x-^tD ST/lf.
* *.	U.S. Environmental Protection Agency	20-E-0309
§ jyi \	Office of Inspector General	September 10,2020
v	At a Glance
Why We Did This Project
The U.S. Environmental
Protection Agency's Office of
Inspector General performed this
evaluation to (1) assess the
completeness of the EPA's
processes for testing its network
to identify potential vulnerabilities
that could compromise the
Agency's systems and data, and
(2) conduct an independent
automated vulnerability testing of
information technology resources
connected to the EPA's network
to identify vulnerabilities that
could compromise the
confidentiality, integrity, and
availability of Agency information
systems and data.
We performed our evaluation at
EPA headquarters, Region 8,
and the National Computer
Center. Due to travel restrictions,
we only performed OIG
vulnerability testing at the
Region 8 headquarters and
laboratory and on the Region 8
Superfund Cost Recovery
Package Imaging and Online
System, known as SCORPIOS,
server.
This report addresses the
following:
•	Operating efficiently and
effectively.
This report addresses a top EPA
management challenge:
•	Enhancing information
technology security.
Address inquiries to our public
affairs office at (202) 566-2391 or
OIG WEBCOMMENTS@epa.gov.
EPA Needs to Improve Processes for
Securing Region 8's Local Area Network
What We Found
The vulnerability tests of Region 8's local area
network, conducted by the EPA's Office of
Mission Support, were not comprehensive.
Additionally, wireless networks operating
within the Region 8 laboratory could
jeopardize controls protecting vulnerable
laboratory equipment. If vulnerabilities at Region 8 are exploited, there could be
denial-of-service attacks, unauthorized disclosure of personally identifiable
information, and corruption of scientific data that are used to make program
decisions.
Exploitation of vulnerabilities
may result in the loss of
confidentiality, integrity, and
availability of personally
identifiable information and
scientific data.
The lack of updated SCORPIOS technical documentation, the Office of the
Chief Financial Officer's inability to identify whether personally identifiable
information is secured on regional SCORPIOS servers, and the security
concerns raised in two 2019 hotline complaints regarding SCORPIOS warrant
an OCFO investigation of whether SCORPIOS needs additional controls to
protect the confidentiality, integrity, and availability of the system. A future
breach to the SCORPIOS application could cost the EPA $11,477,250.
Recommendations and Planned Agency Corrective Actions
We recommend that Region 8 update its local area network system security
plan and review wireless access points within the Region 8 laboratory. We
further recommend that the Office of Mission Support review and implement
procedures to verify that vulnerability tests and their results are comprehensive.
We also recommend that the OCFO implement internal controls to protect
personally identifiable information and manage system development for the
SCORPIOS application.
The Agency concurred with our recommendations and provided acceptable
corrective actions. The Agency has completed corrective actions for four of our
seven recommendations. We consider the remaining three recommendations
resolved with corrective actions pending.
List of OIG reports.

-------