Lack of Vulnerability Remediation for Weaknesses Identified Within the Central Data Exchange System Increases the Risk of Cyberattacks March 5, 2024 | Report No, 24-N-0024 Central Data Exchange wing Hotfce Pf*eednj j.j accK5 ¦ adrmnistrattve you' ------- Report Contributors Tertia Allen Yoon An LaSharn Barnes Troy Givens Nii-Lantei Lamptey lantha Maness Christina Nelson Teresa Richardson Scott Sammons Michelle Wicker Abbreviations CDX Central Data Exchange CIO Chief Information Officer EPA U.S. Environmental Protection Agency OIG Office of Inspector General POA&M Plan of Action and Milestones Key Definitions Brute Force Attack Plan of Action and Milestones Cover Image The Central Data Exchange is the EPA's electronic reporting site for environmental data. (EPA OIG adaptation of EPA images) Allows a threat actor to gain unauthorized access to an account by attempting multiple combinations of passwords. Documents the corrective action plans to correct weaknesses or deficiencies noted during the assessment of controls and to reduce or eliminate known vulnerabilities in a system. Are you aware of fraud, waste, or abuse in an EPA program? EPA Inspector General Hotline 1200 Pennsylvania Avenue, NW (2431T) Washington, D.C. 20460 (888) 546-8740 OIG.Hotline@epa.gov Learn more about our OIG Hotline. EPA Office of Inspector General 1200 Pennsylvania Avenue, NW (241OT) Washington, D.C. 20460 (202) 566-2391 www.epaoiq.gov Subscribe to our Email Updates. Follow us on X (formerly Twitter) @EPAoig. Send us your Project Suggestions. ------- >5»Ecro OFFICE OF INSPECTOR GENERAL U.S. ENVIRONMENTAL PROTECTION AGENCY March 5, 2024 MEMORANDUM SUBJECT: FROM: Lack of Vulnerability Remediation for Weaknesses Identified Within the Central Data Exchange System Increases the Risk of Cyberattacks Report No. 24-N-0024 Sean W. O'Donnell, Inspector General /A nUi TO: Kimberly Patrick, Principal Deputy Assistant Administrator Office of Mission Support The U.S. Environmental Protection Agency Office of Inspector General initiated an audit to review the EPA's Central Data Exchange, or CDX, system's access security controls. While conducting work on that audit, which remains ongoing, we decided to issue this management alert to inform the Agency of significant unresolved vulnerabilities in the CDX system. These vulnerabilities increase the risk of threat actors gaining unauthorized access to CDX and other connected program services. Additionally, we are alerting the Agency of deficiencies in validating the completion of the CDX plans of action and milestones, or POA&Ms, for several vulnerabilities. This management alert supports an EPA mission- This management alert addresses a top EPA related effort: management challenge: Operating efficiently and effectively. Managing grants, contracts, and data systems. You are not required to respond to this management alert because it contains no recommendations. If you submit a response, however, it will be posted on the OIG's website, along with our memorandum commenting on your response. Your response should be provided as an Adobe PDF file that complies with the accessibility requirements of section 508 of the Rehabilitation Act of 1973, as amended. The final response should not contain data that you do not want to be released to the public; if your response contains such data, you should identify the data for redaction or removal along with corresponding justification. We will post this management alert to our website at www.epaoig.gov. To report potential fraud, waste, abuse, misconduct, or mismanagement, contact the OIG Hotline at (888) 546-8740 or OIG.Hotline@epa.gov. 24-N-0024 1 ------- Background The CDX is a web-based system that allows companies, states, tribes, and other entities to electronically report and transfer their environmental data securely within and outside the Agency. The CDX collects environmental data for the EPA's air, water, hazardous waste, and toxics release inventory programs. The system allows end users to create accounts in the CDX and provides identity verification services to enable access to over 30 program services, such as systems and tools. According to the CDX registration webpage, a user can register for available program services to access through the CDX. Additionally, the EPA uses the information maintained in the CDX to investigate potential fraud involving a registered user; verify compliance with program regulations; and initiate legal action regarding program fraud, abuse, or noncompliance. The security of EPA information and information systems is vital to the success of the EPA's mission. Therefore, the EPA conducts periodic testing and evaluates security controls for every system to ensure that security controls are working as intended. As part of the CDX fiscal year 2022 continuous monitoring assessment, an independent Security Control Assessor Test Team conducted a security assessment of the CDX system. A security assessment determines the extent to which security controls are correctly implemented, are operating as intended, and are producing the desired outcome to meet the system requirements. The resulting report, The Central Data Exchange Security Assessment Report Continuous Monitoring Assessment- Year 2, dated March 2022, included test results for not just the fiscal year 2022 assessment but also the fiscal years 2020 and 2021 assessments. It identified 25 vulnerabilities associated with 21 security controls. Two of the 25 identified vulnerabilities were categorized as high risk, while 23 were categorized as moderate risk. Vulnerabilities categorized as high risk may have a catastrophic impact on an organization's operations or systems, and vulnerabilities categorized as moderate risk may have serious adverse impacts on an organization's operations or systems. The Agency developed 20 POA&Ms for the 25 vulnerabilities; 12 POA&Ms associated with 14 vulnerabilities remained open as of August 2023.1 The National Institute of Standards and Technology Special Publication 800-37, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, Revision 2, dated December 2018, states that system owners prepare POA&Ms based on the findings and recommendations of the security assessment reports. The purpose of these POA&Ms is to document the corrective action plans to correct weaknesses or deficiencies noted during the assessment of controls and to reduce or eliminate known vulnerabilities in the system. Responsible Offices The EPA Office of Mission Support owns the CDX. The Office of Information Management, a program office within the Office of Mission Support, is responsible for operating the CDX. The CDX system owner 1 The Agency closed six POA&Ms, and two POA&Ms were submitted for closure as of August 2023. 24-N-0024 1 ------- is responsible for reviewing and updating the POA&Ms monthly. The system owner or other CDX system personnel upload supporting documentation to the Agency's Information Security Repository system, known as XACTA, to support the closure of these POA&Ms. The Office of Information Security and Privacy, a program office within the Office of Mission Support, is responsible for reviewing the POA&Ms' supporting documentation to validate whether the corrective actions remediated the underlying vulnerability and for closing the POA&Ms within the XACTA system. Scope and Methodology We conducted our work from August 2022 to September 2023. While our overall audit, which is still ongoing, is being conducted in accordance with generally accepted government auditing standards, the work related to this management alert does not constitute an audit done in accordance with these standards. However, we did follow the OIG's quality control procedures for ensuring that the information in this report is accurate and supported. OIG Concerns The EPA did not mitigate significant vulnerabilities identified in the CDX system. During the fiscal year 2022 security assessment of the CDX system, the Security Control Assessor Test Team identified vulnerabilities in the system, which the Agency did not remediate within the required time frames, as identified in the Agency's Information Security - Security Assessment and Authorization Procedures, CIO 2150-P-04.2, dated May 27, 2016. The Agency should remediate vulnerabilities within either a 30-, 60-, or 90-day time frame based on the severity of the vulnerability. Of the 25 identified vulnerabilities, two high-risk and 12 moderate-risk vulnerabilities remained unresolved as of August 2023. Although the Agency developed POA&Ms for these vulnerabilities, it did not adhere to CIO 2150-P-04.2. Specifically, the EPA did not ensure that POA&Ms had scheduled completion dates for milestone activities within the XACTA system. The EPA also did not review and update the POA&Ms monthly within the XACTA system to make sure that an accurate record existed of all planned, in-process, and completed actions to correct these deficiencies. Finally, the EPA did not provide support that it implemented adequate mitigating or compensating controls to address the risks associated with the 14 vulnerabilities remaining in the CDX, making the Agency more vulnerable to cyberattacks. Specifically, we found that: The EPA's ability to track the status of all actions taken to correct these security weaknesses was hindered because the XACTA system did not have documentation of the CDX system owner's monthly reviews and updates of the POA&Ms for the 14 remaining vulnerabilities. EPA procedures require that the POA&Ms have milestone completion dates, yet the POA&Ms for these 14 remaining vulnerabilities did not. The system owner or other CDX system personnel 24-N-0024 2 ------- assigns milestones to the POA&Ms to identify the required activities for full remediation of the vulnerability within a specified time frame. Often, there are multiple milestones within a POA&M, and each milestone must be detailed and include a completion date. A POA&M may be considered complete if the Agency accepts the risk. A system owner can submit a Risk Determination Waiver to request exemption from certain aspects of EPA information technology procedures. However, the Risk Determination Waiver should include (1) a detailed business justification and (2) information regarding implementation of compensating or mitigating controls. The Office of Information Security and Privacy rejected five Risk Determination Waiver requests for the CDX system. The Office of Information Security and Privacy waiver rejections stated that: Based on the review of your requests and EPA existing policies and procedures approval is not recommended. If a deviation from the existing policy and procedures is required to support your business needs, please resubmit these requests documenting your detailed business justification and all implemented compensating/mitigating controls deployed to reduce risks from deviating from existing EPA policies and procedures. Compliance with security requirements in a timely manner is necessary to protect against potential unauthorized disclosure or modification of CDX information, yet six of the 14 vulnerabilities had expired POA&M scheduled completion dates ranging from two weeks to 21 months. Additionally, the EPA had deficiencies in validating the completion of POA&Ms for several vulnerabilities. The Agency did not adhere to the POA&M Monitoring and Validation Standard Operating Procedure, dated February 19, 2016, and the XACTA POA&M Guide, Version 5.0, dated October 2020. Specifically, the Agency closed a POA&M without having appropriate supporting security documentation in the XACTA system and did not review the security documentation submitted for POA&M closure in a timely manner. The system owner or other CDX system personnel are responsible for uploading security documentation into the XACTA system as evidence that the corrective actions were completed and that the underlying security control was operating efficiently. We found that: The CDX is potentially vulnerable to brute force attacks due to an unresolved password configuration vulnerability. Brute force attacks allow a threat actor to gain unauthorized access to an account by attempting multiple combinations of passwords. The Office of Information Security and Privacy prematurely closed a POA&M for a password configuration vulnerability without confirming that the POA&M's security documents supported and remediated the underlying vulnerability. The POA&M included documentation that a Risk Determination Waiver will be signed, but CDX system personnel failed to upload an approved and signed Risk Determination Waiver to support closing the POA&M. 24-N-0024 3 ------- The Office of Information Security and Privacy is hindering the timely resolution of these vulnerabilities by failing to review these POA&Ms in a timely manner. It did not review and validate security documentation for two POA&Ms submitted by CDX system personnel for closure in June 2022 until June 2023, even though these POA&Ms were in a completed status and thus were required to be reviewed within a month. The POA&M Monitoring and Validation Standard Operating Procedure and XACTA POA&M Guide state that all corrective actions should be completed, and appropriate security documentation should be uploaded, to the XACTA system prior to a POA&M closure. We identified a similar issue in OIG Report No. 23-E-0021. The EPA's Vulnerability Tracking and Remediation and Information Technology Procedures Review Processes Are Implemented Inconsistently, issued July 5, 2023. In that report, we recommended that the Agency (1) develop and implement a plan for prioritizing and scheduling the installation of patches that address vulnerabilities and (2) assign responsibilities including documenting associated POA&Ms in the Agency tracking system. As of November 2023, these recommendations were resolved with corrective actions pending.2 According to the Cybersecurity and Infrastructure Security Agency, the time between a threat actor discovering a vulnerability and exploiting the vulnerability is decreasing. The Cybersecurity and Infrastructure Security Agency reported that, on average, threat actors exploit a vulnerability within 15 days of discovery. These 14 moderate- and high-risk vulnerabilities continue to remain in the CDX as of August 2023, 17 months after the independent assessor issued its March 2022 security assessment report. Left uncorrected, the EPA's network is more vulnerable to threat actors potentially exploiting these vulnerabilities and gaining access to the CDX and environmental data that states, tribes, and other entities rely on, as well as to the potential disclosure and modification of data for over 30 program services that are connected to the CDX. Agency Response and OIG Assessment On September 19, 2023, the Office of Mission Support responded to our draft report, partially concurring with our findings. The Office of Mission Support stated that it believes that the Agency effectively manages the risks to the CDX and the EPA network. Further, it stated that the Agency uses software to monitor and track vulnerabilities through its POA&M process and that the CDX has compensating controls that reduce the risks of vulnerabilities being exploited. The Agency's response is attached to this report. At the EPA's request, we did not include the screenshots that the Agency attached to its response because of the sensitive nature of the content. 2 We recommended that the assistant administrator for Mission Support develop a process to keep information security procedures consistent with the most current revision of the National Institute of Standards and Technology Special Publication 800-53, Security and Privacy Controls for Information Systems and Organizations. Additionally, we recommended that the assistant administrator for Air and Radiation develop, implement, and assign responsibilities for a plan to prioritize and schedule installation of patches that address critical vulnerabilities in the Analytical Radiation Data System within the Agency's required time frames. 24-N-0024 4 ------- The Agency's response had two overarching responses to our findings: (1) the Office of Mission Support stated that the CDX team reviews POA&Ms weekly and tracks the POA&M due dates in Jira, and (2) the Agency has compensating and mitigating controls that reduce the risks of vulnerabilities being exploited. However, we continue to find that CDX vulnerabilities were not tracked, monitored, and closed in compliance with the POA&M requirements identified in the Agency's XACTA POA&M Guide. The EPA established these requirements to track the resolution of vulnerabilities to better manage the risks to its systems. According to the XACTA POA&M Guide, the XACTA system is the Agency's tool of record for managing the POA&M process. The XACTA system did not include documentation of the CDX system owner's monthly reviews and updates of the POA&Ms for the 14 unresolved vulnerabilities. Furthermore, the POA&Ms for these unresolved vulnerabilities did not include milestone completion dates in the XACTA system. The Agency's response acknowledges that information was not completely updated in the XACTA system and that POA&Ms may have expired completion dates. While the Agency provided Jira screenshots indicating that POA&Ms were in progress, on hold, or in a "to do" status, the Jira screenshots did not show that POA&Ms were updated monthly and that corrective actions were completed to resolve these vulnerabilities.3 While the Agency listed several compensating and mitigating controls within its response to our draft report, it did not provide any supporting documentation for these controls or describe how these controls address the risks associated with the 14 vulnerabilities remaining on the CDX system.4 Further, as noted in our report, the Office of Information Security and Privacy rejected five Risk Determination Waivers submitted for the CDX that deviated from EPA policies and procedures because of a lack of compensating controls. The vulnerabilities remaining on the CDX 17 months after the issuance of the security assessment report leave the EPA's network susceptible to threat actors potentially exploiting these vulnerabilities.5 Additionally, the Agency's response raised concerns regarding specific terminology mentioned in the draft report. We reviewed the response and incorporated technical comments as appropriate. cc: Michael S. Regan, Administrator Janet McCabe, Deputy Administrator Dan Utech, Chief of Staff, Office of the Administrator Wesley J. Carpenter, Deputy Chief of Staff for Management, Office of the Administrator Faisal Amin, Agency Follow-Up Official (the CFO) Andrew LeBlanc, Agency Follow-Up Coordinator Susan Perkins, Agency Follow-Up Coordinator Jeffrey Prieto, General Counsel Tim Del Monico, Associate Administrator for Congressional and Intergovernmental Relations 3 See attachment, "OMS Response To Report Concerns" table, No. 5, 6, 8, 9, 10, and 12. 4 Any review of compensating or mitigating control documentation will be conducted during the overall audit. 5 See attachment, "OMS Response To Report Concerns" table, No. 7, 11, 12, and 16. 24-N-0024 5 ------- Nick Conger, Associate Administrator for Public Affairs Shari Grossarth, Office of Policy OIG Liaison Stuart Miles-McLean, Office of Policy GAO Liaison Vaughn Noga, Chief Information Officer and Deputy Assistant Administrator for Information Technology and Information Management, Office of Mission Support Helena Wooden-Aguilar, Deputy Assistant Administrator for Workforce Solutions and Inclusive Excellence, Office of Mission Support Dan Coogan, Deputy Assistant Administrator for Infrastructure and Extramural Resources, Office of Mission Support Stefan Martiyan, Director, Office of Continuous Improvement, Office of the Chief Financial Officer Yulia Kalikhman, Acting Director, Office of Resources and Business Operations, Office of Mission Support Tonya Manning, Director and Chief Information Security Officer, Office of Information Security and Privacy, Office of Mission Support Michael Benton, Audit Follow-Up Coordinator, Office of the Administrator Afreeka Wilson, Audit Follow-Up Coordinator, Office of Mission Support 24-N-0024 6 ------- Attachment A Agency Response to Draft Report \ f~\ It PRO"*4- UNITED STATES ENVIRONMENTAL PROTECTION AGENCY WASHINGTON, D C. 20460 September 19, 2023 OFFICE OF MISSION SUPPORT MEMORANDUM SUBJECT: Management Response to Office of Inspector General Draft Report "Lack of Vulnerability Remediation for Weaknesses Identified With the Central Data Exchange System Increases the Risk of Cyberattacks" Project No. OA-FY23-0094 dated September 12,2023 \/AI IfiNM Digitally signed by V AUoniN VAUGHN NOGA FROM: VaughnNoga, Deputy Assistant Administrator NOGA o9:so43 woo- fer Environmental Information and Chief Information Officer TO: LaSliam Barnes, Director Information Resources Management Directorate Office of Audit, Office of Inspector General Thank you for the opportunity to respond to the concerns in the September 12th draft report titled "Lack of Vulnerability Remediation for Weaknesses Identified Wi thin the Central Data Exchange System Increases the Risk of Cyberattacks" that outlined the OlG's concerns. Specifically, that: 1. "The EPA did not mitigate significant vulnerabilities identified on the CDX system;" 2. "These vulnerabilities increase the risk of threat actors gaining unauthorized access to CDX and its 49 interconnected systems;" and, 3. There are "deficiencies with validating the completion of the C DX plans of action and milestones, or POA&Ms, for several vulnerabilities." Following is a summary of the agency's position on each of the concerns outlined in the report as well as additional context and information regarding the Central Data Exchange's (CDX) security posture. EPA believes that the agency effectively manages the risk to CDX and the EPA Network. For your consideration, we have also attached screen shots in the Appendix to supplement this response. 24-N-0024 ------- QMS RESPONSE TO REPORT CONCERNS No. OIG Concern or Statement OMS' Response 1. "The system allows end users to create accounts in CDX and provides identity verification services to gain access to 49 other environmental systems." OMS does not concur. OMS does not understand how the OIG calculated "49 other environmental systems." CDX is comprised of human interactions and machine to machine interactions. 2. "The Central Data Exchange Security Assessment Report Continuous Monitoring Assessment - Year 2, dated March 2022, includes test results for the fiscal years 2020 through 2022 assessments. It identified 25 vulnerabilities associated with 21 security controls. Two of the 25 identified vulnerabilities were categorized as high risk,2 while the remaining 23 were categorized as moderate risk.3" Concur with the statement, however, OMS does not concur with the implications that it provides further in the report. The Assessment report had 25 findings related to the controls. This resulted in 18 POA&Ms of which 6 have been closed (including one of the two identified high risk vulnerabilities); remaining are 1 Agency level, 7 relate to ICAM; 4 CDX specific. Plans of Actions and Milestones (POA&Ms) are a risk management process that provides increased security awareness of vulnerabilities and enables the agency to enact a stronger security posture on systems, including mitigating controls. POA&Ms will be created at any point a vulnerability is identified and CIO 2150- P-04.2 CA-5 (1) (a) (i) - lists how POA&Ms can be identified. CDX is constantly monitoring and addressing security vulnerabilities during that same timeframe between October 1, 2019 and September 30, 2022 CDX closed 112 POA&Ms. While this audit has been underway, CDX has also opened an additional 8 POA&Ms, of which 2 have also been closed. The most current version of the XACTA POA&M Guide is 5.1, dated October 2020. 3. "National Institute of Standards and Technology Special Publication 800-37, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, Revision 2, dated December 2018, states that system owners prepare CDXPOA&Ms based on the findings and recommendations of the security assessment reports." Typo. "... states that system owners prepare CDX POA&Ms..." NIST reference to CDX. 24-N-0024 8 ------- 4. "The purpose of these POA&Ms is to document the corrective action plans to correct weaknesses or deficiencies noted during the assessment of controls and to reduce or eliminate known vulnerabilities in the system." Plans of Actions and Milestones (POA&Ms) are a risk management process that provides increased security awareness of vulnerabilities and enables the agency to enact a stronger security posture on systems, including mitigating controls. POA&Ms will be created at any point a vulnerability is identified and CIO 2150-P-04.2 CA-5 (1) (a) (i) - lists how POA&Ms can be identified. The most current version of the XACTA POA&M Guide is 5.1, dated October 2020. 5. "The EPA did not ensure POA&Ms had scheduled completion dates for milestone activities." Do not concur. CDX tracks POA&M due dates in Jira and POA&Ms are reviewed weekly by the CDX security team (see Appendix screen shots). 6. "The EPA also did not review and update the POA&Ms monthly to make sure that an accurate record of all planned, in process, and completed actions existed to correct these deficiencies." Do not concur. The CDX team does review POA&Ms weekly in Jira (see Appendix attached screenshots). 7. ... "the EPA did not implement adequate mitigating or compensating controls to address the risks associated with these 14 vulnerabilities remaining on the CDX system, making the Agency more vulnerable to cyberattacks." Do not concur. CDX has implemented several security layers of compensating controls, for example: Network Security Groups (NSG): to prevent unauthorized network route access. Key Vault: Credentials are stored in a secured location versus packaged with the applications. SSL certificates are also stored in a key vault so threat actors are unable to masquerade as a CDX resource. Defender for Cloud; Defender for Servers; Defender for Containers; Defender for Open Source Databases: Cloud native security tools that provide (dashboard) near real time security posture for CDX resources. Splunk integration: CDX has integrated with the Agency log warehouse. 8. EPA did not ensure POA&Ms had scheduled completion dates for milestone activities. Do not concur. See above. 24-N-0024 9 ------- 9. "The EPA's ability to track the status of all actions taken to correct these security weaknesses was hindered because the Agency's Information Security Repository system did not have documentation of the CDX system owner's monthly reviews and updates of the POA&Ms for the 14 remaining vulnerabilities." Do not concur. CDX does track actions taken in Agency tools, and regularly updates actions in Jira, but acknowledges the information was not completely entered into XACTA. 10. "EPA procedures require that the POA&Ms have milestone completion dates, yet the POA&Ms for these 14 remaining vulnerabilities did not. The system owner or CDX system personnel assigns milestones to the POA&Ms to identify the required activities for full remediation of the vulnerability within a specified time frame. Often, there are multiple milestones within a POA&M, and each milestone must be detailed and include a completion date. " Same as above. 11. "The Office of Information Security and Privacy rejectedfive Risk Determination Waiver requests for the CDX system because the waivers did not include a business justification and compensating or mitigating controls to reduce the risk from the system's deviation from existing EPA policies and procedures." Do not concur. Although these 5 Risk Determination Waivers were rejected it was not because a business justification was not provided. Currently, a Risk Determination Request can be submitted without including compensating or mitigating controls. 12. "Timely compliance with security requirements are necessary to, among other things, protect against potential unauthorized disclosure or modification of CDX information; yet, six of the 14 vulnerabilities had expired POA&M scheduled completion dates ranging from two weeks to 21 months. " Concur that Timely compliance with security requirements are necessary and that POA&Ms may have expired completion dates in XACTA. However, CDX has implemented many layers of compensating controls to reduce vulnerabilities being exploited. 13. "The CDX system continues to remain vulnerable to brute force attacks, which would allow a threat actor to gain unauthorized access to an account by guessing the password by attempting multiple combinations of passwords. " Do not concur. EPA has several mechanisms in place to detect and prevent brute force attacks. Specifically, CDX has more stringent controls than Agency procedures (CIO 2150-P-01.3) implemented on the system to lock accounts after 3 unsuccessful attempts (versus 5 per agency policy). "The Office of Information Security and Privacy is hindering the timely resolution of these vulnerabilities by failing to review these POA&Ms for 12 months. The Agency did not review and validate security Concur however the referenced procedure is not the latest document for POA&M Monitoring and Validation. The link enclosed provides the current guidance. 24-N-0024 10 ------- 14. documentation for two POA&Ms submitted by CDX system personnel for closure in June 2022 until June 2023 when the Office of Information Security and Privacy reviewed and updated the status of these POA&Ms. The POA&MMonitoring and Validation Standard Operating Procedure states that all corrective actions should be completed and appropriate security documentation is uploaded to the Agency Information Security Repository system prior to a POA&M closure." https://usepa.sharepoint.eom/:w:/s/oei_C ommunity/OISP/ERHzftywr5 lFr9V- FPe8h0AB SuenwHEDc Y s6xvXl YF4zs w 15. "Furthermore, we identified a similar issue in OIG Report No. 23-E-0021, The EPA 's Vulnerability Tracking and Remediation and Information Technology Procedures Review Processes Are Implemented Inconsistently, issued July 5, 2023. In that report, we recommended that the Agency (1) develop and implement a plan for prioritizing and scheduling the installation of patches that address vulnerabilities and (2) assign responsibilities including documenting associated POA&Ms in the Agency tracking system. These recommendations were resolved with corrective actions pending." Do not concur. OISP has implemented procedures to address the two recommendations With respect to item #1 the Information Security - Interim System and Information Integrity Procedures (Control SI-2 - Flaw Remediation, Item 2(b)) states that System Owners (SO) in coordination with others "Prioritize vulnerabilities and remediation actions based on the individual vulnerability criticality or severity ratings". With respect to item #2 the same procedure (Section 7 - Roles and Responsibilities) assigns responsibility to the System Owner (SO) "Manage and report flaw remediation to the SAISO through the POA&M process via the Agency's FISMA reporting and tracking tool." (sub-item 'g'). 16. Left uncorrected, the EPA 's network is more vulnerable to threat actors exploiting these vulnerabilities and gaining access to the CDX system and the environmental data relied upon by states, tribes, and other entities, as well as potential disclosure and modification of data for the 49 systems that are interconnected to the CDX system. " Do not concur. EPA has implemented numerous mitigating controls for these 14 vulnerabilities and is monitoring and tracking these vulnerabilities through the POA&M process. CDX has deployed cloud native tools that allow near real time remediation of vulnerabilities and are maturing our operations of these tools. Additionally, CDX's Software Development Life Cycle (SDLC) processes are evolving and increasing 24-N-0024 11 ------- cross collaboration throughout the delivery lifecycle to respond more quickly to findings/vulnerabilities. If you have any questions regarding this response, please contact Afreeka Wilson, Audit Follow-up Coordinator, of the Office of Resources and Business Operations, (202) 564-0867 or wilson.afreeka@epa.gov. Attachment: Technical Materials Cc: Tertia Allen Yoon An Troy Givens Nii-Lantei Lamptey Iantha Maness Christina Nelson Teresa Richardson Scott Sammons Michelle Wiker Erin Collard Austin Henderson David Alvarado Jennie Campbell Dwane Young Joe Carioti Tonya Manning Mark Bacharach Dan Coogan Marilyn Armstrong Susan Perkins OM S_Audit_C oordinati on@epa. gov 24-N-0024 12 ------- Whistleblower Protection U.S. Environmental Protection Agency The whistleblower protection coordinator's role is to educate Agency employees about prohibitions against retaliation for protected disclosures and the rights and remedies against retaliation. For more information, please visit the OIG's whistleblower protectioi webpage Contact us: Congressional Inquiries: OIG.CongressionalAffairs(5)epa.gov Media Inquiries: OIG.PublicAffairsffiepa.gov Tine EPA OIG Hotline: OIG.Hotline@epa.gov -erg- Web: epaoig.gov Follow us: ^ X (formerly Twitter): (5)epaoig (to) Linkedln: linkedin.com/company/epa-oig YouTube: voutube.com/epaoig [S] Instagram: @epa.ig,on,ig ------- |