^EDSrx * a * I 5SkJ V PRO^C<9 U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Hotline Report: Operating Efficiently and Effectively Management Alert: EPA's Incident Tracking System Lacks Required Controls to Protect Personal Information Report No. 18-P-0298 September 28, 2018 ------- Report Contributors: Rudolph M. Brevard Vincent Campbell Nancy Dao Scott Sammons Abbreviations CIO Chief Information Officer EPA U.S. Environmental Protection Agency OEI Office of Environmental Information OIG Office of Inspector General PII Personally Identifiable Information SORN System of Records Notice SPII Sensitive Personally Identifiable Information SSN Social Security Number TSP Thrift Savings Plan Cover Image: The exposure of sensitive personally identifiable information can lead to identify theft. (EPA OIG image) Are you aware of fraud, waste or abuse in an EPA program? EPA Inspector General Hotline 1200 Pennsylvania Avenue, NW (2431T) Washington, DC 20460 (888) 546-8740 (202) 566-2599 (fax) OIG Hotline@epa.gov Learn more about our OIG Hotline. EPA Office of Inspector General 1200 Pennsylvania Avenue, NW (2410T) Washington, DC 20460 (202) 566-2391 www.epa.gov/oiq Subscribe to our Email Updates Follow us on Twitter @EPAoig Send us your Project Suggestions ------- ^£DSrx • A v U.S. Environmental Protection Agency Office of Inspector General At a Glance 18-P-0298 September 28, 2018 Why We Did This Project The Office of Inspector General (OIG) for the U.S. Environmental Protection Agency (EPA) conducted this audit in response to an OIG hotline complaint. Our objective was to determine whether the EPA implemented security controls to protect personally identifiable information (Pll) processed by the agency's incident tracking system, which is used to troubleshoot information technology issues. Pll is defined as information that can be used to distinguish or trace an individual's identity (such as name, date of birth and address), either alone or when combined with other information that is linked or linkable to a specific individual. Sensitive Pll (SPII) is a subset of Pll, and includes Social Security numbers or comparable identification numbers, biometric data, and financial or medical information associated with an individual. This report addresses the following: • Operating efficiently and effectively. Send all inquiries to our public affairs office at (202) 566-2391 or visit www.epa.gov/oia. Listing of OIG reports. Management Alert: EPA's Incident Tracking System Lacks Required Controls to Protect Personal Information What We Found The EPA's current incident tracking system lacks the required security controls to (1) protect the confidentiality of Pll and SPII; and (2) enforce password management requirements, even though the requirements are specified in federal and agency guidance. The EPA's incident tracking system lacks the required privacy and security controls to protect Pll and SPII, which could lead to identity theft. The EPA was unaware that Pll and SPII were included on incident tickets handled by help desk technicians, and retained in the current incident tracking system where it can be viewed by all registered users (EPA employees and contractors). We found that current operating procedures do not instruct help desk technicians to exclude Pll and SPII within incident tickets, or to follow the EPA's information security and privacy directives to protect the confidentiality of Pll and SPII. As a result, we identified 25 incident tickets within the agency's current incident tracking system. The incident tickets disclosed Social Security numbers, W-2 information, dates of birth, home addresses and Thrift Savings Plan account information. The EPA began a partial rollout of a replacement incident tracking system in May 2018. The rollout has an anticipated completion date of September 30, 2018. Current standard operating procedures will be used with the replacement incident tracking system as well. Therefore, we are issuing this report to reiterate the need for management to address current weaknesses, so that the weaknesses do not continue to impair the EPA's ability to protect the confidentiality of Pll and SPII. Recommendations and Planned Agency Corrective Actions We made several recommendations to the Assistant Administrator for Environmental Information. We recommended that the EPA implement a strategy to protect the confidentiality of Pll and SPII contained in the EPA's current incident tracking system, and to update standard operating procedures for help desk technicians to follow when handling incident tickets that require collecting Pll and SPII. Throughout the audit process, we worked closely with EPA representatives and kept them informed about any issues identified. On June 5, 2018, we met with agency representatives concerning the OIG's discussion document pertaining to this audit. The agency agreed with Recommendations 1 and 2, and we consider these recommendations resolved with corrective actions pending. Recommendations 3 and 4 are unresolved pending EPA management's response to this report. ------- UNITED STATES ENVIRONMENTAL PROTECTION AGENCY WASHINGTON, D.C. 20460 THE INSPECTOR GENERAL September 28, 2018 MEMORANDUM SUBJECT: Management Alert: EPA's Incident Tracking System Lacks Required Controls to Protect Personal Information Report No. 18-P-0200 FROM: Arthur A. Elkins Jr. TO: Vaughn Noga, Principal Deputy Assistant Administrator and Deputy Chief Information Officer Office of Environmental Information This is our report on the subject audit conducted by the Office of Inspector General (OIG) of the U.S. Environmental Protection Agency (EPA). The project number for this audit was OA&E-FY18-0124. This report contains findings that describe the problems the OIG has identified and corrective actions the OIG recommends. This report represents the opinion of the OIG and does not necessarily represent the final EPA position. Final determinations on matters in this report will be made by EPA managers in accordance with established audit resolution procedures. The EPA's Office of Environmental Information, Office of Information Technology Operations, Desktop Support Services Division, is responsible for issues discussed in this report. Action Required In accordance with EPA Manual 2750, you are required to provide a written response to this report within 60 calendar days. You should include planned corrective actions and completion dates for all recommendations that need additional information for resolution. Your response will be posted on the OIG's website, along with our memorandum commenting on your response. Your response should be provided as an Adobe PDF file that complies with the accessibility requirements of Section 508 of the Rehabilitation Act of 1973, as amended. The final response should not contain data that you do not want to be released to the public; if your response contains such data, you should identify the data for redaction or removal along with corresponding justification. The report will be available at www.epa.gov/oig. ------- Management Alert: EPA's Incident Tracking 18-P-0298 System Lacks Required Controls to Protect Personal Information Table of C Purpose 1 Background 1 Responsible Office 2 Scope and Methodology 2 Results 3 Agency Actions 7 Conclusion 8 Recommendations 8 Agency Response and OIG Evaluation 8 Status of Recommendations and Potential Monetary Benefits 10 Appendix A Distribution 11 ------- Purpose In response to a hotline complaint, the Office of Inspector General (OIG) for the U.S. Environmental Protection Agency (EPA) conducted this audit to determine whether the EPA implemented security controls to protect personally identifiable information (PII) processed in the agency's incident tracking system. Background In December 2017, the OIG received a hotline complaint that alleged the EPA's current incident tracking system "contained PII and Social Security numbers" (SSNs). Allegedly, the PII and SSNs were visible to anyone with access to the system. The complaint further alleged that the system did not comply with the agency's password standards. The OIG researched the merits of the allegations and corroborated the information. According to the Federal Bureau of Investigation's 2017 Internet Crime Report, personal data breach (e.g., an individual's sensitive, protected or confidential data that is copied, transmitted, viewed, stolen or used by an unauthorized individual) and identity theft were, respectively, the second- and sixth-highest-ranked internet crimes reported to the Internet Crime Complaint Center by victims in 2017. The report found that victims reported aggregate losses of approximately $77.1 million for personal data breaches and approximately $66.8 million for identity theft. Office of Management and Budget Circular A-130 (Revised), Managing Information as a Strategic Resource, dated July 28, 2016, advises agencies to establish administrative, technical and physical safeguards to protect PII from unauthorized access, use, modification, loss, destruction, dissemination or disclosure. The circular further advises agencies to maintain an inventory of agency information systems that involve PII; regularly review and reduce PII to the minimum necessary; and eliminate the unnecessary collection, maintenance and use of SSNs. EPA Chief Information Officer (CIO) 2151.1, Privacy Policy, provides the following definition of PII: [A]ny information about an individual, maintained by an agency, that can be used to distinguish, trace or identify an individual's identity, including personal information which is linked or linkable to an individual (e.g., name, date of birth, address). 18-P-0298 1 ------- The policy defines sensitive PII (SPII) as "a subset of PII, which if lost, compromised or disclosed without authorization, could result in substantial harm, embarrassment, inconvenience or unfairness to an individual." SPII requires additional levels of security controls. The EPA's current incident tracking system is an agencywide tool that manages information system service requests and security incidents. The system tracks and reports these requests and incidents, starting with the reporting of the issue, all the way through the issue's resolution. The EPA's incident tracking system contains several modules used to troubleshoot information technology issues. The EPA uses the incident management module within the incident tracking system to document technical issues, such as resetting a user's password, removing a virus from the agency's network or granting user access to an EPA system. Help desk technicians manage incident tickets within the incident management module to document the details of each event and track the resolution. A technician enters as much data as necessary on the incident ticket to help assigned technicians resolve problems. Sometimes the information entered on the incident ticket includes PII or SPII, which can be viewed by all registered users (EPA employees and contractors) of the system. The EPA is currently implementing a new incident tracking system and plans to retire the current system by September 30, 2018. Responsible Office The Office of Environmental Information (OEI) provides enterprise level strategic planning, collaboration, management and accountability for the implementation of the agency's technology. The Office of Information Technology Operations' Desktop Support Services Division, within OEI, manages the current incident tracking system and the replacement system. Scope and Methodology We performed our audit from March through September 2018. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. EPA definitions for PII and SPII: PII — Information used to distinguish, trace or identify an individual's identity, such as name, date of birth and home address. SPII — A subset of PII, this information includes Social Security numbers or comparable identification numbers, and passport, biometric, medical or financial data. 18-P-0298 2 ------- We reviewed federal and EPA policies and procedures on privacy and password management requirements to protect the confidentiality of PII and SPII collected and maintained in the agency information systems. We reviewed these policies and procedures to help determine what constitutes PII and SPII. We obtained access to the agency's current incident tracking system to conduct queries for incident tickets with PII and SPII. We performed a query on the term "SSN" in the "search" data field. The EPA's incident tracking system identified a total of 2,060 tickets that matched the term "SSN." We judgmentally selected a sample of 264 tickets to determine whether PII and SPII appeared within each ticket. The incident tickets were dated from fiscal years 2009 to 2015. We reviewed recent security assessment reports, privacy impact assessments, and system security plans for the current and replacement incident tracking systems to determine whether (1) the systems' security documentation indicated PII would be collected, and (2) password management controls complied with EPA requirements. We interviewed agency personnel responsible for the oversight, management and implementation of the current and replacement incident tracking systems. We also interviewed contract personnel who manage the current and replacement incident tracking systems on behalf of the EPA to determine what security controls are currently in place to protect the confidentiality of PII and SPII. Results We found that the current incident tracking system lacked required controls to protect sensitive data and manage passwords used to access the system. We identified 25 incident tickets that contained PII and SPII (e.g., SSNs, date of birth and W-2 information) for 73 individuals within the agency's current incident tracking system. Federal and EPA guidance require system owners to take steps to prevent the unauthorized access, use, modification, loss, destruction, dissemination or disclosure of PII and SPII. The incidents occurred because the EPA did not include guidance within its current operating procedures to instruct help desk technicians to not include PII and SPII within incident tickets. Further, as of September 2018, the EPA has not yet identified a solution to enforce the agency's password requirements for the current incident tracking system, even though the system's password module has been inoperable since a software upgrade in 2016. The EPA began a partial rollout of a replacement incident tracking system in May 2018. The rollout has an anticipated completion date of September 30, 2018. Current standard operating procedures also will be used with the replacement incident tracking system. Therefore, we are issuing this report to reiterate the need for management to address current weaknesses, so that the weaknesses do not continue to impair the EPA's ability to protect the confidentiality of PII and SPII. 18-P-0298 3 ------- Confidentiality of Personal Information Is Not Protected in EPA's Incident Tickets The EPA's incident tickets contain personal information that is visible to all registered users of the current incident tracking system. Based on our review of 264 tickets that contained the term "SSN," we found that 25 incident tickets (9 percent) contained PII and SPII. Some incident tickets included multiple individuals' PII or SPII. The 25 incident tickets contained PII and SPII on 73 individuals, and included the following information: • Social Security numbers. • W-2 personal information. • Pseudo SSNs (issued by the Office of Personnel Management to non- United States citizens for background investigation purposes). • Dates of birth. • Home addresses. • Thrift Savings Plan (TSP) account numbers. (The TSP is a retirement savings and investment plan for federal employees.) Figure 1 shows the breakdown of PII and SPII found in the 25 incident tickets. Figure 1: Examples of PII and SPII found in incident tickets Results of 25 remedy incident tickets displaying PII and sensitive PII to registered users' view SSN and W-2 personal information SSN and TSP account numbers SSN Pseudo SSN and real SSN Pseudo SSN and home address New pseudo SSN and old pseudo SSN Date of birth and SSN 0 10 20 30 40 50 60 ¦ # of EPAindividuals affected r # of tickets with PII/SPII Source: OIG compiled using EPA incident tracking system data. 18-P-0298 4 ------- EPA CIO 2151.1, Privacy Policy, dated September 14, 2015, states that EPA employees, managers, contractors and grantees working on behalf of EPA will: ~ Ensure that PII contained in a system of records, to which they have access in the performance of their duties, is protected so that the security and confidentiality of the information are preserved. ~ Access and use only information for which they have official authorization. We met with OEI personnel to discuss and present the contents of the incident tickets we selected for our sample. OEI personnel were unaware of PII and SPII documented within the incident tickets and were unsure why help desk technicians were entering this information. After further examining ticket content, OEI personnel concluded that the nature of documenting PII and SPII appeared to be associated with personnel providing the information to technicians to correct payroll and human resource records. After additional correspondence with OEI personnel, we learned that the office did not include guidance within its current operating procedures to instruct help desk technicians to not include or maintain PII and SPII within incident tickets. We also learned that the OEI did not follow EPA information security and privacy directives to protect the confidentiality of PII and SPII if there is a need to collect or maintain this information. OEI personnel stated that operating procedures need to be updated to provide clear instructions to help desk technicians and how they are to handle incident tickets that involve PII and SPII. Under the OEI's current incident tracking system, the security assessment report (dated August 2017) and the privacy impact assessment (dated January 2016) documented the system would not collect PII. As a result, the OEI did not conduct periodic reviews of incident tickets to verify whether PII and SPII were collected or stored within its current incident tracking system. If periodic reviews had been performed, the EPA could have determined whether a System of Records Notice (SORN) was needed. A SORN informs management that a system containing privacy information may require additional security controls as required by National Institute of Standards and Technology Special Publication 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations, dated April 2013; and EPA CIO 2151 -P-03.1, Procedures for Preparing and Publishing Privacy Act Systems of Records Notices, dated January 5, 2010. The OEI has started a transition to a new system to replace the current incident tracking system. The replacement system became operational in May 2018 for select agency locations. The security assessment report for the replacement system (dated January 2018) indicated that the replacement system would not 18-P-0298 5 ------- collect PII. However, the privacy impact assessment and the draft system security plan state that the new system does collect PII. We are uncertain about the accuracy of any of this documentation, since management was not aware that PII and SPII were included in the current tracking system until we brought this issue to their attention. EPA personnel stated that the replacement and current incident tracking systems will both be in operation until September 30, 2018. The EPA could incur additional costs putting security controls in place to protect individuals' identities within the current incident tracking system until it is decommissioned. The EPA also could be subject to lawsuits because the agency did not perform due diligence to protect the confidentiality of the 73 individuals' PII and SPII from unauthorized use and theft. Since incident tickets associated with those individuals were annotated as resolved and closed between fiscal years 2009 and 2015, those individuals' personal information was exposed for at least 3 years, as of September 2018. Exposure of the individuals' PII and SPII could lead to identity theft and result in financial harm, embarrassment or inconvenience. EPA's Incident Tracking Systems Do Not Comply with Internal Password Management Controls The current incident tracking system is not configured to meet the agency's password management length, character and life span requirements. In January 2018, we requested access to the system and were provided a simple six-character password. Upon initially logging into the system, we were not prompted to change the initial temporary password. We maintained the simple six-character password for more than 60 days without the system requiring us to change our password. Even though the system did not meet password requirements, the agency also did not request a password requirement waiver as required by the agency's information security directive. Furthermore, the incident tracking system's security plan, dated January 2016, indicates that password management controls have been implemented; however, the plan has not been updated to reflect the current weakness in password controls. EPA CIO 2120-P-07.2, Information Security - Identification and Authentication Procedure, dated November 30, 2015, requires specific password characteristics: be comprised of 12 characters; include upper- and lower-case letters, as well as numbers and special characters; and have a maximum password life span of 60 days. Temporary passwords can be used to facilitate password changes or initial account establishment if the system forces an immediate change. If password guidelines cannot be met, a request can be made for a waiver of the password requirements and standards, and the request must include, at a minimum, specific designation of which requirements) the waiver request is addressing. EPA CIO 2150.3-P-12.1, Information Security - Interim Planning Procedures, V3.6, dated August 6, 2012, holds the system owner responsible for 18-P-0298 6 ------- reviewing and updating the system security plan when significant changes occur to the system's operating environment or security requirements. OEI personnel indicated that a waiver outlining the system's noncompliance with agency password requirements was not initiated when the password module failed during the 2016 software upgrade because the software vendor provided a patch to fix the issue. However, OEI personnel stated that the patch did not correct the issue. An EPA contract representative stated that, as of April 2018, the development and testing of a remediation for the password configuration problem is in progress with a target deployment to the production environment as soon as possible. We also discovered that password management controls documented in the replacement system's draft security plan (dated March 2018) did not meet EPA requirements. We found the following issues with the replacement system's password management controls: • Password expiration requirements were stated as every 90 days instead of the policy requirement of every 60 days. • Minimum password length requirements were eight characters instead of the required 12 characters. OEI personnel stated that they were aware of the inconsistency and that the system's draft security plan had been updated. OEI personnel provided us with a copy of the updated draft security plan dated April 11, 2018, which included language consistent with the EPA's password management requirements, but personnel stated that the replacement system's security plan was a work-in- progress. Password management is an additional cybersecurity control that can protect data from unauthorized access, use and destruction. Since the current incident tracking system contains SPII, it is essential that required password controls are implemented to impede internal and external threats from compromising the system and obtaining access to personal information. Agency Actions After our June 5, 2018, meeting with EPA representatives, the agency stated that it had resolved the password management issue with the current incident tracking system. EPA representatives provided information that indicated the current system will require a password of at least 12 characters and a new password will expire in 60 days. We concluded that the updated password length requirement is being enforced. 18-P-0298 7 ------- Conclusion Without proper privacy and security controls in place to make sensitive information unusable, PII and SPII are vulnerable to unauthorized access. The lack of these controls can provide cyber thieves an opportunity to exploit the integrity of the EPA's information security posture and compromise the confidentiality of personal data maintained in the agency's systems. Recommendations We recommend that the Assistant Administrator for Environmental Information: 1. Develop and implement a strategy that protects the confidentiality of personally identifiable information and sensitive personally identifiable information, as required by federal and EPA privacy and password guidance, for incident tickets in the current incident tracking system. 2. Update standard operating procedures for EPA incident tracking system help desk technicians. Establish controls for technicians to comply with federal personally identifiable information requirements when they handle incident tickets that require them to collect personally identifiable information and sensitive personally identifiable information. 3. Complete a System of Records Notice for the replacement incident tracking system. 4. Update the EPA's system security plan, privacy impact assessment and other necessary security documentation to specify that the replacement system will contain personally identifiable information and sensitive personally identifiable information. Agency Response and OIG Evaluation On May 23, 2018, we issued a discussion document outlining our findings and recommendations to the EPA. We met with agency representatives to discuss our findings and recommendations on June 5, 2018. Agency representatives stated that the OEI would not provide written responses to the discussion document. Agency representatives further stated that their verbal responses would serve as their official responses to the discussion document. The agency agreed with our recommendations. EPA representatives stated that mitigation activities are underway to address the report's findings, such as: • Retraining help desk technicians on the correct procedures for handling PII and SPII when this information is submitted to the EPA's help desk. 18-P-0298 8 ------- • Updating standard operating procedures for handling PII and SPII to comply with EPA privacy policies and procedures. • Redacting PII and SPII in incident tickets retained in the EPA's current incident tracking system. • Formulating a plan to mitigate the password deficiencies in the current incident tracking system. A target date of September 30, 2018, has been established to redact all PII and SPII from incident tickets, disconnect the current incident tracking system from the agency's network, and archive that system's database. EPA representatives said that there is a possibility the September 30, 2018, target date to implement the strategy may not be met if there are issues with the ongoing rollout of the replacement system. However, the EPA's goal is not to exceed the target date since keeping the current tracking system online would present an additional risk and cost to the agency. EPA representatives further stated that help desk technicians will use the updated standard operating procedures for handling PII and SPII in the replacement incident tracking system. Recommendation 1 is resolved since the EPA plans to implement a strategy to redact PII and SPII in incident tickets, and disconnect the current incident ticketing system from the network by September 30, 2018. Recommendation 2 is resolved since EPA management indicated that standard operating procedures were updated on July 31, 2018, and they provided a copy of the updated procedures. Planned corrective actions are pending in relation to the EPA establishing controls to verify PII and SPII are not documented in incident tickets. In response to the OIG's original recommendation for the agency to complete a SORN for both the current and replacement systems, an EPA representative stated that conducting a SORN is a lengthy process, and considering the current system is being decommissioned in September 2018, it would not be feasible to complete a SORN for the current system. However, the representative also said that the agency is in the process of completing a SORN for the replacement system. The OIG then revised Recommendation 3 to require the EPA to complete a SORN for the replacement incident tracking system. The recommendation was modified to emphasize the work that needs to be completed on the new system. The EPA has yet to provide a date for when it will complete this corrective action. Recommendation 3 is unresolved since the EPA did not provide any planned corrective actions with milestone dates. EPA representatives did not have any comments regarding Recommendation 4. This recommendation is unresolved since the EPA did not provide any planned corrective actions with milestone dates. 18-P-0298 9 ------- Status of Recommendations and Potential Monetary Benefits RECOMMENDATIONS Potential Planned Monetary Rec. Page Completion Benefits No. No. Subject Status1 Action Official Date (In $000s) Develop and implement a strategy that protects the confidentiality of personally identifiable information and sensitive personally identifiable information, as required by federal and EPA privacy and password guidance, for incident tickets in the current incident tracking system. Update standard operating procedures for EPA incident tracking system help desk technicians. Establish controls for technicians to comply with federal personally identifiable information requirements when they handle incident tickets that require them to collect personally identifiable information and sensitive personally identifiable information. Assistant Administrator for 9/30/18 Environmental Information Assistant Administrator for 7/31/18 Environmental Information Complete a System of Records Notice for the replacement incident tracking system. Update the EPA's system security plan, privacy impact assessment and other necessary security documentation to specify that the replacement system will contain personally identifiable information and sensitive personally identifiable information. Assistant Administrator for Environmental Information Assistant Administrator for Environmental Information C = Corrective action completed. R = Recommendation resolved with corrective action pending. U = Recommendation unresolved with resolution efforts in progress. 18-P-0298 10 ------- Appendix A Distribution The Administrator Deputy Administrator Special Advisor, Office of the Administrator Chief of Staff Chief of Operations Assistant Administrator for Environmental Information Principal Deputy Assistant Administrator for Environmental Information Deputy Assistant Administrator for Environmental Information Agency Follow-Up Official (the CFO) Agency Follow-Up Coordinator General Counsel Associate Administrator for Congressional and Intergovernmental Relations Associate Administrator for Public Affairs Director, Office of Continuous Improvement, Office of the Administrator Director, Office of Information Technology Operations, Office of Environmental Information Audit Follow-Up Coordinator, Office of the Administrator Audit Follow-Up Coordinator, Office of Environmental Information 18-P-0298 11 ------- |