Information Security:

Federal Agencies Have Taken Steps to Secure Wireless Networks, but Further Actions Can Mitigate Risk

GAO-11-43: Published: Nov 30, 2010. Publicly Released: Nov 30, 2010.

Additional Materials:

Contact:

Gregory C. Wilshusen
(202) 512-6244
contact@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

Over the past several years, federal agencies have rapidly adopted the use of wireless technologies for their information systems. In a 2005 report, GAO recommended that the Office of Management and Budget (OMB), in its role overseeing governmentwide information security, take several steps to help agencies better secure their wireless networks. GAO was asked to update its prior report by (1) identifying leading practices and state-of-the-art technologies for deploying and monitoring secure wireless networks and (2) assessing agency efforts to secure wireless networks, including their vulnerability to attack. To do so, GAO reviewed publications, guidance, and other documentation and interviewed subject matter experts in wireless security. GAO also analyzed policies and plans and interviewed agency officials on wireless security at 24 major federal agencies and conducted additional detailed testing at these 5 agencies: the Departments of Agriculture, Commerce, Transportation, and Veterans Affairs, and the Social Security Administration.

GAO identified a range of leading security practices for deploying and monitoring secure wireless networks and technologies that can help secure these networks. The leading practices include the following: (1) comprehensive policies requiring secure encryption and establishing usage restrictions, implementation practices, and access controls; (2) a risk-based approach for wireless deployment and monitoring; (3) a centralized wireless management structure that is integrated with the management of the existing wired network; (4) configuration requirements for wireless networks and devices; (5) incorporation of wireless and mobile device security in training; (6) use of encryption, such as a virtual private network for remote access; (7) continuous monitoring for rogue access points and clients; and (8) regular assessments to ensure wireless networks are secure. Agencies have taken steps to secure their wireless networks, but more can be done to improve security and to limit vulnerability to attack. Specifically, application was inconsistent among the agencies for most of the following leading practices: (1) Most agencies developed policies to support federal guidelines and leading practices, but gaps existed, particularly with respect to dual-connected laptops and mobile devices taken on international travel. (2) All agencies required a risk-based approach for management of wireless technologies. (3) Many agencies used a decentralized structure for management of wireless, limiting the standardization that centralized management can provide. (4) The five agencies where GAO performed detailed testing generally securely configured wireless access points but had numerous weaknesses in laptop and smartphone configurations. (5) Most agencies were missing key elements related to wireless security in their security awareness training. (6) Twenty agencies required encryption, and eight of these agencies specified that a virtual private network must be used; four agencies did not require encryption for remote access. (7) Many agencies had insufficient practices for monitoring or conducting security assessments of their wireless networks. Existing governmentwide guidelines and oversight efforts do not fully address agency implementation of leading wireless security practices. Until agencies take steps to better implement these leading practices, and OMB takes steps to improve governmentwide oversight, wireless networks will remain at an increased vulnerability to attack.

Recommendations for Executive Action

  1. Status: Closed - Not Implemented

    Comments: As of September 15, 2015 the FISMA metrics do not contain specific metrics related to wireless security issues identified in this report.

    Recommendation: To improve governmentwide oversight of wireless security practices, the Director of OMB, in consultation with the Secretary of Homeland Security, should include metrics related to wireless security as part of the Federal Information Security Management Act (FISMA) reporting process.

    Agency Affected: Executive Office of the President: Office of Management and Budget

  2. Status: Closed - Implemented

    Comments: We verified that DHS developed the scope and specific time frames for activities that address wireless security as part of their reviews of agency cybersecurity programs.

    Recommendation: To improve governmentwide oversight of wireless security practices, the Director of OMB, in consultation with the Secretary of Homeland Security, should develop the scope and specific time frames for additional activities that address wireless security as part of their reviews of agency cybersecurity programs.

    Agency Affected: Executive Office of the President: Office of Management and Budget

  3. Status: Closed - Implemented

    Comments: We verified that Commerce instructed the Director of NIST to develop and issue guidelines in the following four areas:(1) technical steps agencies can take to mitigate the risk of dual connected laptops,(2) governmentwide secure configurations for wireless functionality on laptops and for smartphones such as BlackBerries,(3) appropriate ways agencies can centralize their management of wireless technologies based on business need, and(4) criteria for selection of tools and recommendations on appropriate frequencies of wireless security assessments and recommendations for when continuous monitoring of wireless networks may be appropriate.

    Recommendation: The Secretary of Commerce should instruct the Director of NIST to develop and issue guidelines in the following four areas: (1) technical steps agencies can take to mitigate the risk of dual connected laptops, (2) governmentwide secure configurations for wireless functionality on laptops and for smartphones such as BlackBerries, (3) appropriate ways agencies can centralize their management of wireless technologies based on business need, and (4) criteria for selection of tools and recommendations on appropriate frequencies of wireless security assessments and recommendations for when continuous monitoring of wireless networks may be appropriate.

    Agency Affected: Department of Commerce

 

Explore the full database of GAO's Open Recommendations »

Jun 14, 2018

May 14, 2018

Apr 24, 2018

Mar 7, 2018

Feb 6, 2018

Sep 28, 2017

Aug 3, 2017

Jul 27, 2017

Jul 26, 2017

May 31, 2017

Looking for more? Browse all our products here