GAO slams FBI on network security

WASHINGTON, May 25 (UPI) -- The FBI's internal network is not properly secured from unauthorized users, an assessment by the U.S. Government Accountability Office found.

Inadequate security mechanisms make the internal network used by the FBI exchange and transfer of sensitive information vulnerable to misuse or interruption, the GAO found, warning that the FBI's work could be compromised.

The FBI responded to the allegations on Thursday, saying that little in the GAO's report was new.

"The report omitted the fact that the FBI already has corrective action plans in place that proactively and aggressively address information security issues," a statement from the FBI said.

Among its report, the GAO found specifically that the FBI did not consistently configure security devices to identify and prevent unauthorized users from accessing the system or protect sensitive data on the networks; did not enforce the concept of "least privilege" to verify that authorized access was necessary; and did not protect the physical security of its internal network.

The GAO permits audited organizations to file a response to the allegations before the report is published, and comments from the FBI were included in the published report.

The FBI Chief Information Officer agreed with many of the GAO's recommendations, but said that "the bureau did not believe that it has placed sensitive information at an unacceptable risk."

The officer highlighted steps already in place to address the concerns "previously identified by the FBI through our own audits and internal controls," such as raising the number of its major systems that are accredited from 8 percent in 2002 to 100 percent today.

Asked by United Press International how long the FBI has been aware of these concerns about internal network security, spokesman Paul Bresson said, "We're always concerned about information security because of the nature of our work with criminal and terrorism investigations. It is critical for us to have robust safeguards in place to protect our information."