Information Security: Federal Agency Efforts to Encrypt Sensitive
Information Are Under Way, but Work Remains (27-JUN-08, 	 
GAO-08-525).							 
                                                                 
Many federal operations are supported by automated systems that  
may contain sensitive information such as national security	 
information that, if lost or stolen, could be disclosed for	 
improper purposes. Compromises of sensitive information at	 
numerous federal agencies have raised concerns about the extent  
to which such information is vulnerable. The use of technological
controls such as encryption--the process of changing plaintext	 
into ciphertext--can help guard against the unauthorized	 
disclosure of sensitive information. GAO was asked to determine  
(1) how commercially available encryption technologies can help  
agencies protect sensitive information and reduce risks; (2) the 
federal laws, policies, and guidance for using encryption	 
technologies; and (3) the extent to which agencies have 	 
implemented, or plan to implement, encryption technologies. To	 
address these objectives, GAO identified and evaluated		 
commercially available encryption technologies, reviewed relevant
laws and guidance, and surveyed 24 major federal agencies.	 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-08-525 					        
    ACCNO:   A82599						        
  TITLE:     Information Security: Federal Agency Efforts to Encrypt  
Sensitive Information Are Under Way, but Work Remains		 
     DATE:   06/27/2008 
  SUBJECT:   Access control					 
	     Authentication					 
	     Classified defense information			 
	     Computer networks					 
	     Computer security					 
	     Confidential communication 			 
	     Data encryption					 
	     Data encryption standard				 
	     Data storage					 
	     Data transmission					 
	     Electronic data interchange			 
	     Government information dissemination		 
	     Information access 				 
	     Information disclosure				 
	     Information infrastructure 			 
	     Information management				 
	     Information security				 
	     Information security management			 
	     Information security regulations			 
	     Information storage and retrieval			 
	     Information technology				 
	     Internal controls					 
	     Laptops						 
	     Policy evaluation					 
	     Proprietary data					 
	     Regulatory agencies				 
	     Reporting requirements				 
	     Security policies					 
	     Security regulations				 
	     Software						 
	     Standards evaluation				 
	     Wireless networks					 
	     Policies and procedures				 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-08-525

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to [email protected]. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to Congressional Requesters: 

United States Government Accountability Office: 

GAO: 

June 2008: 

Information Security: 

Federal Agency Efforts to Encrypt Sensitive Information Are Under Way, 
but Work Remains: 

GAO-08-525: 

GAO Highlights: 

Highlights of GAO-08-525, a report to congressional requesters. 

Why GAO Did This Study: 

Many federal operations are supported by automated systems that may 
contain sensitive information such as national security information 
that, if lost or stolen, could be disclosed for improper purposes. 
Compromises of sensitive information at numerous federal agencies have 
raised concerns about the extent to which such information is 
vulnerable. The use of technological controls such as encryptionï¿½the 
process of changing plaintext into ciphertextï¿½can help guard against 
the unauthorized disclosure of sensitive information. GAO was asked to 
determine (1) how commercially available encryption technologies can 
help agencies protect sensitive information and reduce risks; (2) the 
federal laws, policies, and guidance for using encryption technologies; 
and (3) the extent to which agencies have implemented, or plan to 
implement, encryption technologies. To address these objectives, GAO 
identified and evaluated commercially available encryption 
technologies, reviewed relevant laws and guidance, and surveyed 24 
major federal agencies. 

What GAO Found: 

Commercially available encryption technologies can help federal 
agencies protect sensitive information that is stored on mobile 
computers and devices (such as laptop computers, handheld devices such 
as personal digital assistants, and portable media such as flash drives 
and CD-ROMs) as well as information that is transmitted over wired or 
wireless networks by reducing the risks of its unauthorized disclosure 
and modification. For example, information stored in individual files, 
folders, or entire hard drives can be encrypted. Encryption 
technologies can also be used to establish secure communication paths 
for protecting data transmitted over networks. While many products to 
encrypt data exist, implementing them incorrectly------such as failing 
to properly configure the product, secure encryption keys, or train 
users------can result in a false sense of security and render data 
permanently inaccessible. 

Key laws frame practices for information protection, while federal 
policies and guidance address the use of encryption. The Federal 
Information Security Management Act of 2002 mandates that agencies 
implement information security programs to protect agency information 
and systems. In addition, other laws provide guidance and direction for 
protecting specific types of information, including agency-specific 
information. For example, the Privacy Act of 1974 requires that 
agencies adequately protect personal information, and the Health 
Insurance Portability and Accountability Act of 1996 requires 
additional protections for sensitive health care information. The 
Office of Management and Budget has issued policy requiring federal 
agencies to encrypt all data on mobile computers and devices that carry 
agency data and use products that have been approved by the National 
Institute for Standards and Technology (NIST) cryptographic validation 
program. Further, NIST guidance recommends that agencies adequately 
plan for the selection, installation, configuration, and management of 
encryption technologies. 

The extent to which 24 major federal agencies reported that they have 
implemented encryption and developed plans to implement encryption of 
sensitive information varied across agencies. From July through 
September 2007, the major agencies collectively reported that they had 
not yet installed encryption technology to protect sensitive 
information on about 70 percent of their laptop computers and handheld 
devices. Additionally, agencies reported uncertainty regarding the 
applicability of OMBï¿½s encryption requirements for mobile devices, 
specifically portable media. While all agencies have initiated efforts 
to deploy encryption technologies, none had documented comprehensive 
plans to guide encryption implementation activities such as installing 
and configuring appropriate technologies in accordance with federal 
guidelines, developing and documenting policies and procedures for 
managing encryption technologies, and training users. As a result 
federal information may remain at increased risk of unauthorized 
disclosure, loss, and modification. 

What GAO Recommends: 

GAO is making recommendations to (1) the Director of the Office of 
Management and Budget (OMB) to clarify guidance and (2) selected 
agencies to strengthen practices for planning and implementing the use 
of encryption. In comments on a draft of this report, OMB and the 
agencies generally agreed with the recommendations. 

To view the full product, including the scope and methodology, click on 
GAO-08-525. For more information, contact Gregory C. Wilshusen at (202) 
512-6244 or [email protected]. 

[End of section] 

Contents: 

Letter: 

Results in Brief: 

Background: 

Commercially Available Encryption Technologies Can Help Agencies Reduce 
Risks: 

Key Laws Frame Practices for Information Protection, while Federal 
Policies and Guidance Address Use of Encryption: 

Efforts to Encrypt Sensitive Information Varied among Agencies: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments: 

Appendix I: Objectives, Scope, and Methodology: 

Appendix II: Important Considerations for Implementing Encryption to 
Effectively Reduce Agency Risks: 

Appendix III: Hindrances Faced by Agencies when Implementing 
Encryption: 

Appendix IV: GSA SmartBUY Program for Data-at-Rest Encryption Products: 

Appendix V: Comments from the Office of Management and Budget: 

Appendix VI: Comments from the Department of Education: 

Appendix VII: Comments from the Department of Housing and Urban 
Development: 

Appendix VIII: Comments from the Department of State: 

Appendix IX: Comments from the General Services Administration: 

Appendix X: Comments from the National Aeronautics and Space 
Administration: 

Appendix XI: GAO Contact and Staff Acknowledgments: 

Glossary: 

Tables: 

Table 1: Commercially Available Encryption Technologies: 

Table 2: Key Laws That Provide a Framework for Agencies to Use in 
Protecting Sensitive Information: 

Table 3: Major OMB Memorandums Related to the Use of Encryption: 

Table 4: Key NIST Publications for Implementing Encryption Technology: 

Table 5: Agency Policies and Procedures That Address NIST Encryption 
Controls: 

Table 6: Hindrances to Implementing Encryption at Federal Agencies: 

Table 7: Examples of Volume Discount Pricing Available through 
SmartBUY: 

Figures: 

Figure 1: Incidents Reported to US-CERT in Fiscal Years 2005 through 
2007: 

Figure 2 : Encryption and Decryption: 

Figure 3: Percentage of Encrypted Laptop Computers and Handheld 
Computing Devices at 24 Major Federal Agencies: 

Figure 4: Agency Status of Encrypting Sensitive Information Transmitted 
Over Wired and Wireless Networks: 

Abbreviations: 

CD-ROM: compact disc read only memory: 

DVD: digital versatile disc: 

FIPS: federal information processing standards: 

FISMA: Federal Information Security Management Act of 2002: 

GSA: General Services Administration: 

HUD: Department of Housing and Urban Development: 

IT: information technology: 

NASA: National Aeronautics and Space Administration: 

NIST: National Institute of Standards and Technology: 

OMB: Office of Management and Budget: 

PKI: public key infrastructures: 

SmartBUY: Software Managed and Acquired on the Right Terms: 

USB: universal serial bus: 

US-CERT: U.S. Computer Emergency Readiness Team: 

USDA: U.S. Department of Agriculture: 

United States Government Accountability Office: 

Washington, DC 20548: 

June 27, 2008: 

The Honorable Bennie G. Thompson: 
Chairman: 
Committee on Homeland Security: 
House of Representatives: 

The Honorable Jane Harman: 
Chairwoman: 
Subcommittee on Intelligence, Information Sharing and Terrorism Risk 
Assessment: 
Committee on Homeland Security: 
House of Representatives: 

The Honorable Zoe Lofgren: 
House of Representatives: 

In 2006, the Department of Veterans Affairs reported that a laptop 
computer and external hard drive--that had not been encrypted or 
password protected and that contained the personal information of 
approximately 26.5 million veterans and United States military 
personnel--had been stolen from an employee's home. This incident and 
the increasing number of data breaches reported by other government 
agencies--such as the Departments of Defense and Health and Human 
Services and the Transportation Security Administration--have raised 
concerns about the extent to which sensitive information maintained by 
the federal government is vulnerable and what current laws, policies, 
and practices are in place to protect that information.[Footnote 1] 

In June 2006, GAO testified that federal agencies should consider the 
use of encryption technologies to improve their ability to protect 
information from improper disclosure,[Footnote 2] particularly when 
data must be stored on mobile computers and devices such as laptop 
computers, handheld personal digital assistants, and portable media 
such as flash drives and CD-ROMs. Encryption protects data through a 
process of transforming ordinary data (commonly referred to as 
plaintext) into code form (ciphertext) using a special value known as a 
key and a mathematical process called an algorithm.[Footnote 3] 
Encryption technologies include commercially available products (such 
as hardware or software) that create the capability to encrypt data. 

In response to your request, our objectives were to determine (1) how 
commercially available encryption technologies could help federal 
agencies protect sensitive information and reduce risks; (2) the 
federal laws, policies, and guidance for using encryption technologies 
to protect sensitive information; and (3) the extent to which agencies 
have implemented, or planned to implement, encryption technologies to 
protect sensitive information. 

To address these objectives, we identified commercially available 
encryption technologies by reviewing prior GAO reports on technology, 
researching products approved by the National Institute of Standards 
and Technology (NIST), and interviewing NIST encryption experts. We 
also reviewed relevant laws, policies, and guidance to identify the 
mandatory and optional practices for protecting sensitive information 
(including personally identifiable information[Footnote 4]) that 
federal agencies collect and handle. In addition, we surveyed 24 major 
federal agencies and examined supporting documentation regarding agency 
efforts to implement encryption.[Footnote 5] We also examined 
encryption practices at six of these agencies to determine whether 
these practices met federal requirements for installation and 
configuration of Federal Information Processing Standards (FIPS)- 
validated cryptographic modules, encryption products, and associated 
management controls. We conducted this performance audit from February 
2007 through June 2008 in accordance with generally accepted government 
auditing standards. These standards require that we plan and perform 
the audit to obtain sufficient, appropriate evidence to provide a 
reasonable basis for our findings and conclusions based on our audit 
objectives. We believe that the evidence obtained provides a reasonable 
basis for our findings and conclusions based on our audit objectives. 
Appendix I contains additional details on the objectives, scope, and 
methodology of our review. 

Results in Brief: 

Many types of commercially available encryption technologies can help 
federal agencies protect sensitive information and reduce the risks to 
the sensitive data stored on agency equipment or transmitted across a 
network. Data stored in individual files, folders, or entire drives can 
be encrypted when not in use. Types of technologies to protect stored 
data include full disk encryption, hardware-based encryption, and file, 
folder, or virtual disk encryption. In addition, encryption 
technologies can be used to establish secure communication paths for 
protecting data transmitted over networks through the use of virtual 
private networks and digital certificates. While many technologies to 
encrypt data exist, implementing them incorrectly--such as failing to 
properly configure the product, secure encryption keys, or train users-
-can create a false sense of security and even render data permanently 
inaccessible. 

Although key federal laws do not specifically address the use of 
encryption, they provide a framework of information protection 
activities and direct the Office of Management and Budget (OMB) and 
NIST to develop policies, standards, and guidance for federal agencies 
to use in implementing technologies, such as encryption, to protect 
sensitive information. Among these laws is the Federal Information 
Security Management Act of 2002 (FISMA), which mandates that agencies 
implement information security programs to protect agency information 
and systems. In addition, the Privacy Act of 1974 requires that 
agencies adequately protect personal information maintained in federal 
systems of records,[Footnote 6] and the Health Insurance Portability 
and Accountability Act of 1996 addresses the protection of personal 
medical information. To specifically direct agencies' use of 
encryption, OMB issued a policy in 2006 recommending, and in 2007 
requiring, that all agencies encrypt all data on mobile computers and 
devices that carry sensitive agency data and also reinforced the long- 
standing requirement that agencies use products that have been approved 
by NIST's cryptographic module validation program. Further, NIST has 
published guidelines for federal agencies to use in planning and 
implementing encryption technologies; these guidelines address the 
documentation of comprehensive implementation plans; the installation 
and configuration of selected encryption technologies, policies and 
procedures for managing encryption; and user training. 

The extent to which 24 major federal agencies reported that they have 
implemented encryption and to which they have developed plans to 
implement encryption varied across the agencies. While all agencies had 
initiated efforts to encrypt sensitive agency information, the 
encryption of information stored on mobile devices lagged behind 
efforts to encrypt information transmitted over networks. For example, 
overall, agencies reported in July through September 2007 that they had 
not yet installed encryption software on about 70 percent of their 
laptop computers and handheld mobile computing devices combined. 
Although progress was under way at agencies governmentwide, agencies 
reported uncertainty regarding the applicability of OMB's encryption 
requirements. In addition, none of the agencies had documented 
comprehensive plans to guide encryption implementation activities, such 
as inventorying information to determine encryption needs; documenting 
how the agency plans to select, install, configure, and monitor 
encryption technologies; developing and documenting encryption policies 
and procedures; and training personnel in the use of installed 
encryption. Further, our tests at 6 selected agencies revealed 
weaknesses in the encryption implementation practices involving the 
installation and configuration of FIPS-validated cryptographic modules, 
encryption products, monitoring the effectiveness of installed 
encryption technologies, the development and documentation of policies 
and procedures for managing these technologies, and training of 
personnel in the proper use of installed encryption products. As a 
result of these weaknesses, federal information may remain at increased 
risk of unauthorized disclosure, loss, and modification. 

We are recommending that OMB clarify governmentwide encryption policy 
to address agency efforts to plan for and implement encryption 
technologies. We are also making recommendations to selected agencies 
to properly install and configure FIPS-compliant encryption 
technologies, to develop policies and procedures to manage encryption, 
and to provide encryption training to personnel. 

We obtained written comments on a draft of this report from OMB, the 
Departments of Education, Housing and Urban Development, and State, as 
well as the General Services Administration and the National 
Aeronautics and Space Administration; these comments are reproduced in 
appendixes V to X, respectively. We also obtained comments from the 
Department of Agriculture via e-mail. OMB generally agreed with the 
report's contents and stated that it would carefully consider our 
recommendations. The other six agencies also agreed with the report's 
findings and recommendations. In addition, NIST and the Social Security 
Administration provided technical comments, which we have incorporated 
as appropriate. 

Background: 

Virtually all federal operations are supported by automated systems, 
mobile devices, and electronic media that may contain sensitive 
information such as Social Security numbers, medical records, law 
enforcement data, national or homeland security information, and 
proprietary information that could be inappropriately disclosed, 
browsed, or copied for improper or criminal purposes. 

In our survey of 24 major federal agencies, 10 agencies reported having 
systems that contain sensitive medical information, 16 reported having 
systems that contain sensitive regulatory information, 19 reported 
having systems that contain sensitive personal information, and 20 
reported having systems that contain sensitive program-specific 
information. It is important for agencies to safeguard sensitive 
information because, if left unprotected, the information could be 
compromised--leading to loss or theft of resources (such as federal 
payments and collections), modification or destruction of data, or 
unauthorized use of computer resources, including launching attacks on 
other computer systems. 

Factors Placing Sensitive Information at Risk: 

Many factors can threaten the confidentiality, integrity, and 
availability of sensitive information. Cyber threats to federal systems 
and critical infrastructures containing sensitive information can be 
intentional or unintentional, targeted or nontargeted, and can come 
from a variety of sources.[Footnote 7] Intentional threats include both 
targeted and nontargeted attacks. A targeted attack occurs when a group 
or individual specifically attacks an information system. A nontargeted 
attack occurs when the intended target of the attack is uncertain, such 
as when a virus, worm, or malware is released on the Internet with no 
specific target. Unintentional threats can be caused by software 
upgrades or maintenance procedures that inadvertently disrupt systems. 

The Federal Bureau of Investigation has identified multiple sources of 
threats to our nation's critical information systems, including those 
from foreign nation states engaged in information warfare, domestic 
criminals, hackers, virus writers, and disgruntled current and former 
employees working within an organization. There is increasing concern 
among both government officials and industry experts regarding the 
potential for a cyber attack. According to the Director of National 
Intelligence, ''our information infrastructure--including the Internet, 
telecommunications networks, computer systems, and embedded processors 
and controllers in critical industries--increasingly is being targeted 
for exploitation and potentially for disruption or destruction by a 
growing array of state and non-state adversaries. Over the past year, 
cyber exploitation activity has grown more sophisticated, more 
targeted, and more serious. The intelligence community expects these 
trends to continue in the coming year."[Footnote 8] 

Threats to mobile devices are posed by people with malicious 
intentions, including causing mischief and disruption as well as 
committing identity theft and other forms of fraud. For example, 
malware threats can infect data stored on devices, and data in transit 
can be intercepted through many means, including from e-mail, Web 
sites, file downloads, file sharing, peer-to-peer software, and instant 
messaging. Another threat to mobile devices is the loss or theft of the 
device. Someone who has physical access to an electronic device can 
attempt to view the information stored on it. 

Incidents at Federal Agencies Demonstrate That Sensitive Information Is 
at Risk: 

Examples of Data Breaches at Federal Agencies: 

Defense: 
February 2008: 

A laptop computer containing personally identifiable information for 
as many as 4,000 participants in the Marine Corps community services' 
New Parent Support Program was stolen. 

Energy: 

December 2007: 

A hacker gained access to an Energy computer by embedding a program,
in an e-mail sent to staff, that allowed the hacker to copy and retrieve
information. 

Transportation Security Administration: 

May 2007: 

An external hard drive, discovered missing from a controlled area at 
agency headquarters human capital office, contained personal data for
100,000 archived employment records of individuals employed by the 
agency from January 2002 until August 2005. 

Source: GAO based on agency-reported incidents.

[End of figure] 

The need for effective information security policies and practices is 
further illustrated by the increasing number of security incidents 
reported by federal agencies that put sensitive information at risk. 
Personally identifiable information about millions of Americans has 
been lost, stolen, or improperly disclosed, thereby potentially 
exposing those individuals to loss of privacy, identity theft, and 
financial crimes. Reported attacks and unintentional incidents 
involving critical infrastructure systems demonstrate that a serious 
attack could be devastating. Agencies have experienced a wide range of 
incidents involving data loss or theft, computer intrusions, and 
privacy breaches, underscoring the need for improved security 
practices. 

When incidents occur, agencies are to notify the federal information 
security incident center--the U.S. Computer Emergency Readiness Team 
(US-CERT). As shown in figure 1, the number of incidents reported by 
federal agencies to US-CERT has increased dramatically over the past 3 
years, increasing from 3,634 incidents reported in fiscal year 2005 to 
13,029 incidents in fiscal year 2007 (about a 259 percent increase). 

Figure 1: Incidents Reported to US-CERT in Fiscal Years 2005 through 
2007: 

This figure is a vertical bar graph is showing incidents reported to US-
CERT in fiscal years 2005 through 2007. The X axis represents the 
fiscal year, and the Y axis represents the number of incidents 
reported. 

Year: FY05; 
Number of incidents: 3,634. 

Year: FY06; 
Number of incidents: 5,503. 

Year: FY07; 
Number of incidents: 13,029. 

[See PDF for image] 

Source: GAO analysis of US-CERT data. 

[End of figure] 

Data breaches present federal agencies with potentially serious and 
expensive consequences; for example, a security breach might require an 
agency to fund the burdensome costs of notifying affected individuals 
and associated credit monitoring services or it could jeopardize the 
agency's mission. Implementation of a risk-based framework of 
management, operational, and technical controls that includes controls 
such as encryption technology can help guard against the inadvertent 
compromise of sensitive information. While encrypting data might add to 
operational burdens by requiring individuals to enter pass codes or use 
other means to encrypt and decrypt data, it can also help to mitigate 
the risk associated with the theft or loss of computer equipment that 
contains sensitive data. 

Workforce Mobility Introduces Additional Risks to Sensitive 
Information: 

Protecting information has become more challenging in today's IT 
environment of highly mobile workers and decreasing device size. Using 
small, easily pilferable devices such as laptop computers, handheld 
personal digital assistants, thumb-sized Universal Serial Bus (USB) 
flash drives, and portable electronic media such as CD-ROMs and DVDs, 
employees can access their agency's systems and information from 
anywhere. When computers were larger and stationary, sensitive 
information that was stored on mainframe computers was accessible by 
only a limited number of authorized personnel via terminals that were 
secured within the physical boundaries of the agency's facility. Now, 
mobile workers can process, transport, and transmit sensitive 
information anywhere they work. This transition from a stationary 
environment to a mobile one has changed the type of controls needed to 
protect the information.[Footnote 9] Encryption technologies, among 
other controls, provide agencies with an alternate method of protecting 
sensitive information that compensates for the protections offered by 
the physical security controls of an agency facility when the 
information is removed from, or accessed from, outside of the agency 
location. 

Encryption Can Help Protect Sensitive Information: 

Data breaches can be reduced through the use of encryption, which is 
the process of transforming plaintext into ciphertext using a special 
value known as a key and a mathematical process called an algorithm 
(see fig. 2). 

Figure 2: Encryption and Decryption: 

This figure is a visual diagram of encryption and decryption. 

Plaintext; 
Key Encryption; 
Ciphertext; 
Key Decryption; 
Original plaintext. 

[See PDF for image] 

Source: GAO analysis. 

[End of figure] 

Cryptographic algorithms are designed to produce ciphertext that is 
unintelligible to unauthorized users. Decryption of ciphertext-- 
returning the encoded data to plaintext--is possible by using the 
proper key. Encryption can protect sensitive information in storage and 
during transmission. Encryption of data in transit hides information as 
it moves, for example, between a database and a computing device over 
the Internet, local networks, or via fax or wireless networks. Stored 
data include data stored in files or databases, for example, on a 
personal digital assistant, a laptop computer, a file server, a DVD, or 
a network storage appliance. Encryption may also be used in system 
interconnection devices such as routers, switches, firewalls, servers, 
and computer workstations to apply the appropriate level of encryption 
required for data that pass through the interconnection.[Footnote 10] 

Commercially Available Encryption Technologies Can Help Agencies Reduce 
Risks: 

Commercially available encryption technologies can help federal 
agencies protect sensitive information and reduce the risks of its 
unauthorized disclosure and modification. These technologies have been 
designed to protect information stored on computing devices or other 
media and transmitted over wired or wireless networks. 

Because the capability of each type of encryption technology to protect 
information is limited by the boundaries of the file, folder, drive, or 
network covered by that type of technology, a combination of several 
technologies may be required to ensure that sensitive information is 
continuously protected as it flows from one point, such as a remote 
mobile device, to another point, such as a network or portable 
electronic media. For example, one product that encrypts a laptop's 
hard drive may not provide any protection for files copied to portable 
media, attached to an e-mail, or transmitted over a network. 

Encryption Technologies to Protect Stored Information Are Available: 

Agencies have several options available when selecting an encryption 
technology for protecting stored data. According to NIST guidance on 
encrypting stored information,[Footnote 11] these include full disk, 
hardware-based, file, folder, or virtual disk encryption. Through the 
use of these technologies, encryption can be applied granularly, to an 
individual file that contains sensitive information, or broadly, by 
encrypting an entire hard drive. The appropriate encryption technology 
for a particular situation depends primarily on the type of storage, 
the amount of information that needs to be protected, and the threats 
that need to be mitigated. Storage encryption technologies require 
users to authenticate successfully before accessing the information 
that has been encrypted. The combination of encryption and 
authentication controls access to the stored information. 

Full Disk Encryption: 

Full disk encryption software encrypts all data on the hard drive used 
to boot a computer, including the computer's operating system, and 
permits access to the data only after successful authentication to the 
full disk encryption software. The majority of current full disk 
encryption products are implemented entirely within a software 
application. The software encrypts all information stored on the hard 
drive and installs a special environment to authenticate the user and 
begin decrypting the drive. Users enter their user identification and 
password before decrypting and starting the operating system. Once a 
user authenticates to the operating system by logging in, the user can 
access the encrypted files without further authentication, so the 
security of the solution is heavily dependent on the strength of the 
operating system authenticator. 

When a computer is turned off, all the information encrypted by full 
disk encryption is protected, assuming that pre-boot authentication is 
required. After the computer is booted, full disk encryption provides 
no protection and the operating system becomes fully responsible for 
protecting the unencrypted information. 

Hardware-Based Encryption: 

Full disk encryption can also be built into a hard drive. Hardware and 
software-based full disk encryption offer similar capabilities through 
different mechanisms. When a user tries to boot a device protected with 
hardware-based full disk encryption, the hard drive prompts the user to 
authenticate before it allows an operating system to load. The full 
disk encryption capability is built into the hardware in such a way 
that it cannot be disabled or removed from the drive. The encryption 
code and authenticators, such as passwords and cryptographic 
keys,[Footnote 12] are stored securely on the hard drive. Because the 
encryption and decryption are performed by the hard drive itself, 
without any operating system participation, typically there is very 
little performance impact. 

A major difference between software-and hardware-based full disk 
encryption is that software-based full disk encryption can be centrally 
managed, but hardware-based full disk encryption can usually be managed 
only locally. This makes key management and recovery actions 
considerably more resource-intensive and cumbersome for hardware-based 
full disk encryption than for software-based. Another major difference 
is that because hardware-based full disk encryption performs all 
cryptographic processing within the hard drive's hardware, it does not 
need to place its cryptographic keys in the computer's memory, 
potentially exposing the keys to malware and other threats. A third 
significant difference is that hardware-based full disk encryption does 
not cause conflicts with software that modifies the master boot record, 
for example, software that allows the use of more than one operating 
system on a hard drive. 

File, Folder, and Virtual Disk Encryption: 

File, folder, and virtual disk encryption are all used to encrypt 
specified areas of data on a storage medium such as a laptop hard 
drive. File encryption encrypts files, a collection of information 
logically grouped into a single entity and referenced by a unique name, 
such as a file name. Folder encryption encrypts folders, a type of 
organizational structure used to group files. Virtual disk encryption 
encrypts a special type of file--called a container--that is used to 
encompass and protect other files. 

File encryption is the process of encrypting individual files on a 
storage medium and permitting access to the encrypted data only after 
proper authentication is provided. Folder encryption is very similar to 
file encryption, except that it addresses individual folders instead of 
files. Some operating systems offer built-in file and/or folder 
encryption capabilities, and many third-party programs are also 
commercially available. File/folder encryption does not provide any 
protection for data outside the protected files or folders such as 
unencrypted temporary files that may contain the contents of any 
unencrypted files being held in computer memory. 

Virtual disk encryption is the process of encrypting a container. The 
container appears as a single file but can hold many files and folders 
that are not seen until the container is decrypted. Access to the data 
within the container is permitted only after proper authentication is 
provided, at which point the container appears as a logical disk drive 
that may contain many files and folders. Virtual disk encryption does 
not provide any protection for data created outside the protected 
container, such as unencrypted temporary files, that could contain the 
contents of any unencrypted files being held in computer memory. 

Agency Information Can Be Encrypted while in Transit over a Network: 

Sensitive data are also at risk during transmission across unsecured-- 
untrusted--networks such as the Internet. For example, as reported by 
NIST,[Footnote 13] transmission of e-mail containing sensitive 
information or direct connections for the purpose of processing 
information between a mobile device and an internal trusted system can 
expose sensitive agency data to monitoring or interception. According 
to both NIST[Footnote 14] and an industry source,[Footnote 15] agencies 
can use commercially available encryption technologies such as virtual 
private networks and digital signatures to encrypt sensitive data while 
they are in transit over a wired or wireless network. 

Virtual Private Networks: 

According to NIST,[Footnote 16] a virtual private network is a data 
network that enables two or more parties to communicate securely across 
a public network by creating a private connection, or "tunnel," between 
them. Because a virtual private network can be used over existing 
networks such as the Internet, it can facilitate the secure transfer of 
sensitive data across public networks. Virtual private networks can 
also be used to provide a secure communication mechanism for sensitive 
data such as Web-based electronic transactions and to provide secure 
remote access to an organization's resources. 

Digital Signatures and Digital Certificates: 

Properly implemented digital signature technology uses public key 
cryptography to provide authentication, data integrity, and 
nonrepudiation for a message or transaction. As NIST states,[Footnote 
17] public key infrastructures[Footnote 18] (PKI) can be used not only 
to encrypt data but also to authenticate the identity of specific 
users. Just as a physical signature provides assurance that a letter 
has been written by a specific person, a digital signature is an 
electronic credential created using a party's private key with an 
encryption algorithm.[Footnote 19] When it is added to a document, it 
can be used to confirm the identity of a document's sender since it 
also contains the user's public key and name of the encryption 
algorithm. Validating the digital signature not only confirms who 
signed it, but also ensures that there have been no alterations to the 
document since it was signed. 

Digital signatures may also be employed in authentication protocols to 
confirm the identity of the user before establishing a session. 
Specifically, digital signatures can be used to provide higher 
assurance authentication (in comparison with passwords) when 
establishing virtual private networks. 

Digital signatures are often used in conjunction with digital 
certificates. A digital certificate is an electronic credential that 
guarantees the association between a public key and a specific entity, 
such as a person or organization. As specified by NIST, the signature 
on the document can be validated by using the public key from the 
digital certificate issued to the signer. Validating the digital 
certificate, the system can confirm that the user's relationship to the 
organization is still valid. The most common use of digital 
certificates is to verify that a user sending a message is who he or 
she claims to be and to provide the receiver with a means to encode a 
reply. For example, an agency virtual private network could use these 
certificates to authenticate the identity of the user, verify that the 
key is still good, and that he or she is still employed by the agency. 

Encryption Technologies Available for Handheld Mobile Computing 
Devices: 

NIST guidance further states that encryption software can be used to 
protect the confidentiality of sensitive information stored on handheld 
mobile computing devices and mirrored on the desktop computer.[Footnote 
20] The information on the handheld's add-on backup storage modules can 
also be encrypted when not in use. This additional level of security 
can be added to provide an extra layer of defense, further protecting 
sensitive information stored on handheld devices. 

In addition, encryption technologies can protect data on handheld 
devices while the data are in transit. Users often subscribe to third- 
party wireless Internet service providers, which use untrusted 
networks; therefore, the handheld device would require virtual private 
network software and a supporting corporate system to create a secure 
communications tunnel to the agency. 

Table 1 describes the types of commercial encryption technologies 
available to agencies. 

Table 1: Commercially Available Encryption Technologies: 

Technology: Full disk encryption (software); 
Use: Stored data; 
Description: Full disk encryption software encrypts all data on the 
hard drive that is used first when a computer is turned on, including 
the computer's operating system, and permits access to the data only 
after successful authentication to the full disk encryption software. 

Technology: Hardware-based encryption; 
Use: Stored data; 
Description: Full disk encryption can also be built into a hard drive. 

Technology: File encryption; 
Use: Stored data; 
Description: File encryption is the process of encrypting individual 
files on a storage medium and permitting access to the encrypted data 
only after proper authentication is provided. 

Technology: Folder encryption; 
Use: Stored data; 
Description: Folder encryption is very similar to file encryption, only 
it addresses individual folders instead of files. 

Technology: Virtual disk encryption; 
Use: Stored data; 
Description: Virtual disk encryption is the process of encrypting a 
file called a container, which can hold many files and folders. Access 
to the data within the container is permitted only after proper 
authentication is provided. 

Technology: Virtual private networks; 
Use: Data in transit; 
Description: A virtual private network serves as an encrypted tunnel to 
provide a secure communications mechanism for data in transit between 
networks. 

Technology: Digital signatures and digital certificates; 
Use: Stored data and data in transit; 
Description: A digital signature is an electronic credential created 
using a party's private key with an encryption algorithm. A digital 
certificate is an electronic credential that guarantees the association 
between a public key and a specific entity. 

Technology: Handheld mobile computing devices; 
Use: Stored data and data in transit; 
Description: Commercial encryption technologies allow users to send and 
receive encrypted e-mail and access data wirelessly using secure NIST-
approved algorithms. Data stored on the handheld mobile computing 
devices (for example, e-mail messages, contacts, and appointments) can 
also be encrypted. 

Source: GAO analysis, Defense Information Systems Agency, Vendor 
Technical Overview, and NIST special publications. 

[End of table] 

While many technologies exist to protect data, implementing them 
incorrectly--such as failing to properly configure the product, secure 
encryption keys, or train users--can result in a false sense of 
security or even render data permanently inaccessible. See appendix II 
for a discussion of decisions agencies face and important 
considerations for effectively implementing encryption to reduce agency 
risks. 

Key Laws Frame Practices for Information Protection, while Federal 
Policies and Guidance Address Use of Encryption: 

Although federal laws do not specifically require agencies to encrypt 
sensitive information, they give federal agencies responsibilities for 
protecting it. Specifically, FISMA, included within the E-Government 
Act of 2002,[Footnote 21] provides a comprehensive framework for 
ensuring the effectiveness of information security controls over 
federal agency information and information systems. In addition, other 
laws frame practices for protecting specific types of sensitive 
information. OMB is responsible for establishing governmentwide 
policies and for providing guidance to agencies on how to implement the 
provisions of FISMA, the Privacy Act, and other federal information 
security and privacy laws. In the wake of recent security breaches 
involving personal data, OMB issued guidance in 2006 and 2007 
reiterating the requirements of these laws and guidance. In this 
guidance, OMB directed, among other things, that agencies encrypt data 
on mobile computers or devices and follow NIST security guidelines. In 
support of federal laws and policies, NIST provides federal agencies 
with planning and implementation guidance and mandatory standards for 
identifying and categorizing information types, and for selecting 
adequate controls based on risk, such as encryption, to protect 
sensitive information. 

Key Laws Provide Framework for Protecting Sensitive Information: 

Although federal laws do not specifically address the use of 
encryption, they provide a framework for agencies to use to protect 
their sensitive information. FISMA, which is Title III of the E- 
Government Act of 2002, emphasizes the need for federal agencies to 
develop, document, and implement programs using a risk-based approach 
to provide information security for the information and information 
systems that support their operations and assets. Its purposes include 
the following: 

* providing a comprehensive framework for ensuring the effectiveness of 
information security controls over information resources that support 
federal operations and assets; 

* recognizing the highly networked nature of the current federal 
computing environment and providing effective governmentwide management 
and oversight of the related information security risks, including 
coordination of information security efforts throughout the civilian, 
national security, and law enforcement communities; 

* providing for development and maintenance of minimum controls 
required to protect federal information and information systems; 

* acknowledging that commercially developed information security 
products offer advanced, dynamic, robust, and effective information 
security solutions, reflecting market solutions for the protection of 
critical information infrastructures important to the national defense 
and economic security of the nation that are designed, built, and 
operated by the private sector; and: 

* recognizing that the selection of specific technical hardware and 
software information security solutions should be left to individual 
agencies choosing from among commercially developed products. 

This act requires agencies to provide cost-effective controls to 
protect federal information and information systems from unauthorized 
access, use, disclosure, disruption, modification, or destruction, and 
it directs OMB and NIST to establish policies and standards to guide 
agency implementation of these controls, which may include the use of 
encryption. 

The E-Government Act of 2002 also strives to enhance protection for 
personal information in government information systems by requiring 
that agencies conduct privacy impact assessments. A privacy impact 
assessment is an analysis of how personal information is collected, 
stored, shared, and managed in a federal system. 

Additionally, the Privacy Act of 1974 regulates agencies' collection, 
use, and dissemination of personal information maintained in systems of 
records. In this regard, the Privacy Act requires agencies to establish 
appropriate administrative, technical, and physical safeguards to 
ensure the security and confidentiality of records and to protect 
against any threats or hazards to their security or integrity that 
could result in substantial harm, embarrassment, inconvenience, or 
unfairness to any individual on whom information is maintained. 

Congress has also passed laws requiring protection of sensitive 
information that are agency-specific or that target a specific type of 
information. These laws include the Health Insurance Portability and 
Accountability Act of 1996,[Footnote 22] which requires additional 
protections to sensitive health care information and the Veterans 
Benefits, Health Care, and Information Technology Act,[Footnote 23] 
enacted in December 2006, which establishes information technology 
security requirements for personally identifiable information that 
apply specifically to the Department of Veterans Affairs. 

Table 2 summarizes the laws that provide a framework for agencies to 
use in protecting sensitive information. 

Table 2: Key Laws That Provide a Framework for Agencies to Use in 
Protecting Sensitive Information: 

Law: Federal Information Security Management Act of 2002; 
Security elements: Governs information security in the federal 
government. Defines roles and responsibilities for OMB and NIST in 
developing federal policies and guidance. Also addresses the protection 
of sensitive information in the context of securing federal agency 
information and information systems. 

Law: E-Government Act of 2002; 
Security elements: Enhances protection of personal information in 
government information systems by requiring that agencies conduct 
privacy impact assessments. 

Law: The Privacy Act of 1974; 
Security elements: Places privacy restrictions on data collected by 
government agencies maintained in systems of records. Also requires 
agencies to secure and protect information using adequate technical and 
physical safeguards. 

Law: Health Insurance Portability and Accountability Act of 1996; 
Security elements: Requires privacy regulations that establish 
standards for protecting medical records and other personal health 
information of individuals. Resulting regulations include encryption as 
an addressable (not required) implementation specification. 

Law: Veterans Benefits, Health Care, and Information Technology Act of 
2006; 
Security elements: Authorizes information technology security 
requirements for personally identifiable information at the Department 
of Veterans Affairs, including the requirement to develop procedures 
for detecting, reporting, and responding to security incidents. 

Source: GAO analysis of key laws that frame protection of sensitive 
information. 

[End of table] 

OMB Policy Requires Encryption of Sensitive Government Information on 
Mobile Devices: 

OMB is responsible for establishing governmentwide policies and for 
providing guidance to agencies on how to implement the provisions of 
FISMA, the Privacy Act, and other federal information security and 
privacy laws. OMB policy expands on the risk-based information security 
program requirements of FISMA in its 2002 and 2004 guidance[Footnote 
24] and in the wake of recent security breaches involving personal 
data, outlines minimum practices for implementation of encryption 
required by federal agencies in guidance issued in 2006 and 2007. 
Specifically: 

* OMB memorandum M-04-04, E-Authentication Guidance for Federal 
Agencies, requires that agencies implement specific security controls 
recommended by NIST,[Footnote 25] including the use of approved 
cryptographic techniques for certain types of electronic transactions 
that require a specified level of protection. 

* OMB memorandum M-06-16, Protection of Sensitive Agency Information, 
recommends, among other things, that agencies encrypt all agency data 
on mobile computers and devices or obtain a waiver from the Deputy 
Secretary of the agency that the device does not contain sensitive 
information. The memorandum also recommends that agencies use a NIST 
checklist[Footnote 26] provided in the memorandum that states agencies 
should verify that information requiring protection is appropriately 
categorized and assigned an appropriate risk impact category. 

* OMB memorandum M-07-16, Safeguarding Against and Responding to the 
Breach of Personally Identifiable Information, restated the M-06-16 
recommendations as requirements, and also required the use of NIST- 
certified cryptographic modules. 

These OMB memorandums significant to the use of encryption are briefly 
described in table 3. 

Table 3: Major OMB Memorandums Related to the Use of Encryption: 

OMB memorandum: Reporting Instructions for the Government Information 
Security Reform Act and Updated Guidance on Security Plans of Action 
and Milestones, (M-02-09), July 2, 2002; 
Description: Requires that agencies document and track plans of actions 
and milestones necessary to implement security controls including the 
use of encryption if required. 

OMB memorandum: E-Authentication Guidance for Federal Agencies, (M-04- 
04), Dec. 16, 2003; 
Description: Requires agencies with systems using remote authentication 
to conduct electronic authentication risk assessments and select proper 
controls, including the use of cryptographic components, as recommended 
by NIST, to protect sensitive information on those systems. 

OMB memorandum: Protection of Sensitive Agency Information, (M-06-16), 
June 23, 2006; 
Description: Recommends that agencies encrypt all data on mobile 
computers/devices. 

OMB memorandum: Safeguarding Against and Responding to the Breach of 
Personally Identifiable Information, (M-07-16), May 22, 2007; 
Description: Restates the recommendations of OMB M-06-16 as 
requirements and requires that agencies use NIST-certified 
cryptographic modules in encryption efforts. 

Source: GAO analysis of OMB memorandums on encryption. 

[End of table] 

NIST Provides Guidance and Standards for Encryption Use: 

In support of federal laws and policies, NIST provides federal agencies 
with implementation guidance and mandatory standards for identifying 
and categorizing information types and for selecting adequate controls 
based on risk, such as encryption, to protect sensitive information. 
Specifically, NIST Special Publication 800-53 instructs agencies to 
follow the implementation guidance detailed in supplemental NIST 
publications, including the following:[Footnote 27] 

* NIST Special Publication 800-21, Guideline for Implementing 
Cryptography in the Federal Government, guides the implementation of 
encryption by agencies. It recommends that prior to selecting a 
cryptographic method, or combination of methods, agencies address 
several implementation considerations when formulating an approach and 
developing requirements for integrating cryptographic methods into new 
or existing systems, including installing and configuring appropriate 
cryptographic components associated with selected encryption 
technologies; monitoring the continued effectiveness and functioning of 
encryption technologies; developing policies and procedures for life 
cycle management of cryptographic components (such as procedures for 
management of encryption keys, backup and restoration of services, and 
authentication techniques); and training users, operators, and system 
engineers. 

* Special Publication 800-57, Recommendation for Key Management, 
provides guidance to federal agencies on how to select and implement 
cryptographic controls for protecting sensitive information by 
describing cryptographic algorithms, classifying different types of 
keys used in encryption, and providing information on key management. 

* Special Publication 800-60, Guide for Mapping Types of Information 
and Information Systems to Security Categories, provides implementation 
guidance on the assignment of security categories to information and 
information systems using FIPS 199.[Footnote 28] 

* Special Publication 800-63, Electronic Authentication Guideline, 
addresses criteria for implementing controls that correspond to the 
assurance levels of OMB memorandum M-04-04 such that, if agencies 
assign a level 2, 3, or 4 to an electronic transaction, they are 
required to implement specific security controls, including the use of 
approved cryptographic techniques. 

* Special Publication 800-77, Guide to IPsec VPNs, provides technical 
guidance to agencies in the implementation of virtual private networks, 
such as identifying needs and designing, deploying, and managing the 
appropriate solution, including the use of Federal Information 
Processing Standards (FIPS)-compliant encryption algorithms. 

NIST also issues FIPS, which frame the critical elements agencies are 
required to follow to protect sensitive information and information 
systems. Specifically: 

* FIPS 140-2, Security Requirements for Cryptographic Modules.[Footnote 
29] Agencies are required to encrypt agency data, where appropriate, 
using NIST-certified cryptographic modules.[Footnote 30] This standard 
specifies the security requirements for a cryptographic module used 
within a security system protecting sensitive information in computer 
and telecommunication systems (including voice systems) and provides 
four increasing, qualitative levels of security intended to cover a 
wide range of potential applications and environments. 

* Several standards describe the technical specifications for 
cryptographic algorithms, including those required when using digital 
signatures.[Footnote 31] 

* FIPS 199 provides agencies with criteria to identify and categorize 
all of their information and information systems based on the 
objectives of providing appropriate levels of information security 
according to a range of risk levels.[Footnote 32] 

* FIPS 200 requires a baseline of minimum information security controls 
for protecting the confidentiality, integrity, and availability of 
federal information systems and the information processed, stored, and 
transmitted by those systems.[Footnote 33] FIPS 200 directs agencies to 
implement the baseline control recommendations of NIST Special 
Publication 800-53. The following security-related areas in FIPS 200 
whose controls are further detailed in Special Publication 800-53 
pertain to the use of encryption: 

- Access control--describes controls for developing and enforcing 
policies and procedures for access control including remote access, 
wireless access, and for portable and mobile devices using mechanisms 
such as authentication and encryption. 

- Contingency planning--includes controls to ensure that the 
organization protects system backup information from unauthorized 
modification by employing appropriate mechanisms such as digital 
signatures. 

- Identification and authentication--describes controls for developing 
and documenting identification and authentication policies and 
procedures. 

* Maintenance--includes remote maintenance control that addresses how 
an organization approves, controls, and monitors remotely executed 
maintenance and diagnostic activities including using encryption and 
decryption of diagnostic communications. 

* Media protection--describes developing policies and procedures for 
media protection including media storage (which may include encrypting 
stored data) and transport. 

* System and communications protection--includes controls to ensure the 
integrity and confidentiality of information in transit by employing 
cryptographic mechanisms if required, including establishing and 
managing cryptographic keys. 

NIST publications pertaining to the use of encryption in federal 
agencies are briefly described in table 4. 

Table 4: Key NIST Publications for Implementing Encryption Technology: 

NIST publication: Guideline for Implementing Cryptography In the 
Federal Government (Special Publication 800-21); 
Description: Directs agencies on how to select and implement 
cryptographic controls for protecting sensitive information. 

NIST publication: Recommended Security Controls for Federal Information 
Systems (Special Publication 800-53, Revision 2); 
Description: Recommends that agencies select and specify security 
controls for information systems, including controls for implementing 
cryptographic components. 

NIST publication: Recommendation for Key Management (Special 
Publication 800-57); 
Description: Recommends technical guidance to agencies in the proper 
management and protection of cryptographic keys and the information 
associated with the keys. 

NIST publication: Guide for Mapping Types of Information and 
Information Systems to Security Categories (Special Publication 800-60, 
Revision 1); 
Description: Directs agencies to categorize information and information 
systems, helping agencies determine their needs for encryption. 

NIST publication: Electronic Authentication Guideline (Special 
Publication 800-63); 
Description: Directs agencies to properly implement electronic 
authentication,[A] including use of cryptographic components where 
required by the level of electronic authentication assurance. 

NIST publication: Guide to IPsec VPNs (Special Publication 800-77); 
Description: Directs agencies to properly implement virtual private 
networks, such as with the use of FIPS-compliant encryption algorithms. 

NIST publication: Security Requirements for Cryptographic Modules (FIPS 
140-2); 
Description: Requires agencies to employ this standard when designing 
and implementing cryptographic modules that federal agencies operate or 
are operated for them under contract. 

NIST publication: Secure Hash Standard (FIPS 180-2); 
Description: Mandates that agencies implement this standard whenever a 
secure hash algorithm is required for federal applications, including 
use by other cryptographic algorithms and protocols. 

NIST publication: Digital Signature Standard (FIPS 186-3); 
Description: Requires agencies to use this standard when designing and 
implementing public key-based signatures systems. 

NIST publication: Advanced Encryption Standard (FIPS 197); 
Description: Requires use of this or other FIPS-compliant cryptographic 
algorithms when an agency determines that sensitive (unclassified) 
information requires cryptographic protection. 

NIST publication: Standards for Security Categorization of Federal 
Information and Information Systems (FIPS 199); 
Description: Requires agencies to use risk-based criteria for the 
security categorization of information and information systems, helping 
agencies determine their needs for encryption. 

NIST publication: Minimum Security Requirements for Federal Information 
and Information Systems (FIPS 200); 
Description: Requires agencies to select and implement minimum 
information security controls based on risk. 

Source: GAO analysis of NIST publications. 

[A] The process of electronically establishing confidence in a user's 
identity. 

[End of table] 

Efforts to Encrypt Sensitive Information Varied among Agencies: 

The extent to which 24 major federal agencies reported that they had 
implemented encryption and developed plans to implement encryption 
varied across agencies. Although all agencies had initiated efforts to 
encrypt stored and transmitted sensitive agency information, none had 
completed these efforts or developed and documented comprehensive plans 
to guide their implementation of encryption technologies. Our tests at 
6 selected agencies revealed weaknesses in the encryption 
implementation practices involving the installation and configuration 
of FIPS-validated cryptographic modules encryption products, monitoring 
the effectiveness of installed encryption technologies, the development 
and documentation of policies and procedures for managing these 
technologies, and the training of personnel in the proper use of 
installed encryption products. As a result of these weaknesses, federal 
information may remain at increased risk of unauthorized disclosure, 
loss, and modification. 

Reported Efforts to Encrypt Stored Information Lagged behind Efforts to 
Encrypt Transmitted Information: 

All 24 major federal agencies reported varying degrees of progress in 
their efforts to encrypt stored and transmitted sensitive agency 
information. While most of the agencies reported that they had not 
completed efforts to encrypt stored sensitive information, they 
reported being further along with efforts to encrypt transmitted 
sensitive information. Preparing for the implementation of encryption 
technologies involves numerous considerations. In response to our 
survey, agencies reported that they had encountered challenges that 
hinder the implementation of encryption. See appendix III for a 
discussion of the hindrances identified by agencies. 

Few Agencies Have Encrypted All Sensitive Information Stored on Mobile 
Devices: 

OMB requires agencies to encrypt all agency data on mobile computers 
and devices or obtain a waiver from the Deputy Secretary of the agency 
stating that the device does not contain sensitive information. Of 24 
agencies that reported from July through September 2007 on the status 
of their efforts to encrypt sensitive information stored on their 
laptops and handheld mobile devices, 8 agencies reported having 
encrypted information on less than 20 percent of these devices and 5 
agencies reported having encrypted information on between 20 and 39 
percent of these devices (see fig. 3). Overall, the 24 agencies 
reported that about 70 percent of laptop computers and handheld devices 
had not been encrypted. 

Figure 3: Percentage of Encrypted Laptop Computers and Handheld 
Computing Devices at 24 Major Federal Agencies: 

This figure is a bar graph showing the percentage of encrypted laptop 
computers and handheld computing devices at 24 major federal agencies. 
The X axis is the percentage encrypted. 

Number of agencies: 0-19; 
Percentage encrypted: 8. 

Number of agencies: 20-39; 
Percentage encrypted: 5. 

Number of agencies: 40-59; 
Percentage encrypted: 2. 

Number of agencies: 60-79; 
Percentage encrypted: 3. 

Number of agencies: 80-100; 
Percentage encrypted: 6. 

[See PDF for image] 

Source: GAO analysis of agency-supplied data. 

[End of figure] 

In addition, 10 of 22 agencies reported having encrypted information on 
less than 20 percent of portable storage media taken offsite, and 3 of 
22 reported having encrypted between 20 and 39 percent. Further, 9 of 
17 agencies reported encrypting sensitive information on less than 20 
percent of offsite backup storage media. However, while agencies were 
encrypting sensitive data on mobile computers and devices such as 
laptop computers and handheld devices (e.g. personal digital 
assistants), 6 agencies reported having other storage devices, such as 
portable storage media, that could contain sensitive data. Of the 6 
agencies, 4 had not encrypted these additional devices. Further, 
officials at 1 agency had no plans to encrypt sensitive data contained 
on their portable media. 

In response to our query in April 2008, OMB officials stated that the 
term "mobile computers and devices" was intended to include all agency 
laptops, handheld devices, and portable storage devices such as 
portable drives and CD-ROMs that contain agency data. Nevertheless, 
this description is not clear in any of its memorandums. Until OMB 
clarifies the applicability of the encryption requirement so that 
agencies can complete encrypting sensitive agency information stored on 
applicable devices, the information will remain at risk of unauthorized 
disclosure. 

Most Agencies Are Encrypting Sensitive Transmitted Information: 

Most agencies reported that they had encrypted sensitive information 
transmitted over wired and wireless networks. Of 23 agencies reporting 
on their efforts to encrypt wired Internet transmissions of sensitive 
information, 18 agencies reported encrypting nearly all or all (80 
percent to 100 percent), of their transmissions over wired Internet 
networks. In addition, of 21 agencies reporting on their efforts to 
encrypt wireless transmissions of sensitive information, 12 reported 
having encrypted all or nearly all such transmissions (see fig. 4). 

Figure 4: Agency Status of Encrypting Sensitive Information Transmitted 
Over Wired and Wireless Networks: 

This figure is a combination bar graph showing agency status of 
encrypting sensitive information transmitted over wired and wireless 
networks. 

		
Number of agencies: 0-19; 
Wired Internet transmissions: 1; 
Wireless network transmissions: 2. 

Number of agencies: 20-39; 
Wired Internet transmissions: 1; 
Wireless network transmissions: 2. 

Number of agencies: 40-59; 
Wired Internet transmissions: 0; 
Wireless network transmissions: 0. 

Number of agencies: 60-79; 
Wired Internet transmissions: 3; 
Wireless network transmissions: 5. 

Number of agencies: 80-100; 
Wired Internet transmissions: 18; 
Wireless network transmissions: 12. 

[See PDF for image] 

Source: GAO analysis of survey data reported July through September 
2007 by 21 agencies regarding encryption of sensitive information 
transmitted by wireless networks, and by 23 agencies regarding 
encrypting such information transmitted by the Internet. 

[End of figure] 

Encryption Efforts Had Not Been Adequately Planned at Most Agencies: 

Although 24 major federal agencies reported having encryption efforts 
under way, none of the agencies had documented a comprehensive plan 
that considered the security control implementation elements 
recommended by NIST. According to NIST, cryptography is best designed 
as an integrated part of a comprehensive information security program 
rather than as an add-on feature and it suggests that implementing 
technical approaches without a plan to guide the process is the least 
effective approach to making use of cryptography. Specifically, as part 
of an effective information security program, NIST Special Publication 
800-53 requires agencies to inventory and categorize information and 
systems according to risk as well as to document the baseline security 
controls--such as encryption--selected to adequately mitigate risks to 
information. However, of the 24 agencies we surveyed, 18 reported that 
they had not completed efforts to inventory sensitive information that 
they hold. 

Further, NIST recommends that agencies follow NIST Special Publication 
800-21 guidance when formulating their approach for integrating 
cryptographic methods into new or existing systems and documenting 
plans for implementing encryption, such plans consist of the following 
minimum elements: 

* installing and properly configuring FIPS-validated cryptographic 
modules associated with selected encryption technologies; 

* monitoring the continued effectiveness of installed cryptographic 
controls, including the proper functioning of encryption technologies; 

* documenting and implementing policies and procedures for management 
of cryptographic components, such as the effective implementation and 
use of FIPS-compliant encryption technologies and the establishment and 
management of encryption keys; and: 

* providing training to users, operators, and system engineers. 

Although several agencies had developed ad hoc encryption technology 
acquisition or deployment plans, none of the agencies had documented 
comprehensive plans that addressed the elements recommended by NIST. 

In response to our query, OMB officials stated that they monitor 
agencies' progress toward implementing encryption through quarterly 
data submitted by the agencies as part of the President's Management 
Agenda scorecard. However, OMB did not provide us with evidence to 
demonstrate monitoring of the agencies' efforts to inventory the 
sensitive information they hold or to develop implementation plans. As 
previously noted, agencies did not have such plans and often did not 
have inventories. Until agencies develop and document comprehensive 
plans to guide their approach for implementing encryption, including 
completing an inventory of the sensitive information they hold, 
agencies will have limited assurance that they will be able to 
effectively complete implementation and manage life cycle maintenance 
of encryption technologies, as we observed at selected agencies and 
discuss later in this report. 

Weaknesses in Encryption Implementation Practices Exist at Selected 
Agencies: 

Practices for implementing encryption displayed weaknesses at the 6 
federal agencies we reviewed for testing.[Footnote 34] Specifically, 2 
of the 6 agencies had not installed FIPS-validated cryptographic 
modules encryption technologies and 4 had not configured installed 
encryption technologies in accordance with FIPS 140-2 specifications. 
In addition, all of the 6 agencies had not either developed or 
documented policies and procedures for managing encryption 
implementation, and 3 of these agencies had not adequately trained 
personnel in the effective use of installed encryption technologies. 
Protection of information and information systems relies not only on 
the technology in place but on establishing a foundation for effective 
implementation, life cycle management, and proper use of the 
technologies. Until agencies resolve these weaknesses, their data may 
not be fully protected. 

FIPS-Compliant Encryption Products Had Not Been Installed on All Agency 
Devices: 

OMB requires agencies to protect sensitive agency data stored on mobile 
devices by installing a FIPS-validated cryptographic modules product, 
and NIST Special Publication 800-53 recommends that agencies install 
FIPS-compliant products when the agency requires encryption of stored 
or transmitted sensitive information. Agencies can now acquire FIPS- 
validated cryptographic module products for encrypting stored 
information through the General Services Administration's (GSA) 
SmartBUY program (see app. IV for a description of this program). Use 
of encryption technologies approved by NIST as compliant with FIPS 140- 
2 provides additional assurance that the product implemented--if 
configured correctly--will help protect sensitive information from 
unauthorized disclosure. 

Laptop computers. The Department of Housing and Urban Development (HUD) 
had not installed encryption products on any of its laptop computers 
despite an agency official's assertions to the contrary. HUD officials 
explained that they had planned to implement FIPS-compliant encryption 
in fiscal year 2008 but that implementation was delayed until late in 
fiscal year 2008 due to lack of funding and it is now part of their 
fiscal year 2009 budget request. In addition, the Department of 
Education had not installed a FIPS-validated cryptographic modules 
product to encrypt sensitive information on any of the 15 laptop 
computers that we tested at one of its components. Of the 4 remaining 
agencies, 3--the Department of Agriculture (USDA), the State 
Department,[Footnote 35] and GSA--had installed FIPS-compliant 
technologies on all 58 of the laptop computers that we tested at 
specific locations within each agency. At the National Aeronautics and 
Space Administration (NASA) location we tested, we confirmed that the 
agency's selected FIPS-compliant encryption software had been installed 
on 27 of 29 laptop computers. Although the agency asserted that it had 
installed it on all 29 laptops, officials explained that they did not 
have a mechanism to detect whether the encryption product was 
successfully installed and functioning. 

Handheld devices. All 6 of the agencies had deployed FIPS-compliant 
handheld mobile devices (specifically, BlackBerryï¿½ devices) for use by 
personnel. BlackBerry software and the BlackBerry enterprise server 
software enable users to store, send, and receive encrypted e-mail and 
access data wirelessly using FIPS-validated cryptographic modules 
encryption algorithms. 

Virtual private networks. One of three virtual private networks 
installed by the Department of Education was not a FIPS-compliant 
product. The remaining 5 agencies had installed FIPS-validated 
cryptographic modules products to protect transmissions of sensitive 
information. 

Certain Agencies Did Not Consistently Configure or Install Encryption 
Technologies in Accordance with NIST Requirements: 

Although most agencies had installed FIPS-compliant products to encrypt 
information stored on devices and transmitted across networks, some did 
not monitor whether the product was functioning or configure the 
product to operate only in a FIPS-validated cryptographic modules 
secure mode. Until agencies configure FIPS-compliant products in a 
secure mode as directed by NIST--for example, by enabling only FIPS- 
validated cryptographic module encryption algorithms--protection 
against unauthorized decryption and disclosure of sensitive information 
will be diminished. 

Laptop computers. Of the 4 agencies with FIPS-compliant products 
installed on laptop computers, 3 had configured the product to operate 
in a secure mode as approved by NIST on all devices that we examined. 
However, a component of the Department of Agriculture had not 
effectively monitored the effectiveness and continued functioning of 
encryption products on 5 of the 52 laptop computers that we examined. 
Agency officials were unaware that the drives of these devices had not 
been correctly encrypted. The drives, while having the encryption 
software installed, did not encrypt the data on the drive. This 
agency's system administrator attributed the noncompliance to the 
failure of a step in the installation process; specifically, the laptop 
had not been connected to the agency's network for a sufficient period 
of time to complete activation of the user's encryption key by the 
central server, and the agency had no mechanism in place to monitor 
whether the installed product was functioning properly. 

Handheld devices. Three of the 6 agencies--the Department of Education, 
HUD, and NASA--had not configured their handheld BlackBerry devices to 
encrypt the data contained on the devices. All six of the agencies 
encrypted data in transit because FIPS-validated cryptographic modules 
encryption was built into the BlackBerry device software. However, 
agencies must enable the encryption to protect information stored on 
the device itself by making a selection to do so and requiring the user 
to input a password. Officials at these 3 agencies stated that they had 
not enabled this protective feature on all their BlackBerry devices due 
to operational issues with enabling content protection and that they 
are awaiting a solution from the vendor. 

Virtual private networks. Two of the 6 agencies--the Department of 
Education and HUD--had not configured their virtual private networking 
technologies to use only strong, FIPS-validated cryptographic modules 
encryption algorithms for encrypting data and to ensure message 
integrity. The use of weak encryption algorithms--ones that have not 
been approved by NIST or that have explicitly been disapproved by NIST-
-provides limited assurance that information is adequately protected 
from unauthorized disclosure or modification. 

Agencies Had Not Developed or Documented Encryption Policies and 
Procedures: 

The weaknesses in encryption practices identified at the 6 selected 
agencies existed in part because agencywide policies and procedures did 
not address federal guidelines related to implementing and using 
encryption. NIST Special Publication 800-53 recommends that agencies 
develop a formal, documented policy that addresses the system and 
communications controls as well as a formal, documented procedure to 
facilitate implementation of these controls. While policies should 
address the agency's position regarding use of encryption and 
management of encryption keys, the implementation procedures should 
describe the steps for performance of specific activities such as user 
registration, system initialization, encryption key generation, key 
recovery, and key destruction. However, 4 of the 6 agencies did not 
have a policy that addressed the establishment and management of 
cryptographic keys as directed by NIST, and none of the 6 agencies had 
detailed procedures for implementing this control. 

Furthermore, according to NIST guidance, agency policies and procedures 
are to address how agencies will install and configure FIPS-compliant 
encryption products. All agencies' policies addressed how the agency 
planned to comply with these requirements. However, 4 agencies did not 
have detailed procedures requiring installation and configuration of 
FIPS-compliant cryptography (see table 5). 

Table 5: Agency Policies and Procedures That Address NIST Encryption 
Controls: 

Agency: USDA; 
Encryption key establishment and management control: Policy: Yes; 
Encryption key establishment and management control: Procedures: No; 
Installation and configuration of FIPS-compliant encryption products: 
Policy: Yes; 
Installation and configuration of FIPS-compliant encryption products: 
Procedure: Yes. 

Agency: Education; 
Encryption key establishment and management control: Policy: No; 
Encryption key establishment and management control: Procedures: No; 
Installation and configuration of FIPS-compliant encryption products: 
Policy: Yes; 
Installation and configuration of FIPS-compliant encryption products: 
Procedure: No. 

Agency: HUD; 
Encryption key establishment and management control: Policy: Yes; 
Encryption key establishment and management control: Procedures: No; 
Installation and configuration of FIPS-compliant encryption products: 
Policy: Yes; 
Installation and configuration of FIPS-compliant encryption products: 
Procedure: No. 

Agency: State; 
Encryption key establishment and management control: Policy: No; 
Encryption key establishment and management control: Procedures: No; 
Installation and configuration of FIPS-compliant encryption products: 
Policy: Yes; 
Installation and configuration of FIPS-compliant encryption products: 
Procedure: No. 

Agency: GSA; 
Encryption key establishment and management control: Policy: No; 
Encryption key establishment and management control: Procedures: No; 
Installation and configuration of FIPS-compliant encryption products: 
Policy: Yes; 
Installation and configuration of FIPS-compliant encryption products: 
Procedure: No. 

Agency: NASA; 
Encryption key establishment and management control: Policy: No; 
Encryption key establishment and management control: Procedures: No; 
Installation and configuration of FIPS-compliant encryption products: 
Policy: Yes; 
Installation and configuration of FIPS-compliant encryption products: 
Procedure: Yes. 

Source: GAO analysis of agency policies and procedures for NIST 
encryption controls. 

[End of table] 

Policies and procedures for installing and configuring encryption 
technologies and for managing encryption keys provide the foundation 
for the effective implementation and use of encryption technologies and 
are a necessary element of agency implementation plans. Until these 
agencies develop, document, and implement these policies and 
procedures, the agencies' implementation of encryption may be 
ineffective in protecting the confidentiality, integrity, and 
availability of sensitive information. 

Three Agencies Had Not Adequately Trained Personnel to Use Installed 
Encryption Products: 

Also contributing to the weaknesses at 3 of 6 agencies was the failure 
to adequately train personnel in the proper use of installed encryption 
technology. Specifically: 

* USDA officials stated that users had not been trained to check for 
continued functioning of the software after installation but that they 
were in the process of including encryption concepts in its annual 
security awareness training required for all computer users. At the 
conclusion of our review, USDA had not yet completed this effort. 

* At the component of the Department of Education where testing was 
conducted, some users were unaware that the agency had installed 
encryption software on their laptop computers. These users, therefore, 
had never used the software to encrypt sensitive files or folders. 
Further, while an agency official asserted that encryption training was 
provided, the training documents provided pertained only to the 
protection of personally identifiable information and did not provide 
specifics on how to use the available encryption products. Users we 
spoke with were unaware of any available training. 

* At NASA, several users stated that they had refused to allow the 
encryption software to be installed on their devices, while other users 
said they were unfamiliar with the product. Although NASA requires 
users to receive training when encryption is installed and has 
developed a training guide, there was no mechanism in place to track 
whether users complete the necessary training. 

Until these agencies provide effective training to their personnel in 
the proper management and use of installed encryption technologies, 
they will have limited confidence in the ability of the installed 
encryption technologies to function as intended. 

Conclusions: 

Despite the availability of numerous types of commercial encryption 
technologies and federal policies requiring encryption, most federal 
agencies had just begun to encrypt sensitive information on mobile 
computers and devices. In addition, agencies had not documented 
comprehensive plans to guide activities for effectively implementing 
encryption. Although governmentwide efforts were under way, agency 
uncertainty with OMB requirements hampered progress. In addition, 
weaknesses in encryption practices at six selected federal agencies-- 
including practices for installing and configuring FIPS-validated 
cryptographic modules products, monitoring the effectiveness of these 
technologies, developing encryption policies and procedures, and 
training personnel--increased the likelihood that the encryption 
technologies used by the agencies will not function as intended. Until 
agencies address these weaknesses, sensitive federal information will 
remain at increased risk of unauthorized disclosure, modification, or 
loss. 

Recommendations for Executive Action: 

We are making 20 recommendations to the Director of the Office of 
Management and Budget and six federal departments and agencies to 
strengthen encryption of federal systems. 

To assist agencies with effectively planning for and implementing 
encryption technologies to protect sensitive information, we recommend 
that the Director of the Office of Management and Budget take the 
following two actions: 

* clarify governmentwide policy requiring agencies to encrypt sensitive 
agency data through the promulgation of additional guidance and/or 
through educational activities and: 

* monitor the effectiveness of the agencies' encryption implementation 
plans and efforts to inventory the sensitive information they hold. 

To assist the Department of Agriculture as it continues to deploy its 
departmentwide encryption solutions and to improve the life cycle 
management of encryption technologies, we recommend that the Secretary 
of Agriculture direct the chief information officer to take the 
following three actions: 

* establish and implement a mechanism to monitor the successful 
installation and effective functioning of encryption products installed 
on devices, 

* develop and implement departmentwide procedures for encryption key 
establishment and management, and: 

* develop and implement a training program that provides technical 
support and end-user personnel with adequate training on encryption 
concepts, including proper operation of the specific encryption 
products used. 

We also recommend that the Secretary of the Department of Education 
direct the chief information officer to take the following five actions 
to improve the life cycle management of encryption technologies: 

* evaluate, select, and install FIPS 140-compliant products for all 
encryption needs and document a plan for implementation that addresses 
protection of all sensitive information stored and transmitted by the 
agency; 

* configure installed FIPS-compliant encryption technologies in 
accordance with FIPS-validated cryptographic modules security settings 
for the product; 

* develop and implement departmentwide policy and procedures for 
encryption key establishment and management; 

* develop and implement departmentwide procedures for use of FIPS- 
compliant cryptography; and: 

* develop and implement a training program that provides technical 
support and end-user personnel with adequate training on encryption 
concepts, including proper operation of the specific encryption 
products used. 

To ensure that the Department of Housing and Urban Development is 
adequately protecting its sensitive information and to improve the life 
cycle management of encryption technologies at the department, we 
recommend that the Secretary of Housing and Urban Development direct 
the chief information officer to take the following three actions: 

* evaluate, select, and install FIPS 140-compliant products for all 
encryption needs and document a plan for implementation that addresses 
protection of all sensitive information stored and transmitted by the 
agency; 

* configure installed FIPS-compliant encryption technologies in 
accordance with FIPS-validated cryptographic modules security settings 
for the product; and: 

* develop and implement departmentwide procedures for the use of FIPS- 
compliant cryptography and for encryption key establishment and 
management. 

To improve the life cycle management of encryption technologies at the 
Department of State, we recommend that the Secretary of State direct 
the chief information officer to take the following two actions: 

* develop and implement departmentwide policy and procedures for 
encryption key establishment and management and: 

* develop and implement departmentwide procedures for use of FIPS- 
compliant cryptography. 

To improve the life cycle management of encryption technologies at the 
General Services Administration, we recommend that the Administrator of 
the General Services Administration direct the chief information 
officer to take the following two actions: 

* develop and implement departmentwide policy and procedures for 
encryption key establishment and management and: 

* develop and implement departmentwide procedures for use of FIPS- 
compliant cryptography. 

As the National Aeronautics and Space Administration continues to plan 
for a departmentwide encryption solution and to improve the life cycle 
management of encryption technologies, we recommend that the 
Administrator of the National Aeronautics and Space Administration 
direct the chief information officer to take the following three 
actions: 

* establish and implement a mechanism to monitor the successful 
installation and effective functioning of encryption products installed 
on devices, 

* develop and implement departmentwide policy and procedures for 
encryption key establishment and management, and: 

* develop and implement a training program that provides technical 
support and end-user personnel with adequate training on encryption 
concepts, including proper operation of the specific encryption 
products used. 

Agency Comments: 

We received written comments on a draft of this report from the 
Administrator, Office of E-Government and Information Technology at OMB 
(reproduced in app. V). OMB generally agreed with the report's contents 
and stated that it would carefully consider our recommendations. We 
also received written comments from Education's Chief Information 
Officer (reproduced in app. VI), from HUD's Acting Chief Information 
Officer (reproduced in app. VII), from the Department of State 
(reproduced in app. VIII), from the Acting Administrator of the GSA 
(reproduced in app. IX), and from the Deputy Administrator of NASA 
(reproduced in app. X). We received comments via email from the 
Department of Agriculture. 

In these comments, the Departments of Agriculture, Education, HUD, and 
State; the GSA; and NASA agreed with our recommendations to their 
respective departments. Agencies also stated that they had implemented 
or were in the process of implementing our recommendations. In 
addition, NIST and the Social Security Administration provided 
technical comments, which we have incorporated as appropriate. 

As we agreed with your offices, unless you publicly announce the 
contents of this report earlier, we plan no further distribution of it 
until 30 days from the date of this letter. At that time, we will send 
copies of this report to interested congressional committees and the 
agency heads and inspectors general of the 24 major federal agencies. 
We will also make copies available to others on request. In addition, 
this report will be available at no charge on the GAO Web site at 
[hyperlink, http://www.gao.gov]. 

If you have any questions or wish to discuss this report, please 
contact me at (202) 512-6244 or [email protected]. Contact points for 
our Offices of Congressional Relations and Public Affairs may be found 
on the last page of this report. GAO staff who made major contributions 
to this report are listed in appendix XI. 

Signed by: 

Gregory C. Wilshusen: 

Director, Information Security Issues: 

[End of section] 

Appendix I: Objectives, Scope, and Methodology: 

The objectives of our review were to determine (1) how commercially 
available encryption technologies could help federal agencies protect 
sensitive information and reduce risks; (2) the federal laws, policies, 
and guidance for using encryption technologies to protect sensitive 
information; and (3) the extent to which agencies have implemented, or 
planned to implement, encryption technologies to protect sensitive 
information. 

To address the first objective, we reviewed prior GAO reports and 
reviewed documentation regarding products validated by the National 
Institute of Standards and Technology (NIST) Cryptographic Module 
Validation Program to identify commercially available encryption 
technologies. Additionally, we met with a vendor of an encryption 
product and interviewed NIST encryption experts regarding the 
characteristics of products that can reduce risks to agencies. 

To address the second objective, we reviewed prior GAO and agency 
inspector general reports to identify relevant laws and guidance such 
as the Federal Information Security Management Act of 2002 (FISMA) and 
the Privacy Act of 1974 to identify mandatory and optional practices 
for protecting sensitive information (including personally identifiable 
information but excluding classified national security information) 
that federal agencies collect, process, store, and transmit. We 
examined the laws to identify federal agencies responsible for 
promulgating federal policies and standards on the use of encryption. 
Additionally, we researched official publications issued by the Office 
of Management and Budget and NIST and interviewed officials from these 
agencies to identify the policies, standards, and guidance on 
encryption that have been issued. 

To address the third objective, we collected and analyzed agency- 
specific policies, plans, and practices through a data request and also 
conducted a survey of the 24 major federal agencies. A survey 
specialist designed the survey instrument in collaboration with subject 
matter experts. Then, the survey was pretested at 4 of these agencies 
to ensure that the questions were relevant and easy to comprehend. For 
each agency surveyed, we identified the appropriate point of contact, 
notified each one of our work, and distributed the survey along with a 
data request to each via e-mail in June 2007. In addition, we discussed 
the purpose and content of the survey and data request with agency 
officials when requested. All 24 agencies responded to our survey and 
data request from June to September 2007; results are reported as of 
this date. We contacted agency officials when necessary for additional 
information or clarification of agencies' status of encryption 
implementation. We did not verify the accuracy of the agencies' 
responses; however, we reviewed supporting documentation that agencies 
provided to corroborate information provided in their responses. We 
then analyzed the results from the survey and data request to identify: 

* the types of information encrypted in data when stored and in 
transit; 

* technologies used by the agency to encrypt information; 

* whether the technologies implemented by the agency met federal 
guidelines; 

* the extent to which the agency has implemented, or plans to 
implement, encryption; and: 

* any challenges faced and lessons learned by agencies in their efforts 
to encrypt sensitive but unclassified information. 

Conducting any survey may introduce errors. For example, differences in 
how a particular question is interpreted, the sources of information 
that are available to respondents, or how the data are entered or were 
analyzed can introduce variability into the survey results. We took 
steps in the development of the survey instrument, the data collection, 
and the data analysis to minimize errors. 

In addition, we tested the implementation of encryption technologies at 
6 agencies to determine whether each agency was complying with federal 
guidance that required agencies to use NIST-validated encryption 
technology. Out of 24 major federal agencies, we selected 6 that met 
one or more of the following conditions: they (1) had not been tested 
under a recent GAO engagement, (2) had reported having initiated 
efforts to install FIPS-validated cryptographic modules encryption 
technologies, (3) had experienced publicized incidents of data 
compromise, or (4) were reasonably expected to collect, store, and 
transmit a wide range of sensitive information. Specifically, we tested 
the implementation of encryption for BlackBerry servers, virtual 
private networks, or a random selection of laptop computers at specific 
locations at the following 6 agencies within the Washington, D.C. 
area:[Footnote 36] 

* U.S. Department of Agriculture, 

* Department of Education, 

* Department of Housing and Urban Development, 

* Department of State,[Footnote 37] 

* General Services Administration, and: 

* National Aeronautics and Space Administration: 

At each of these agencies, we requested an inventory of laptop 
computers that were located at agency facilities in the Washington, 
D.C., metro area and that were encrypted. For each agency, we 
nonstatistically selected one location at which to perform testing, and 
thus the encryption test results for each agency cannot be projected to 
the entire agency. We performed the testing between September and 
December 2007. At each location where laptop computers were tested, 
there were a small number of laptop computers that were requested as 
part of our sample but which were not made available to us for testing. 
Department officials cited several reasons for this, including that the 
user of the device could not bring it to the location in time for our 
testing. 

In testing the laptop computers, we determined whether encryption 
software had been installed on the device and whether the software had 
been configured properly to adhere to federally required standards. 
Although we identified unencrypted laptop computers at each agency, we 
were not able to make statistical estimates of the percentage of 
unencrypted devices at each location. The small number of devices in 
each sample not made available to us for our testing compromised the 
randomness of each sample. 

Additionally, for each of the selected locations among the 6 agencies, 
we requested information on their BlackBerry servers, chose the server 
with the greatest number of users for testing, and reviewed through 
observation the specific security configuration settings. We also 
requested and examined agency-provided information for their virtual 
private networks to determine if encrypted networks were using products 
validated by NIST. Finally, we interviewed agency officials regarding 
their practices for encrypting stored data as well as data in transit, 
and for encryption key establishment and management. 

Furthermore, we reviewed and analyzed data on the General Services 
Administration's SmartBUY program to determine the extent of savings 
the program provides to federal agencies and how certain agencies have 
already benefited from the program. 

We conducted this performance audit from February 2007 through June 
2008 in accordance with generally accepted government auditing 
standards. Those standards require that we plan and perform the audit 
to obtain sufficient, appropriate evidence to provide a reasonable 
basis for our findings and conclusions based on our audit objectives. 
We believe that the evidence obtained provides a reasonable basis for 
our findings and conclusions based on our audit objectives. 

[End of section] 

Appendix II: Important Considerations for Implementing Encryption to 
Effectively Reduce Agency Risks: 

Encryption technology may help protect sensitive information from 
compromise; however, there are several important implementation and 
management considerations when selecting and implementing this 
technology. Encryption can be a powerful tool, but implementing it 
incorrectly--such as by failing to properly configure the product, 
secure encryption keys, or train users--can, at best, result in a false 
sense of security and, at worst, render data permanently inaccessible. 
Designing, building, and effectively implementing commercially 
available cryptographic technologies involves more than installing the 
technology. Decisions must be made for managing encryption keys and 
related cryptographic components, as well as for managing mobile 
devices and using public key infrastructure (PKI) technologies. 
Ultimately, the effectiveness of the encryption technologies used to 
protect agency information and reduce risk depends on how an agency 
implements and manages these technologies and the extent to which they 
are an integral part of an effectively enforced information security 
policy that includes sound practices for managing encryption keys. 

Encryption Key Management Considerations: 

Policies and procedures. Comprehensive policies for the management of 
encryption and decryption keys--the secret codes that lock and unlock 
the data--are an important consideration. Providing lifetime management 
of private keys and digital certificates across hundreds of 
applications and thousands of servers, end-users, and networked devices 
can quickly strain an agency's resources. For example, if a key is lost 
or damaged, it may not be possible to recover the encrypted data. 
Therefore, it is important to ensure that all keys are secured and 
managed properly by planning key management processes, procedures, and 
technologies before implementing storage encryption technologies. 
According to NIST, this planning would include all aspects of key 
management, including key generation, use, storage, and destruction. It 
would also include a careful consideration of how key management 
practices can support the recovery of encrypted data if a key is 
inadvertently destroyed or otherwise becomes unavailable (for instance, 
because a user unexpectedly resigns or loses a cryptographic token 
containing a key). An example of recovery preparation is storing 
duplicates of keys in a centralized, secured key repository or on 
physically secured removable media. Additional considerations for the 
encryption of removable media are how changing keys may affect access 
to encrypted storage on the media and what compensating controls could 
be developed, such as retaining the previous keys in case they are 
needed. 

Key storage location. Another consideration that NIST describes is 
deciding where the local keys will be stored. For some encryption 
technologies, such as full disk encryption and many file/folder 
encryption products, there are often several options for key location, 
including the local hard drive, a flash drive, a cryptographic token, 
or a trusted platform module chip. Some products also permit keys to be 
stored on a centralized server and retrieved automatically after the 
user authenticates successfully. For virtual disk encryption, the main 
encryption key is often stored encrypted within the disk or container 
itself. 

Access to encryption keys. Another consideration is properly 
restricting access to encryption keys. According to NIST, storage 
encryption technologies should require the use of one or more 
authentication mechanisms, such as passwords, smart cards, and 
cryptographic tokens, to decrypt or otherwise gain access to a storage 
encryption key. The keys themselves should be logically secured 
(encrypted) or physically secured (stored in a tamper-resistant 
cryptographic token). The authenticators used to retrieve keys should 
also be secured properly. 

Managing cryptographic components related to encryption keys. In 
addition to key management, NIST describes several other considerations 
when planning a storage encryption technology. Setting the cryptography 
policy involves choosing the encryption algorithm, mode of 
cryptographic operation, and key length. Federal agencies must also use 
NIST-validated cryptographic modules configured for FIPS-compliant 
algorithms and key lengths. In addition, several FIPS-compliant 
algorithms are available for integrity checking. Another consideration 
for managing cryptographic components is how easily an encryption 
product can be updated when stronger algorithms and key sizes become 
available in the future. 

Other Implementation Considerations: 

Centralized management of mobile devices. NIST recommends centralized 
management for most storage encryption deployments because of its 
effectiveness and efficiency for policy verification and enforcement, 
key management, authenticator management, data recovery, and other 
management tasks. Centralized management can also automate these 
functions: deployment and configuration of storage encryption software 
to end user devices, distribution and installation of updates, 
collection and review of logs, and recovery of information from local 
failures. 

PKI technology. Because PKI technology uses a public key as part of its 
encryption system, PKI systems with key management can be used to avoid 
the problem of lost keys. Data encrypted with PKI relies on one public 
key, so the private key of the person encrypting the data isn't 
necessarily required to decrypt it. However, if an unauthorized user is 
able to obtain a private key, the digital certificate could then be 
compromised. Agencies considering PKI technology must ensure that the 
key systems of different agencies are compatible for cross-agency 
collaboration on tasks such as security incident information sharing. 
Further, users of certificates are dependent on certification 
authorities to verify the digital certificates. If a valid 
certification authority is not used, or a certification authority makes 
a mistake or is the victim of a cyber attack, a digital certificate may 
be ineffective. 

Ongoing maintenance of encryption technologies. Systems administrators 
responsible for encryption technology maintenance should be able to 
configure and manage all components of the technology effectively and 
securely. According to NIST, it is particularly important to evaluate 
the ease of deployment and configuration, including how easily the 
technology can be managed as the technology is scaled to larger 
deployments. Another consideration is the ability of administrators to 
disable configuration options so that users cannot circumvent the 
intended security. Other maintenance considerations NIST describes 
include the effects of patching/upgrading software, changing software 
settings (changing cryptographic algorithms or key sizes), uninstalling 
or disabling encryption software, changing encryption/decryption keys, 
and changing user or administrator passwords. 

[End of section] 

Appendix III: Hindrances Faced by Agencies when Implementing 
Encryption: 

Preparing an agency for encryption presents numerous challenges to 
agencies, including selecting an adequate combination of cost-effective 
baseline security controls, properly configuring the networks and user 
devices within the information technology (IT) infrastructure to 
accommodate selected encryption technologies, providing training to 
personnel, and managing encryption keys. In response to our survey, 
agencies reported several conditions that hinder their ability to 
encrypt sensitive information as required by the Office of Management 
and Budget. 

In response to our survey, all 24 agencies reported hindrances with 
implementing encryption. These hindrances included prohibitive costs; 
user acceptance; user training; data backup and recovery; data archival 
and retrieval; interoperability; infrastructure; vendor support for 
encryption products acquired; availability of FIPS-compliant products 
to meet the needs of uncommon or unique devices, applications, or 
environments within the agency's IT infrastructure; and management 
support for migration to encryption controls. Agencies noted the level 
of hindrance caused by these challenges ranged from little or no 
hindrance to great or very great hindrance. The most challenging 
conditions are discussed below. 

Prohibitive costs. Nine agencies reported that the cost of acquiring 
and implementing encryption was their greatest hindrance, and 13 
agencies cited this condition as somewhat of a hindrance or a moderate 
hindrance. As reported in appendix IV, a governmentwide initiative 
(SmartBUY) has been established to assist agencies with overcoming this 
hindrance. 

User acceptance and training. Some encryption technologies can be 
burdensome to users and can require specialized training on encryption 
concepts and proper installation, maintenance, and use of encryption 
products. Sixteen agencies reported facing somewhat of a hindrance or a 
moderate hindrance in obtaining user acceptance of encryption 
implementations and in training personnel. Four agencies reported a 
great or very great hindrance from lack of user acceptance, and 2 
agencies reported a great hindrance from insufficient training. 

Data backup, recovery, archiving, and retrieval. Agencies must 
establish policies and procedures for management of encryption keys, 
which are necessary to recover data from back-ups in the event of a 
service interruption or disaster, or to retrieve data in archived 
records, perhaps many years in the future. For example, if the key is 
not properly backed up and is on a server that has been destroyed in a 
fire or the key used to encrypt archived records changes over time, 
data encrypted with the key may be irretrievably lost. Sixteen agencies 
reported facing somewhat of a hindrance or a moderate hindrance with 
backup and recovery, and 15 agencies reported the same level of 
hindrance with data archiving and retrieval. 

Interoperability. Key systems and technologies of different agencies 
need to be compatible with each other for cross-agency collaboration. 
Five agencies reported that lack of interoperability was a great or 
very great hindrance, and 13 reported somewhat of a hindrance or a 
moderate hindrance. 

Infrastructure considerations. Six agencies reported facing a great or 
very great hindrance in readying their IT infrastructure for encryption 
and 11 reported this was somewhat of a hindrance or a moderate 
hindrance. 

Table 6 summarizes the number of agencies reporting the extent to which 
10 conditions affect their agency's ability to implement encryption. 

Table 6: Hindrances to Implementing Encryption at Federal Agencies: 

Hindrance: Prohibitive costs; 
Little or no hindrance: 2; 
Some hindrance: 8; 
Moderate hindrance: 5; 
Great or very great hindrance: 9. 

Hindrance: Lack of user acceptance; 
Little or no hindrance: 3; 
Some hindrance: 12; 
Moderate hindrance: 4; 
Great or very great hindrance: 4. 

Hindrance: Difficulties with data backup and recovery; 
Little or no hindrance: 5; 
Some hindrance: 10; 
Moderate hindrance: 6; 
Great or very great hindrance: 3. 

Hindrance: Insufficient training; 
Little or no hindrance: 4; 
Some hindrance: 13; 
Moderate hindrance: 3; 
Great or very great hindrance: 2. 

Hindrance: Difficulties with archiving and retrieving; 
Little or no hindrance: 5; 
Some hindrance: 12; 
Moderate hindrance: 3; 
Great or very great hindrance: 3. 

Hindrance: Lack of interoperability; 
Little or no hindrance: 3; 
Some hindrance: 6; 
Moderate hindrance: 7; 
Great or very great hindrance: 5. 

Hindrance: Lack of infrastructure readiness; 
Little or no hindrance: 7; 
Some hindrance: 2; 
Moderate hindrance: 9; 
Great or very great hindrance: 6. 

Hindrance: Lack of vendor support; 
Little or no hindrance: 8; 
Some hindrance: 8; 
Moderate hindrance: 6; 
Great or very great hindrance: 1. 

Hindrance: Lack of FIPS-compliant products; 
Little or no hindrance: 7; 
Some hindrance: 6; 
Moderate hindrance: 4; 
Great or very great hindrance: 4. 

Hindrance: Lack of management acceptance; 
Little or no hindrance: 7; 
Some hindrance: 9; 
Moderate hindrance: 1; 
Great or very great hindrance: 2. 

Source: GAO analysis of agency-reported data. Respondents were 
permitted to select more than one condition. 

[End of table] 

Although agencies reported facing hindrances to implementing 
encryption, a new program (GSA SmartBUY specific to encryption 
products) established after we started our review, offers agencies 
options to overcome key hindrances. For example, prohibitive costs and 
acquiring FIPS-compliant products are two hindrances that agencies may 
be able to address through SmartBUY. As discussed in appendix IV, 
discounted pricing is available for data-at-rest encryption software. 
In addition, all products available through SmartBUY use cryptographic 
modules validated under FIPS 140-2 security requirements. 

[End of section] 

Appendix IV: GSA SmartBUY Program for Data-at-Rest Encryption Products: 

To help agencies comply with OMB requirements for encrypting 
information on mobile devices, a governmentwide acquisition vehicle was 
established for encryption products for stored data. Through a 
governmentwide program known as SmartBUY (Software Managed and Acquired 
on the Right Terms), agencies can procure encryption software at 
discounted prices. According to the General Services Administration 
(GSA), SmartBUY is a federal government procurement vehicle designed to 
promote effective enterprise-level software management. By leveraging 
the government's immense buying power, SmartBUY could save taxpayers 
millions of dollars through governmentwide aggregate buying of 
commercial off-the-shelf software products. 

SmartBUY officially began in 2003, when OMB issued a memo emphasizing 
the need to reduce costs and improve quality in federal purchases of 
commercial software.[Footnote 38] The memo designates GSA as the 
executive agent to lead the interagency initiative in negotiating 
governmentwide enterprise licenses for software. SmartBUY establishes 
strategic enterprise agreements with software publishers (or resellers) 
via blanket purchase agreements. 

OMB Memorandum 04-08, Maximizing Use of SmartBUY and Avoiding 
Duplication of Agency Activities with the President's 24 E-Gov 
Initiatives, requires agencies to review SmartBUY contracts to 
determine whether they satisfy agency needs--such as for products to 
encrypt stored data--and, absent a compelling justification for doing 
otherwise, acquire their software requirements from the SmartBUY 
program. 

The issuance of OMB's May 2006 recommendation to encrypt mobile devices 
contributed to the addition of 11 SmartBUY agreements for stored data 
encryption products established in June 2007. The products offered fall 
into one of three software and hardware encryption product categories: 
full disk encryption, file encryption, or integrated full disk/file 
encryption products. All products use cryptographic modules validated 
under FIPS 140-2 security requirements. 

Volume discounts on encryption products are available when purchasing 
in tiers of 10,000, 33,000, and 100,000 users. Each of the 11 
agreements has its own pricing structure, which may include maintenance 
and training in addition to licenses for users. Discounts on volume 
pricing can range up to 85 percent off GSA schedule prices. 

Table 7 provides an example of the discounted pricing available from 1 
of the 11 SmartBUY agreements for encryption software. 

Table 7: Examples of Volume Discount Pricing Available through 
SmartBUY: 

Order quantity: 1-99; 
Commercial list price: $199.00; 
GSA schedule price: $171.08; 
SmartBUY price: $133.52. 

Order quantity: 100-499; 
Commercial list price: 164.00; 
GSA schedule price: 140.99; 
SmartBUY price: 102.47. 

Order quantity: 500-999; 
Commercial list price: 149.00; 
GSA schedule price: 128.10; 
SmartBUY price: 94.19. 

Order quantity: 1,000-1,999; 
Commercial list price: 133.00; 
GSA schedule price: 114.34; 
SmartBUY price: 81.77. 

Order quantity: 2,000-2,999; 
Commercial list price: 119.00; 
GSA schedule price: 102.31; 
SmartBUY price: 76.59. 

Order quantity: 3,000-4,999; 
Commercial list price: 111.00; 
GSA schedule price: $95.43; 
SmartBUY price: 71.42. 

Order quantity: 5,000-9,999; 
Commercial list price: 98.00; 
GSA schedule price: [Empty]; 
SmartBUY price: 67.50. 

Order quantity: 10,000-24,999; 
Commercial list price: $83.00; 
GSA schedule price: [Empty]; 
SmartBUY price: 54.75. 

Order quantity: 25,000-49,999; 
Commercial list price: [Empty]; 
GSA schedule price: [Empty]; 
SmartBUY price: 44.00. 

Order quantity: 50,000-99,999; 
Commercial list price: [Empty]; 
GSA schedule price: [Empty]; 
SmartBUY price: 37.00. 

Order quantity: 100,000-199,999; 
Commercial list price: [Empty]; 
GSA schedule price: [Empty]; 
SmartBUY price: $30.00. 

Source: GSA supplied documentation. 

[End of table] 

As of January 2008, 10 agencies had purchased encryption products--such 
as software licenses, annual maintenance services, and training--from 
the stored data SmartBUY list, realizing significant cost savings. One 
of those agencies--the Social Security Administration--purchased 
250,000 licenses of one of the stored data products at a savings of 
$6.7 million off the GSA schedule prices. Additionally, USDA negotiated 
an agreement for 180,000 licenses at $9.63 each, as opposed to the GSA 
unit price of $170 per license. The large number of licenses acquired 
allowed USDA to negotiate the low price. Several agencies noted that 
considering an enterprisewide deployment of encryption can be helpful 
with issues of standardization, interoperability, and infrastructure 
readiness. While 10 agencies have already acquired encryption products 
through the SmartBUY program, several agencies are still in the process 
of assessing which encryption products (including those available under 
the SmartBUY program) will best suit agency needs. 

[End of section] 

Appendix V Comments from the Office of Management and Budget: 

Executive Office Of The President: 
Office Of Management And Budget: 

Washington, DC. 20503
June 19, 2008 

Gregory C. Wilshusen: 
Director, Information Security Issues: 
United States Government Accountability Office: 
441 G St., NW: 
Washington, D.C. 20548: 

Dear Mr. Wilshusen: 

Thank your for the opportunity to review and comment on General 
Accountability Office's (GAO's) draft report entitled, "Federal Agency 
Efforts to Encrypt Sensitive Information Are Under Way, but Work 
Remains." The Office of Management and Budget (OMB) appreciates the 
work GAO has devoted to this issue. 

As the draft report indicates, OMB has been working to provide Federal 
Departments and agencies with the tools and guidance necessary for the 
implementation and use of encryption appropriately to protect Federal 
information. In OMB Memorandum M-06- 16, dated June 23, 2006, 
"Protection of Sensitive Agency Information," OMB recommended agencies 
"encrypt all data on mobile computers/devices which carry agency data 
unless the data is determined to be non-sensitive, in writing, by your 
Deputy Secretary or an individual he/she may designate in writing." 

In OMB Memorandum M-07-16, dated May 22, 2007, "Safeguarding Against 
and Responding to the Breach of Personally Identifiable Information," 
OMB required agencies to implement this policy for personally 
identifiable information. 

In order to help agencies implement encryption requirements, OMB has 
been working with both the Commerce Department's National Institute of 
Standards and Technology (NIST) and the General Services Administration 
(GSA) to provide agencies with guidance and tools. GSA and the 
Department of Defense established a Software Managed and Acquired on 
the Right Terms (SmartBUY) agreement for products certified through the 
NIST Federal Information Processing Standards (F1PS) 140-2 Cryptomodule 
Validation Program. Agencies are using these certified products to 
encrypt data on agency information systems. SmartBUY is a Federal 
government procurement vehicle designed to promote effective enterprise 
level software acquisition and management. By leveraging the 
government's immense buying power, SmartBUY has saved taxpayers 
millions of dollars through government wide aggregate buying of 
Commercial off-the-shelf (COTS) software products, and agencies are 
utilizing new SmartBUY agreements to acquire quality security products 
at lower costs. To date, the Federal government has avoided and/or 
saved more than $600 million dollars ($133 million in 2007) through the 
use of this program.

Benefits of the SmartBUY program are not confined solely to Federal 
agencies; the encryption Blanket Purchase Agreement (BPA) was written 
so that state and local governments can also take advantage of this 
opportunity. The state and local governments are participating under 
GSA's Cooperative Purchasing Program, which allows them to purchase IT 
products and services from both GSA's Multiple Award Schedule 70 and 
Consolidated Schedules that have IT special item numbers. To date 
127,296 licenses have been issued across 15 states (including local 
governments). This has resulted in savings of $24 million on purchases 
of encryption software through use of these Federal contracts and 
approximately $8 million using the special state and local government 
offers -- for a total of more than $32 million in savings/cost 
avoidance to date. 

In addition to ensuring agencies have appropriate guidance and tools, 
OMB closely monitors agency progress on policy implementation through a 
variety of mechanisms, including the President's Management Agenda 
(PMA) E-Government Scorecard. The PMA E-Government Scorecard process 
includes ongoing staff-level dialogue between OMB and the agencies, and 
quarterly oversight assessments which OMB discusses with agency 
managers. 

The draft GAO report makes two recommendations to the OMB Director. 
These draft recommendations are for OMB to: 

* Clarify government-wide policy requiring agencies to encrypt 
sensitive agency data through the promulgation of additional guidance 
and/or through educational activities.

* Monitor the effectiveness of agency encryption implementation plans 
and agency efforts to inventory the sensitive information it holds. OMB 
will carefully consider these recommendations to determine whether or 
not any additional activities in these areas will help to improve the 
effective implementation and use of encryption products across the 
Federal government. In particular, we will attempt to leverage existing 
government wide educational vehicles and forums, such as the CIO 
Council's Best Practices Committee. 

Thank you again for the opportunity to comment on the draft report. 

Sincerely, 

Karen S. Evans: 
Administrator, Office of E-Government and Information Technology: 

[End of section] 

Appendix VI: Comments from the Department of Education: 

United States Department Of Education: 
Office Of The Chief Information Officer: 
The Chief Information Officer: 
400 Maryland Avenue, S.W. Washington D.C. 20202: 
[hyperlink, http://www.ed.gov]: 

May 28, 2008: 

Mr. Gregory C. Wilshusen: 
Director, Information Security Issues: 
Government Accountability Office: 
441 G Street, NW: 
Washington, DC 20548:  

Dear Mr. Wilshusen: 

I am providing comments on behalf of the U.S. Department of Education 
(Department) on the five recommendations listed on page 40 of the DRAFT 
report by the General Accountability Office (GAO) (GAO-08-525), 
"Federal Agency Efforts to Encrypt Sensitive Information Are Under Way, 
but Work Remains." The draft report includes recommendations that the 
Secretary of the Department of Education direct the chief information 
officer to take five actions to improve the management of encryption 
technologies throughout the agency. We have the following responses 
regarding the recommendations: 

Recommendation 1. Evaluate, select, and install FIPS 140-compliant 
products for all encryption needs and document a plan for 
implementation that addresses protection of all sensitive information 
stored and transmitted by the agency. 

The Department has already implemented many solutions with regard to 
encryption technologies to safeguard data. We plan to further evaluate 
current safeguards and determine what improvements would be 
appropriate. Thus, we agree with GAO's recommendation to evaluate, 
select, and install additional Federal Information Processing Standards 
(FIPS) 140-2 compliant solutions for all encryption needs and for 
documenting plans for addressing the protection of all sensitive 
information stored and transmitted by the Department. 

Recommendation 2. Configure installed FIPS-compliant encryption 
technologies in accordance with NIST-approved security settings for the 
product. 

The Department agrees with GAO's recommendation for configuring all 
currently installed FIPS-compliant encryption technologies in 
accordance with National Institute of Standards and Technology (NIST)-
approved security settings. The Department further intends to develop 
plans to ensure that all virtual private network (VPN) devices/software 
are FIPS certified. We have directed the Department's contractor under 
the "Educate contract," our contract for information technology (IT), 
to provide various plans, including a sequence plan with milestones, a 
compliance plan, an interoperability plan, and a risk management plan. 
We will ask the contractor to provide recommendations and milestones 
for our review and concurrence. 

Recommendation 3. Develop and implement departmentwide policy and 
procedures for encryption key establishment and management. 

The Department agrees with GAO's recommendation to develop and 
implement a department-wide policy and procedures for encryption key 
establishment and management, including procedures for the use of FIPS-
compliant cryptography. We expect that our policy and procedures for 
addressing encryption key establishment, key management, and use of 
FIPS-compliant cryptography technologies will be in final form in July 
o f 2008. 

Recommendation 4. Develop and implement departmentwide procedures for 
use of FIPS-compliant cryptography. 

The Department agrees with GAO's recommendation to develop and 
implement department-wide procedures for use of FIPS-compliant 
cryptography. In addition to our efforts for developing policies, the 
Department's Office of the Chief Information Officer has been reviewing 
emerging (and "disruptive") technologies that provide encryption on an 
"enterprise" basis for both "data at rest" and "data in motion." The 
Department is also encouraging its primary IT services contractor to 
consider those technologies that go beyond the current standard of care 
in the "encryption" industry. Some of these technologies may solve the 
expensive "key-logger" problem by encrypting data at the "bit/byte" 
level, thereby making administration of encryption keys much less 
cumbersome. Because the EDUCATE contract that the Department has with 
its primary IT service provider is a "performance based" contract, the 
Department may not direct the specific "means and methods" of 
performance there under. However, we are expecting that performance 
under the contract will result in appropriate department-wide 
procedures for use of FIPS-compliant cryptography. 

Recommendation 5. Develop and implement a training program that 
provides technical support and end-user personnel with adequate 
training on encryption concepts, including proper operation of the 
specific encryption products used. 

The Department agrees with GAO's recommendation to develop and 
implement a training program on encryption with regard to its direct 
application to us, and we are already enhancing our training in this 
area. The Department's on-line security awareness and specialized 
training program is reviewed and updated annually to help ensure that 
appropriate improvements are made, including coverage of additional 
relevant topics. The Department also intends to include encryption as 
part of its annual security awareness and specialized training program 
under the Federal Information Security Management Act in Fiscal Year 
2009. This training will include how to use encryption technologies 
implemented department-wide, how encryption works and what capabilities 
it can provide, what encryption is, what it can and cannot do, and 
where it fits into the securing of the Department's vital information 
assets. 

We appreciate the information provided in the draft report. Please let 
us know if you have any questions about our comments. 

Sincerely, 

Signed by: 

Bill Vajda: 
Chief Information Officer: 

[End of section] 

Appendix VII Comments from the Department of Housing and Urban 
Development: 

U.S. Department Of Housing And Urban Development: 
Washington, DC 20410-3000: 

Chief Information Officer: 

May 28, 2008: 

Mr. Gregory C. Wilshusen: 
Director, Information Security Issues: 
Government Accountability Office: 
441 G Street, NW: 
Washington, DC 20548: 

Dear Mr. Wilshusen: 

Thank you for the opportunity to comment on the Government 
Accountability Office (GAO) draft report entitled "Federal Agencies 
Efforts to Encrypt Sensitive Information Are Under Way, but Work 
Remains, job code 310590. 

The Department of Housing and Urban Development has reviewed the draft 
report and is providing the following comments to the recommendations: 

Evaluate, select, and install FIPS 140-compliant products for all 
encryption needs and document a plan for implementation that addresses 
protection of all sensitive information stored and transmitted by the 
agency. 

To date, HUD has implemented a FIPS-compliant encrypted flash drive as 
the enterprise standard, and identified a FIPS-compliant laptop 
encryption solution which will be implemented in FY2009. HUD will 
continue to implement FIPS compliant products, in accordance with NIST-
approved security settings, to safeguard stored and transmitted 
sensitive information. 

Configure installed FIPS-compliant encryption technologies in 
accordance with NIST- approved security settings for the product. 

All FIPS compliant encryption technologies security settings are and 
will be configured in accordance with NIST. 

Develop and implement department-wide procedures for the use of BPS-
compliant cryptography and for encryption key establishment and 
management. Department-wide procedures will be reviewed to ensure 
references to use of FIPS- compliant cryptography and encryption key 
establishment and management are current.

In conclusion, HUD agrees with the GAO recommendations and remains 
committed to strengthen the encryption of sensitive information by 
implementing plans for fully satisfying each of the conditions 
identified in GAO's review. More definitive information with timelines 
will be provided once the final report has been issued If you have any 
questions or require additional information, please contact Shelia 
Fitzgerald, Acting Director, Office of Investments, Strategy, Policy 
and Management at (202)-402-2432. 

Sincerely, 

Signed by: 

Joseph M. Milazzo: 
Acting Chief Information Officer: 

[End of section] 

Appendix VIII: Comments from the Department of State: 

United States Department of State: 
Assistant Secretary for Resource Management and Chief Financial 
Officer: 

Washington, D.C. 20520: 

Ms. Jacquelyn Williams-Bridgers: 
Managing Director: 
International Affairs and Trade: 
Government Accountability Office: 
441 G Street, N.W.: 
Washington, D.C. 20548-0001: 

May 28 2008: 

Dear Ms. Williams-Bridgers: 

We appreciate the opportunity to review your draft report, "Information 
Security: Federal Agency Efforts to Encrypt Sensitive Information Are 
Under Way, but Work Remains," GAO Job Code 310590. 

The enclosed Department of State comments are provided for 
incorporation with this letter as an appendix to the final report. 

If you have any questions concerning this response, please contact 
Peter Gouldmann, Systems Authorization Chief, Bureau of Information 
Resource Management at (703) 812-2500. 

Sincerely, 

Signed by: 

Bradford R. Higgins: 

cc: GAO ï¿½ Greg Wilshesen: 
IRM ï¿½ Susan Swart: 
State/OIG ï¿½ Mark Duda: 

Department of State Comments on GAO Draft Report:

Information Security: Federal Agency Efforts to Encrypt Sensitive 
Information Are Under Way, but Work Remains (GAO-08-525, GAO Code 
310590) 

The Department of State appreciates the opportunity to comment on GAO's 
draft report entitled "Information Security: Federal Agency Efforts to 
Encrypt Sensitive Information Are Under Way, but Work Remains." 

The subject GAO report recommends the following to the Secretary of 
State. 

"To improve the life cycle management of encryption technologies at the 
Department of State, we recommend that the Secretary of State direct 
the chief information officer to take the following two actions: 

Develop and implement department-wide policy and procedures for 
encryption key establishment and management. 

Develop and implement department-wide procedures for use of Federal 
Information Processing Standards (FIPS)-compliant cryptography." 

The Department of State concurs with the GAO recommendations and is 
working towards completing the suggested actions. 

With regard to the first recommendation, the Department has effectively 
managed the Department's military grade, Type 1 encryption for several 
decades. Additionally, the Department effectively manages an 
enterprise- wide Public Key Cryptography program. Several All 
Diplomatic and Consular Post cables (ALDACs), accompanied by 
memorandums for domestic offices provided interim policy guidance 
mandating the encryption of government owned mobile devices. 

On May 1, 2007, the Department sent an ALDAC that mandated the use of 
encryption on all Department owned laptop hard drives, regardless of 
whether they held sensitive information or not. On December 14, 2007, 
in a second ALDAC, the Department expanded requirements to all mobile 
devices and media. Subsequently, on April 3, 2008 a third ALDAC was 
sent announcing availability of a Department acquired FIPS 140-2 
compliant encryption solution with central management capabilities. 
Work is underway to codify this interim guidance and expand it to 
encompass all unclassified key establishment and management into the 
Foreign Affairs Manual. 

With regard to the second recommendation, as previously referenced, the 
third ALDAC sent April 3, 2008, announced the availability of adequate 
licenses of a FIPS 140-2 compliant encryption product to encrypt the 
hard drives of all Department-owned unclassified laptops. 

In addition to laptops, remote access to the Department's unclassified 
network is provided using FIPS 140-2 compliant encryption employed in 
two VPN access solutions. 

For removable media, the Department has FIPS 140-2 compliant encryption 
software for some applications, and is evaluating other software for 
the remaining uses. Policy and procedures for effective central 
management are being developed.

[End of section] 

Appendix IX: Comments from the General Services Administration: 

GSA: 

May 29, 2008: 

The Honorable Gene L. Dodaro: 
Acting Comptroller General of the United States: 
Government Accountability Office: 
Washington, DC 20548: 

Dear Mr. Dodaro: 

The General Services Administration (GSA) appreciates the opportunity 
to review and comment on the draft report, "Information Security: 
Federal Agency Efforts to Encrypt Sensitive Information Are Under Way, 
but Work Remains" (GAO-08-525). The Government Accountability Office 
recommends that GSA improve its life cycle management of encryption 
technologies by developing and implementing agency-wide policy and 
procedures for encryption key establishment and management along with 
developing procedures for use of FIPS compliant cryptography. 

We agree with the findings and recommendations and will use the report 
findings to improve GSA's life cycle management of encryption 
technologies. 

Enclosed is GSA's response to the referenced recommendations. If you 
have any questions, please contact me. Staff inquiries can be directed 
to Mr. Kevin Messner, Associate Administrator, Office of Congressional 
and Intergovernmental Affairs, at (202) 501-0563. 

Sincerely, 

Signed by: 

David L. Bibb: 
Acting Administrator: 

Enclosure 

cc:
Mr. Gregory C. Wilshusen
Director: 
Information Technology Issues: 
U.S. Government Accountability Office: 
Washington, DC 20548: 

Government Accountability Office (GAO) Draft Report Information 
Security: Federal Agency Efforts to Encrypt Sensitive Information Are 
Under Way, but Work Remains: 

GAO-08-525 ï¿½ Dated June 2008 General Services Administration Comments 
to the Recommendations: 

Recommendation 1: GAO recommends that the Acting Administrator direct 
the Chief Information Officer to develop and implement department-wide 
policy and procedures for encryption key establishment and management. 

GSA Response: Concur with recommendation. GSA agrees with the 
recommendation and will develop and implement agency-wide policy and 
procedures for encryption key establishment and management. 

Recommendation 2: GAO recommends that the Acting Administrator direct 
the Chief Information Officer to develop and implement department-wide 
procedures for use of FIPS-compliant cryptography. 

GSA Response: Concur with recommendation. GSA agrees with the 
recommendation and will develop and implement agency-wide procedures 
for use of FIPS-compliant cryptography.

[End of section] 

Appendix X Comments from the National Aeronautics and Space 
Administration: 

National Aeronautics and Space Administration: 
Office of the Administrator: 
Washington, DC 20546-0001: 

June 3, 2008: 

Mr. Gregory C. Wilshusen: 
Director, Information Security Issues: 
United States Government Accountability Office: 
Washington, DC 20548: 

Dear Mr. Wilshusen: 

Thank you for the opportunity to review and comment on the draft report 
entitled, Information Security: Federal Agency Efforts to Encrypt 
Sensitive Information Are Under Way, but Work Remains (GAO-08-525). 

In its draft report, the GAO reports several findings from its audit of 
systems at NASA, followed by three recommended actions. The GAO 
recommends that, "As the National Aeronautics and Space Administration 
continues to plan for a departmentwide encryption solution and to 
improve the life cycle management of encryption technologies, we 
recommend that the Administrator of National Aeronautics and Space 
Administration direct the chief information officer to take the 
following three actions." 

Recommendation: Establish and implement a mechanism to monitor the 
successful installation and effective functioning of encryption 
products installed on devices. 

Response: NASA concurs with this recommendation. As noted in the GAO 
report, successful implementation of an encryption method includes 
monitoring the effectiveness of installed cryptographic controls. In 
following this guidance, NASA formed an Agency team chartered to 
provide a recommendation for an enterprise data-at-rest encryption 
solution. In addition to recommendations from NIST SP800-21, the 
requirements for this enterprise solution included the ability to 
continuously monitor the encryption state of every device. 

NASA has selected a vendor to provide an enterprise encryption solution 
based on these requirements and has allocated significant resources 
(personnel and dollars) this fiscal year to implement a centrally 
managed full-disk encryption solution to replace its current solution. 
Once this solution is implemented, targeted for April 2009, NASA will 
be able to provide central reporting on each laptop and desktop 
encrypted with this software. NASA will be able to push new policies to 
these systems and remotely disable any laptop or removable media device 
that is reported lost or stolen. This state- of-the-art encryption 
functionality will significantly improve NASA's ability to meet its 
data encryption responsibilities. 

Recommendation: Develop and implement departmentwide policy and 
procedures for encryption key establishment and management. Response: 
NASA concurs with this recommendation. As noted above, the Agency took 
great care in using the guidance from Government publications in 
selecting the best encryption solution, including guidance on key 
establishment and management from NIST SP800-21. 

NASA policy and detailed procedures currently exist for how encryption 
keys are created, tracked, revoked, and managed. As part of the 
implementation of the Agency enterprise solution for data-at-rest 
encryption, NASA will further document the procedural framework for 
establishing and managing encryption keys and will disseminate existing 
and new policies and procedures across the Agency. 

Recommendation: Develop and implement a training program that provides 
technical support and end-user personnel with adequate training on 
encryption concepts, including proper operation of the specific 
encryption products used. 

Response: NASA concurs with this recommendation. Further, NASA believes 
that the most effective encryption technology is completely transparent 
to the end user and provides constant protection without end user 
intervention. Many of the modem full-disk encryption solutions offer 
this level of transparency, including the one selected for deployment 
at NASA. Training is, nevertheless, a key requirement of the selected 
solution, and product-specific training will be created and made 
available to all users as part of the implementation of NASA's 
enterprise data-at-rest encryption solution. NASA will work with the 
vendor to create training materials for specific audiences. Topics will 
include proper use of the product and encryption concepts for the end 
user as well as troubleshooting, policy creation, forensic integration, 
and administration for the support staff. 

My point of contact for this matter is Jerry L. Davis, Deputy Chief 
Information Officer for Information Technology Security. He may be 
contacted by e-mail at [email protected] or by telephone at (202) 
358-1401. 

Sincerely,

Signed by: 

Shana Dale: 
Deputy Administrator: 

[End of section] 

Appendix XI GAO Contact and Staff Acknowledgments: 

GAO Contact: 

Gregory C. Wilshusen, (202) 512-6244, [email protected]: 

Staff Acknowledgments: 

In addition to the individual named above, Nancy DeFrancesco (Assistant 
Director), James Ashley, Debra Conner; Season Dietrich, Neil Doherty, 
Nancy Glover, Joel Grossman, Ethan Iczkovitz, Stanley J. Kostyla, 
Lowell Labaro, Rebecca Lapaze, Anjalique Lawrence, Harold Lewis, Lee 
McCracken, and Tammi L. Nguyen made key contributions to this report. 

[End of section] 

Glossary: 

Access Control: 

Process of determining the permissible activities of users and 
authorizing or prohibiting activities by each user. 

Authentication: 

Process of confirming an asserted identity with a specified or 
understood level of confidence. 

Authorization: 

Granting the appropriate access privileges to authenticated users. 

Card Management System: 

A system that manages life cycle maintenance tasks associated with the 
credentials, such as unlocking the personal identity verification cards 
during issuance or updating a personal identification number or digital 
certificate on the card. 

Certificate: 

A digital representation of information that (1) identifies the 
authority issuing the certificate; (2) names or identifies the person, 
process, or equipment using the certificate; (3) contains the user's 
public key; (4) identifies the certificate's operational period; and 
(5) is digitally signed by the certificate authority issuing it. A 
certificate is the means by which a user is linked--or bound--to a 
public key. 

Ciphertext: 

Data in an encrypted form. 

Container: 

The file used by a virtual disk encryption technology to encompass and 
protect other files. 

Credential: 

An object, such as a smart card, that identifies an individual as an 
official representative of, for example, a government agency. 

Digital Signature: 

The result of the transformation of a message by means of a 
cryptographic system using digital keys, so that a relying party can 
determine (1) whether the transformation was created using the private 
key that corresponds to the public key in the signer's digital 
certificate and (2) whether the message has been altered since the 
transformation was made. Digital signatures may also be attached to 
other electronic information and programs so that the integrity of the 
information and programs may be verified at a later time. 

Electronic Credentials: 

The electronic equivalent of a traditional paper-based credential--a 
document that vouches for an individual's identity. 

End-to-End Encryption: 

The encryption of information at its origin and decryption at its 
intended destination without any intermediate decryption. 

File: 

A collection of information that is logically grouped into a single 
entity and referenced by a unique name, such as a file name. 

Folder: 

An organizational structure used to group files. 

Full Disk Encryption: 

The process of encrypting all the data on the hard drive used to boot a 
computer, including the computer's operating system, that permits 
access to the data only after successful authentication with the full 
disk encryption product. 

Hardware Based Encryption: 

Encryption that is normally performed by dedicated hardware in the 
client/host system. 

Identification: 

The process of determining to what identity a particular individual 
corresponds. 

Key: 

A value used to control cryptographic operations, such as decryption, 
encryption, signature generation, or signature verification. 

Malware: 

A program that is inserted into a system, usually covertly, with the 
intent of compromising the confidentiality, integrity, or availability 
of the victim's data, applications, or operating system or of otherwise 
annoying or disrupting the victim. 

Master Boot Record: 

A computer's master boot record is a reserved sector on its bootable 
media that determines which software (e.g., operating system, utility) 
will be executed when the computer boots from the media. 

Operating System: 

The program that, after being initially loaded into the computer by a 
boot program, manages all the other programs in a computer. Examples of 
operating systems include Microsoft Windows, MacOS, and Linux. The 
other programs are called applications or application programs. The 
application programs make use of the operating system by making a 
request for service through a defined application program interface. In 
addition, users can interact directly with the operating system through 
a user interface such as a command language or a graphical user 
interface. 

Private Key: 

The secret part of an asymmetric key pair that is typically used to 
digitally sign or decrypt data. 

Public Key: 

The public part of an asymmetric key pair that is typically used to 
verify signatures or encrypt data. 

Public Key Infrastructure: 

A system of hardware, software, policies, and people that, when fully 
and properly implemented, can provide a suite of information security 
assurances--including confidentiality, data integrity, authentication, 
and nonrepudiation--that are important in protecting sensitive 
communications and transactions. 

Risk: 

The expectation of loss expressed as the probability that a threat will 
exploit a vulnerability with a harmful result. 

Senstitive Information: 

Any information that an agency has determined requires some degree of 
heightened protection from unauthorized access, use, disclosure, 
disruption, modification, or destruction because of the nature of the 
information, e.g., personal information required to be protected by the 
Privacy Act of 1974, proprietary commercial information, information 
critical to agency program activities, and information that has or may 
be determined to be exempt from public release under the Freedom of 
Information Act. 

Standard: 

A statement published on a given topic by organizations such as the 
National Institute of Standards and Technology, the Institute of 
Electrical and Electronics Engineers, the International Organization 
for Standardization, and others specifying characteristics--usually 
measurable ones--that must be satisfied to comply with the standard. 

Trusted Platform Module Chip: 

A tamper-resistant integrated circuit built into some computer 
motherboards that can perform cryptographic operations (including key 
generation) and protect small amounts of sensitive information such as 
passwords and cryptographic keys. 

Virtual Disk Encryption: 

The process of encrypting a container, which can hold many files and 
folders, and of permitting access to the data within the container only 
after proper authentication is provided. In this case, the container is 
typically mounted as a virtual disk; it appears to the user as a 
logical disk drive. 

Virtual Private Network: 

A virtual private network is a logical network that is established, at 
the application layer of the open systems interconnection model, over 
an existing physical network and typically does not include every node 
present on the physical network. 

[End of section] 

Footnotes: 

[1] As used in this report, the term ï¿½sensitive informationï¿½ refers to 
any information that an agency has determined requires some degree of 
heightened protection from unauthorized access, use, disclosure, 
disruption, modification, or destruction because of the nature of the 
information, e.g., personal information required to be protected by the 
Privacy Act of 1974, proprietary commercial information, information 
critical to agency program activities, and information that has or may 
be determined to be exempt from public release under the Freedom of 
Information Act. 

[2] GAO, Privacy: Preventing and Responding to Improper Disclosures of 
Personal Information, GAO-06-833T(Washington, D.C.: June 8, 2006). 

[3] Encryption is a subset of cryptography, which is used to secure 
transactions by providing ways to ensure data confidentiality 
(assurance that the information will be protected from unauthorized 
access), data integrity (assurance that data have not been accidentally 
or deliberately altered), authentication of the message's originator, 
electronic certification of data, and nonrepudiation (proof of the 
integrity and origin of data that can be verified by a third party). 

[4] For purposes of this report, the terms "personally identifiable 
information" and "personal information" refer to any information about 
an individual maintained by an agency, including (1) any information 
that can be used to distinguish or trace an individual's identity, such 
as name, Social Security number, date and place of birth, mother's 
maiden name, or biometric records, and (2) any other information that 
is linked or linkable to an individual, such as medical, educational, 
financial, and employment information. 

[5] The 24 major federal agencies are the Agency for International 
Development; the Departments of Agriculture, Commerce, Defense, 
Education, Energy, Health and Human Services, Homeland Security, 
Housing and Urban Development, the Interior, Justice, Labor, State, 
Transportation, the Treasury, and Veterans Affairs; the Environmental 
Protection Agency; the General Services Administration; the National 
Aeronautics and Space Administration; the National Science Foundation; 
the Nuclear Regulatory Commission; the Office of Personnel Management; 
the Small Business Administration; and the Social Security 
Administration. 

[6] "System of records" is defined as a group of records under the 
control of an agency from which information is retrieved by the name of 
the individual or by an individual identifier. 

[7] Critical infrastructures include cyber and physical, public and 
private infrastructures that are essential to national security, 
national economic security, or national public health and safety. 

[8] J. Michael McConnell, Annual Threat Assessment of the Director of 
National Intelligence for the Senate Select Committee on Intelligence, 
Feb. 5, 2008. 

[9] Security controls--access controls--should provide reasonable 
assurance that computer resources (data files, application programs, 
and computer-related facilities and equipment) are protected. Such 
controls include physical access controls, such as keeping computers in 
locked rooms, and logical access controls, such as security software 
programs designed to prevent or detect unauthorized access to sensitive 
files. 

[10] A system interconnection is the direct connection of two or more 
IT systems for the purpose of sharing data and other information 
resources. 

[11] NIST, Special Publication 800-11, Guide to Storage Encryption 
Technologies for End User Devices (Gaithersburg, Maryland: November 
2007). 

[12] A key is a value used to control cryptographic operations, such as 
decryption, encryption, signature generation, or signature 
verification. 

[13] NIST, Information Technology Laboratory Bulletin: Advising Users 
on Information Technology, (Gaithersburg, Maryland: March 2007). 

[14] NIST, Special Publication 800-11. 

[15] Microsoft Corporation, Windows Mobile Devices and Security: 
Protecting Sensitive Business Information, (March 2006). 

[16] NIST, Special Publication 800-47, Security Guide for 
Interconnecting Information Technology Systems, (Gaithersburg, 
Maryland: August 2002). 

[17] NIST, Special Publication 800-25, Federal Agency Use of Public Key 
Technology for Digital Signatures and Authentication, (Gaithersburg, 
Maryland: October 2000). 

[18] Public key infrastructure is a system of hardware, software, 
policies, and people that, when fully and properly implemented, can 
provide a suite of information security assurances--including 
confidentiality, data integrity, authentication, and nonrepudiation-- 
that are important in protecting sensitive communications and 
transactions. For more information about public key infrastructure, see 
GAO, Information Security: Advances and Remaining Challenges to 
Adoption of Public Key Infrastructure Technology, GAO-01-277 
(Washington, D.C.: Feb. 26, 2001). 

[19] A private key is the secret part of an asymmetric key pair that is 
typically used to digitally sign or decrypt data. 

[20] NIST Special Publication 800-48, Wireless Network Security 802.11, 
Bluetooth and Handheld Devices, (Gaithersburg, Maryland: November 
2002). 

[21] Pub. L. No. 107-347 (Dec. 17, 2002). 

[22] Pub. L. No. 104-191 (Aug. 21, 1996). 

[23] Pub. L. No. 109-461 (Dec. 22, 2006). 

[24] OMB Memorandum 04-04 requires agencies with systems using remote 
authentication to conduct special electronic authentication risk 
assessments and select proper controls as recommended by NIST to 
protect sensitive information on those systems. 

[25] NIST, Special Publication 800-63, Electronic Authentication 
Guideline (Gaithersburg, Maryland: April 2006). 

[26] The checklist provided in M-06-16 provides specific actions to be 
taken by federal agencies for the protection of personally identifiable 
information categorized in accordance with FIPS 199 as moderate or high 
impact that is either accessed remotely or physically transported 
outside of the agency's secured physical perimeter. The security 
controls and associated control assessment methods/procedures in the 
checklist were taken from NIST Special Publication 800-53 and NIST 
Special Publication 800-53A. 

[27] NIST, Special Publication 800-53 Revision 2, Recommended Security 
Controls for Federal Information Systems, (Gaithersburg, Maryland: 
December 2007). 

[28] FIPS 199, Standards for Security Categorization of Federal 
Information and Information Systems (Gaithersburg, Maryland: February 
2004). 

[29] Supersedes FIPS 140-1, 1994. 

[30] OMB M-07-16. 

[31] FIPS 180-2, 186-3, and 197. 

[32] FIPS 199. 

[33] FIPS 200, Minimum Security Requirements for Federal Information 
and Information System. (Gaithersburg, Maryland: March 2006). 

[34] We selected six agencies that reported having initiated efforts to 
install FIPS-validated cryptographic modules encryption technologies on 
their laptop computers, BlackBerryï¿½ devices, or virtual private 
networks or that had either experienced publicized incidents of data 
compromise or were expected to collect, store, and transmit a wide 
range of sensitive information. The six agencies are the General 
Services Administration; the Departments of Education, Agriculture, 
Housing and Urban Development, and State; and the National Aeronautics 
and Space Administration. 

[35] We were unable to test the installation of encryption products on 
deployed laptops assigned to State employees because although the 
inventory provided by the agency indicated that the employees were 
assigned to the location that we visited, they were actually assigned 
to posts throughout the world. We instead discussed the encryption 
installation process with State officials and verified use of a FIPS- 
validated cryptographic modules product on one unassigned laptop (not 
from our sample) that agency officials provided for our examination. 
Officials stated that the laptop inventory provided for our review 
included only those laptop computers that were assigned for 
telecommuting and that it did not constitute the entire universe of 
State's laptops. A State official asserted that all of the 
telecommuting laptops--about 2,100 in total--were encrypted as a 
condition for assigning the device to a telecommuting employee and that 
approximately 19 percent of their remaining laptops were encrypted. 

[36] We conducted testing at the headquarters locations of the 
Departments of Housing and Urban Development and State, the General 
Services Administration, and the National Aeronautics and Space 
Administration. We conducted testing at the Food and Nutrition Service 
component of the U.S. Department of Agriculture and at the Federal 
Student Aid component of the Department of Education. 

[37] At the Departments of Housing and Urban Development and State, we 
tested only the BlackBerry server and virtual private networks. 

[38] OMB, Reducing Cost and Improving Quality in Federal Purchases of 
Commercial Software (M-03-14), (Washington, D.C. June 2, 2003). 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability.  

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates."  

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to:  

U.S. Government Accountability Office: 
441 G Street NW, Room LM: 
Washington, D.C. 20548:  

To order by Phone: 
Voice: (202) 512-6000: 
TDD: (202) 512-2537: 
Fax: (202) 512-6061:  

To Report Fraud, Waste, and Abuse in Federal Programs:  

Contact:  

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: [email protected]: 
Automated answering system: (800) 424-5454 or (202) 512-7470:  

Congressional Relations:  

Ralph Dawn, Managing Director, [email protected]: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548:  

Public Affairs: 

Chuck Young, Managing Director, [email protected]: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: 

*** End of document. ***