 square feet In concert with these actions LANL is implementing a series of engineered and administrative controls to better protect and control classified assets 9 such as removing the functions from classified computers that enable them to create new pieces of removable electronic media and streamlining physical security procedures to make them easier to implement across the laboratory We found that DOE’s Office of Independent Oversight and the Los Alamos Site Office identified significant physical security problems at LANL that the laboratory had not fully addressed Specifically while LANL’s storage of classified parts in unapproved storage containers and its process for ensuring that actions to correct identified security deficiencies have been cited in external security evaluations for years complete security solutions in these areas had not yet been implemented at the time of our review In addition external security evaluations had repeatedly identified concerns about the adequacy of LANL’s assessments of its own security performance The security self-assessment program provides LANL with the opportunity to self-identify security deficiencies and address them before they can be exploited External security evaluations found that LANL’s self-assessments were not comprehensive and did not include discussions of all internal findings These evaluations also noted that findings identified through self-assessments were not always analyzed and 9 Engineered controls are system-based controls that manage work processes and prevent employees from taking inappropriate action Administrative controls are typically policies or procedures that govern the handling of classified resources Page 7 GAO-08-1180T Security at DOE National Laboratories addressed through corrective actions At the time of our review Los Alamos Site Office and DOE Office of Independent Oversight officials noted that LANL’s self-assessment program was improving LANL officials identified three management approaches that they asserted would sustain security improvements over the long term However these approaches were either in an early stage of development or contained important weaknesses that may impair their ability to ensure the sustainability of security improvements at the laboratory for the foreseeable future First LANL officials identified completing the management actions required by the Secretary of Energy’s Compliance Order issued as a result of the October 2006 thumb drive incident as an approach to ensure that security improvements are sustained yet the Compliance Order itself does not provide a mechanism to sustain security improvements over the long-term 10 Second LANL officials told us they will track the implementation of longer-term actions including those required by the Compliance Order by developing and implementing the Contractor Assurance System required under the LANS contract 11 However the extent to which LANL can rely on the Contractor Assurance System to ensure the long-term sustainability of security improvements is unclear According to a Los Alamos Site Office official the Contractor Assurance System will not be fully completed for 3 to 4 years and thus will not be fully implemented by the time actions under the Compliance Order are completed Finally according to LANL officials the laboratory plans to realize security improvements by meeting the security-related performance incentives in the annual performance evaluation plans NNSA uses to measure performance and determine an award fee for LANS However the annual performance evaluation plans focus principally on 10 The Secretary of Energy has authority under 10 C F R § 824 4 b of DOE’s Procedural Rules for the Assessment of Civil Penalties for Classified Information Security Violations to issue compliance orders that direct management and operating contractors to take specific corrective actions to remediate deficiencies that contributed to security violations On July 12 2007 the Secretary of Energy issued a compliance order to LANS as a result of the security incident discovered in October 2006 The Compliance Order directs LANS to take comprehensive steps to ensure that it identifies and addresses critical classified information and cyber security deficiencies at LANL Violation of the Compliance Order would subject LANS to civil penalties of up to $100 000 per violation per day until compliance is reached 11 The Contractor Assurance System is intended to be a tool to increase accountability and improve laboratory management and performance According to a LANL official the Contractor Assurance System is an integrated performance-based management system that is available as a tool for federal oversight Page 8 GAO-08-1180T Security at DOE National Laboratories compliance with DOE requirements and do not sufficiently reward security program improvement In that regard according to a senior NNSA security official compliance with current DOE requirements does not assure that LANL’s security program is functioning effectively Indeed we found that all but $30 000 of the total $1 43 million fiscal year 2008 performance fee allocated to physical security was associated with LANL’s achievement of compliance-oriented milestones such as issuing plans publishing policies and completing equipment maintenance requirements The management attention dedicated to improving physical security following the October 2006 thumb drive incident mirrors the level of attention that followed LANL’s 2004 shutdown when over 3 400 safety and security deficiencies were identified for correction This shutdown lasted up to 10 months for some laboratory activities and cost as much as $370 million 12 Given how quickly LANL’s security performance declined between the full resumption of laboratory activities in May 2005 and the discovery of the thumb drive on private property LANL’s ability to sustain the improved security posture it has recently achieved is unproven Strong federal oversight will help ensure that these improvements are sustained However we reported that the Los Alamos Site Office suffers from a shortage of security personnel and lacks funding needed for training Specifically as of October 2007 the Los Alamos Site Office employed 13 security staff—enough for 1 person to oversee each of the topical areas the Site Office had to evaluate This staffing level officials said was sufficient to cover only 15 percent of LANL’s facilities In April 2008 a senior security official at the Site Office said security staffing levels had decreased since October 2007 Furthermore while NNSA had identified the need to train and certify Site Office security personnel in specific subject matters according to Site Office officials no specific training funds had been made available We made three recommendations to the Secretary of Energy and the Administrator of NNSA that if effectively implemented will improve physical security at LANL and help ensure that improvements LANL has achieved are sustained over the long term Specifically we recommended that LANL be required to develop a comprehensive strategic plan for laboratory security that addresses all previously identified security 12 GAO Stand-Down of Los Alamos National Laboratory Total Costs Uncertain Almost All Mission-Critical Programs Were Affected but Have Recovered GAO-06-83 Washington D C Nov 18 2005 Page 9 GAO-08-1180T Security at DOE National Laboratories weaknesses and focuses on improving security program effectiveness Furthermore we recommended that NNSA provide meaningful financial incentives in future performance evaluation plans for implementation of this comprehensive strategic plan for laboratory security In June 2008 the Committee requested that we review the security status at Livermore This request came as a result of an evaluation by DOE’s Office of Independent Oversight in April 2008 in which Livermore received the lowest possible ratings for protective force performance and for physical protection of classified resources The evaluation also identified issues in other areas such as security sensors and alarms and security program management We are currently verifying the findings of the evaluation and Livermore’s actions to correct security deficiencies Specifically Preliminary Observations on Physical Security at Lawrence Livermore National Laboratory • Self-assessment and performance assurance testing programs at Livermore need improvement DOE’s Office of Independent Oversight evaluations and Livermore Site Office security surveys found shortcomings in Livermore’s fiscal year 1999 2000 2002 and 2008 selfassessment programs In addition Livermore and NNSA security officials acknowledged that a lack of comprehensive performance assurance testing was a significant contributing factor to the poor performance of Livermore protective forces during their April 2008 exercise Between December 2006 and April 2008 Livermore did not hold an integrated performance assurance test of its protective forces or operationally test equipment key to the laboratory’s protective strategy During our visit to the laboratory 2 weeks ago Livermore officials told us they are finalizing corrective action plans to address deficiencies in their performance assurance and self-assessment programs and have already conducted a significant number of performance assurance tests with the protective force and on equipment since the completion of the Office of Independent Oversight’s 2008 evaluation • NNSA and the Livermore Site Office have not always provided effective security oversight Six months before the Office of Independent Oversight’s 2008 evaluation the 2007 Livermore Site Office’s annual security survey gave the laboratory a 100-percent satisfactory rating on its security performance the highest possible rating The results of the Office of Independent Oversight inspection not only differed markedly but also found that the Livermore Site Office survey was not comprehensive and the ratings provided did not reflect what was actually observed The Livermore Site Office is currently in the process of fundamentally Page 10 GAO-08-1180T Security at DOE National Laboratories rebuilding and restructuring its survey program and has embarked on a training program for its security personnel Though our observations are preliminary Livermore appears to be experiencing difficulties similar to LANL’s in sustaining physical security performance For example in 1999 DOE’s Office of Independent Oversight identified significant weaknesses in Livermore’s programs to secure the laboratory’s Category I special nuclear material facility against a potential terrorist attack Livermore then embarked on a major program to improve security and according to the Office of Independent Oversight addressed most issues by 2002 This improved level of security performance appears to have been sustained through 2006 Between December 2006—when Livermore’s protective force performed well in an exercise—and April 2008 security performance at Livermore declined In response to the negative results of the 2008 Office of Independent Oversight evaluation Livermore appears to be refocusing management attention on security performance While our work is preliminary we believe the actions taken by Livermore the Livermore Site Office and NNSA if and when fully implemented will address identified physical security issues However just as at LANL sustaining attention on physical security performance will continue to be a challenge Los Alamos National Laboratory Has Implemented Measures to Enhance Cyber Security on Its Unclassified Network but Weaknesses Remain LANL has implemented measures to enhance its cyber security but weaknesses remain in protecting the confidentiality integrity and availability of information on its unclassified network In particular LANL has implemented a network security system that is capable of detecting potential intrusions on the network However LANL has vulnerabilities in several critical areas including 1 identifying and authenticating users of the network 2 encrypting sensitive information 3 monitoring and auditing compliance with security policies 4 controlling and documenting changes to a computer system’s hardware and software and 5 restricting physical access to computing resources For example although LANL had implemented strong authentication measures for accessing the network these measures were not always used Once a user successfully accessed the network the user could create a separate simple password that would allow alternative access to certain sensitive information Furthermore LANL neither conducted comprehensive vulnerability scans of the unclassified network nor included sensitive applications in these scans thus leaving the network at increased risk of compromise or disruption In addition to these weaknesses LANL’s Page 11 GAO-08-1180T Security at DOE National Laboratories computing facilities had physical security weaknesses and could be vulnerable to intentional disruption Specifically we observed lax restriction of vehicular traffic entering the laboratory and inadequate fencing A key reason for the information security weaknesses we identified is that LANL has not yet fully implemented an information security program to ensure that controls are effectively established and maintained Although LANL has implemented a security awareness training program we identified a number of shortcomings in its overall information security management program For example 1 its risk assessment was not comprehensive 2 specific guidance was missing from policies and procedures 3 the network security plan was incomplete 4 system testing had shortcomings 5 remedial action plans were incomplete and corrective actions were not always timely and 6 the network contingency plan was incomplete and inadequately tested Until LANL ensures that the information security program associated with its unclassified network is fully implemented it will have limited assurance that sensitive data are adequately protected against unauthorized disclosure or modification or that network services will not be interrupted Many of LANL’s cyber security deficiencies have been the subject of prior evaluations conducted by DOE’s Office of Independent Oversight and the Los Alamos Site Office The most recent reports covering fiscal years 2006 and 2007 documented significant weaknesses with LANL’s unclassified information security program including foreign nationals’ access to the laboratory’s unclassified network As of May 2008 LANL had granted unclassified network access to 688 foreign nationals including about 300 from countries identified as sensitive by DOE such as China India and Russia 13 In addition foreign nationals from sensitive countries have been authorized remote access to LANL’s unclassified network The number of foreign nationals who have access to the unclassified network has raised security concerns among some laboratory and NNSA officials because of the sensitive information contained on the network According to LANL the percentage of foreign nationals with authorized remote access to the unclassified network has steadily declined over the last 5 years 13 DOE identifies countries as sensitive based on national security nuclear nonproliferation or terrorism concerns Page 12 GAO-08-1180T Security at DOE National Laboratories NNSA and LANL have not agreed on the level of funding necessary for protecting the unclassified network From fiscal years 2001 through 2007 LANL spent $51 4 million to protect and maintain its unclassified network Although LANL cyber security officials told us that funding has been inadequate to address some of their security concerns NNSA officials raised questions about the basis for LANL’s funding request for cyber security NNSA’s Chief Information Officer told us that LANL has not adequately justified requests for additional funds to address the laboratory’s stated shortfalls In addition NNSA officials informed us that LANL’s past budget requests were prepared on an ad hoc basis and were not based on well-defined threat and risk assessments In response to these concerns in fiscal year 2006 NNSA implemented a more systematic approach to developing cyber security budgets across the nuclear weapons complex including LANL This effort however does not provide guidance that clearly lays out funding priorities Furthermore NNSA does not consistently document resource allocation decisions and identify how funding shortfalls affect critical cyber security issues To help strengthen information security controls over LANL’s unclassified network we made a series of recommendations to the Secretary of Energy and the Administrator of NNSA 11 of which focus on improving LANL’s information security program and determining resource requirements for the unclassified network For example we recommended that the Secretary of Energy and the NNSA Administrator require the Director of LANL to among other things 1 ensure that the risk assessment for the unclassified network evaluates all known vulnerabilities and is revised periodically and 2 strengthen policies with a view toward further reducing as appropriate foreign nationals’ access to the unclassified network particularly those from countries identified as sensitive by DOE We made an additional 41 recommendations in a separate report with limited distribution These recommendations consist of actions to be taken to correct the specific information security weaknesses related to identification and authentication cryptography audit and monitoring configuration management and physical security that we identified Mr Chairman this concludes our prepared statement We would be happy to respond to any questions that you or Members of the Subcommittee may have at this time Page 13 GAO-08-1180T Security at DOE National Laboratories GAO Contacts and Staff Acknowledgements For further information on this testimony please contact Gene Aloise at 202 512-3481 or aloisee@gao gov Nabajyoti Barkakati at 202 512-6412 or barkakatin@gao gov and Gregory C Wilshusen at 202 512-6244 or wilshuseng@gao gov Jonathan Gill Ed Glagola Jeff Knott and Glen Levis Assistant Directors Allison Bawden Preston Heard Tom Twambly Ray Rodriguez John Cooney Carol Herrnstadt Shulman and Omari Norman made key contributions to this testimony Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement 361011 Page 14 GAO-08-1180T Security at DOE National Laboratories This is a work of the U S government and is not subject to copyright protection in the United States The published product may be reproduced and distributed in its entirety without further permission from GAO However because this work may contain copyrighted images or other material permission from the copyright holder may be necessary if you wish to reproduce this material separately GAO’s Mission The Government Accountability Office the audit evaluation and investigative arm of Congress exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people GAO examines the use of public funds evaluates federal programs and policies and provides analyses recommendations and other assistance to help Congress make informed oversight policy and funding decisions GAO’s commitment to good government is reflected in its core values of accountability integrity and reliability Obtaining Copies of GAO Reports and Testimony The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s Web site www gao gov Each weekday GAO posts newly released reports testimony and correspondence on its Web site To have GAO e-mail you a list of newly posted products every afternoon go to www gao gov and select “E-mail Updates ” Order by Mail or Phone The first copy of each printed report is free Additional copies are $2 each A check or money order should be made out to the Superintendent of Documents GAO also accepts VISA and Mastercard Orders for 100 or more copies mailed to a single address are discounted 25 percent Orders should be sent to U S Government Accountability Office 441 G Street NW Room LM Washington DC 20548 To order by Phone Voice TDD Fax 202 512-6000 202 512-2537 202 512-6061 To Report Fraud Waste and Abuse in Federal Programs Contact Congressional Relations Ralph Dawn Managing Director dawnr@gao gov 202 512-4400 U S Government Accountability Office 441 G Street NW Room 7125 Washington DC 20548 Public Affairs Chuck Young Managing Director youngc1@gao gov 202 512-4800 U S Government Accountability Office 441 G Street NW Room 7149 Washington DC 20548 Web site www gao gov fraudnet fraudnet htm E-mail fraudnet@gao gov Automated answering system 800 424-5454 or 202 512-7470 PRINTED ON RECYCLED PAPER