Internal Audit of IT Security Governance and Risk Management

Internal Audit & Accountability Branch
January 2014

Table of Contents

• Executive Summary
• Why This Is Important
• Key Findings
• Conclusion
• Statement of Conformance
• Background
• Audit ObjectiveS and Scope
• Detailed Recommendations and Findings
  • Finding 1: Governance
  • Finding 2: IT Security Planning
  • Finding 3: IT Security Assessment and Monitoring
• Appendix A – Detailed Audit Criteria
• Appendix B – Management Action Plan
• Appendix C – Links to Applicable Legislation, Frameworks, Policies, Directives and Guidance

Executive Summary

The objective of the audit was to provide assurance to senior management on the effectiveness of governance over information technology (IT) security at Citizenship & Immigration (CIC), including IT security risk management and, specifically, CIC’s Certification and Accreditation (C&A) process.

Why This Is Important

IT security governance is an important foundational component in implementing and maintaining an effective IT security management program. Ensuring sound governance is even more critical with the transition of roles and responsibilities to Shared Services Canada (SSC). Effective risk management is critical in IT security to ensure risks are appropriately identified, prioritized, and mitigated.

Key Findings

Although departmental security governance has been established, IT security has not been fully integrated. Roles and responsibilities of the Departmental Security Officer (DSO), Chief Information Officer (CIO) and IT Security Coordinator are outlined in the CIC IT Security Policy and in each position description. Department-wide security planning and IT-specific security requirements are not fully integrated. Security roles and responsibilities have not been formally defined and documented between CIC and SSC.

Departmental security planning does not include a comprehensive assessment of IT security risks. A Corporate Security Risk Register has been developed that integrates security risk information from all areas of the Department; however, it is not updated on an ongoing basis to include risks identified by IT Security. High-level risk snapshots in the Departmental Security Plan summarize key risks to the Department, but do not include IT-specific risks.

Governance and processes for ensuring ongoing security assessments and monitoring at the corporate and system level have not been formally defined. CIC has developed risk assessment procedures for IT systems and applications, but these procedures have been inconsistently implemented; some new systems are assessed, while others which are continually upgraded rely on previous outdated assessments.

Conclusion

Overall, the IT security governance and risk management framework partially met our expectations. Areas for improvement were noted related to integrating IT security into departmental security governance, formally defining and documenting roles and responsibilities between CIC and SSC, and further strengthening the IT security risk assessment process and implementation of mitigation strategies throughout the Department.

Management has accepted the audit findings and developed an action plan to address the audit recommendations.^{Footnote 1}

Statement of Conformance

The conduct of this engagement conforms with the Internal Auditing Standards for the Government of Canada, as supported by the results of the quality assurance and improvement program. We examined sufficient, relevant evidence to support the conclusions reached.

Gibby Armstrong CA, CIA
Chief Audit Executive
Citizenship and Immigration Canada

Background

As a federal department, CIC must adhere to the Treasury Board of Canada’s baseline security requirements as outlined in the Policy on Government Security. The Policy requires each department to establish a security program for the coordination and management of departmental security activities, and the proper management of security requires the continuous assessment of risks, and the implementation, monitoring and maintenance of appropriate internal management controls involving prevention (mitigation), detection, response and recovery. The Directive on Departmental Security Management provides further security requirements, as do various standards and guidance documents such as the IT Security Guidance suite from the Communications Security Establishment Canada.

Accountability for overall security within the Department rests with the DSO, although IT security specifically is managed under the supervision of the CIO within the Solutions and Information Management Branch (SIMB). The Chief of IT Security and Production Services acts as the departmental IT Security Coordinator responsible for the management of the IT security program and associated risk management.

In the summer of 2011, IT infrastructure services that were formerly performed by CIC were transitioned to SSC. This included the transfer to SSC of CIC personnel who had been delivering these services for the Department.

CIC shares IT systems and infrastructure with a number of agencies, including the Canada Border Services Agency, Royal Canadian Mounted Police, the Canadian Security Intelligence Service and the Department of Foreign Affairs, Trade and Development. While most of its data is centralized in Ottawa, the Department has regional operations across Canada and operations that span the globe. Among other systems, the Department operates a highly complex Global Case Management System (GCMS) on which CIC’s partner departments rely for immigration and border control information, and the Department offers extensive and expanding eServices online through the launch of Electronic Applications.

Audit Objectives and Scope

The objective of the audit was to provide assurance to senior management on the effectiveness of governance over IT security at CIC, including IT security risk management and, specifically, CIC’s C&A process.

The audit scope included an assessment of the processes and practices related to IT security planning and governance at CIC; the roles and responsibilities of IT Security, including CIC’s relationship with SSC; the IT security risk management program, including CIC’s C&A process; and compliance with Treasury Board requirements related to IT security. The audit reviewed IT security activities from April 1, 2012 to June 1, 2013.

The audit criteria developed for this audit are included in Appendix A.

Detailed Recommendations and Findings

Finding 1: Governance

We expected to find that accountability for IT security was well defined and documented within CIC and included an IT security oversight body with a clear mandate that met regularly and reviewed information related to IT Security priorities and plans. We also expected that roles and responsibilities with service providers, such as SSC, were formally defined and documented. Clear accountability and oversight for IT security is important to ensure that IT security issues are identified, prioritized and mitigated.

Governance over IT security has been established.

CIC has a Departmental Security Advisory Committee (DSAC) with the mandate to provide advice and guidance on all departmental security risks and accountabilities, including IT security. DSAC is chaired by the DSO. The CIO is not a designated DSAC participant, as IT is represented by the IT Security Coordinator. DSAC met twice in fiscal year 2012–13; the terms of reference for the committee require that it meet on a quarterly basis or as required.

IT security has on occasion been discussed with other governance bodies, for example, information security was discussed at the Executive Management Committee in March 2013 in response to data loss incidents that had recently occurred within the federal government.

Physical security and IT security responsibilities are not coordinated.

The roles and responsibilities of the DSO, the CIO and the IT Security Coordinator are outlined at a high level in the CIC IT Security Policy and in each position description. From an operational perspective, however, accountabilities and reporting relationships for formally integrating security requirements into the Department’s security plans have not been defined or documented.

CIC’s 2012–13 Departmental Security Plan identifies several priorities, including the need to improve CIC’s security culture by enhancing engagement of DSAC members, and to ensure that the security-related responsibilities of the CIO are clearly defined and that there is clear and formal coordination for the reporting of security related incidents between the CIO and DSO. These priorities were identified as action items to be addressed by end of fiscal year 2012–13, although as of July 2013 they had not yet been completed.

Without fully integrating IT security into departmental security governance processes, including regular governance meetings involving all key stakeholders, there is an increased risk that IT security issues will not be appropriately identified, prioritized or mitigated. A governance body should provide oversight for and approve these activities to ensure that the level of residual risk is acceptable.

Security roles and responsibilities have not been formally defined and documented between CIC and SSC.

With the creation of SSC, many of the functions for IT security have been transferred out of CIC’s area of responsibility. As a preliminary step, CIC has signed a Business Arrangement Document and high-level Memorandum of Understanding with SSC to document the new roles. Operational-level departmental responsibilities that would be required for staff to perform their duties, however, are still under development. The elaboration of processes required to monitor and report against operational requirements also have yet to be developed. As noted in our Audit of Informatics Disaster Recovery Planning, the absence of defined responsibilities and accountabilities results in significant ambiguity for IT staff.

While many of CIC’s former IT staff remained responsible for CIC after the move to SSC, SSC is moving toward a new portfolio model, wherein their staff will be assigned to a group of departments, rather than specific departments. This increases the risk that corporate memory over CIC IT security needs will not be retained and that IT security issues will not be appropriately identified or addressed.

Recommendation 1 (Medium Risk):

CIC should formalize an agreement with Shared Services Canada to establish IT security roles, responsibilities and processes for service delivery.

Finding 2: IT Security Planning

We expected to find that a current security plan that considers IT has been defined and aligns business strategy, business expectations and IT capabilities. We also expected to find that the Security Plan has been translated into tactical operational plans for IT. Finally, we expected to find that the achievement of security plan objectives related to IT security is regularly reviewed and reported, and that the plan is updated on a regular basis.

A Corporate Security Risk Register exists and is updated annually.

There is a Corporate Security Risk Register that underpins the development of the Departmental Security Plan and integrates security risk information from all areas of the Department. The risk registry is updated annually; IT-specific risks are not reviewed or prioritized as they arise.

Based on a Corporate Security Risk Register, the Departmental Security Plan includes four overarching “risk snapshots.” None of the risk snapshots specifically relate to IT security, although Risk Snapshot #2: Compromise of Information includes aspects of IT security. The performance measures to be tracked related to this Risk Snapshot #2 do not include reference to IT Security. Snapshot #4: Partnerships does not include any specific reference to SSC, or risks related to defining roles and responsibilities between CIC and SSC.

Without formal inclusion of IT security risks in the Departmental Security Plan, these risks may not be effectively addressed by the Department in a coordinated fashion.

Recommendation 2 (Medium Risk):

CIC should establish a formal process to ensure that IT security risks and priorities are included in the Corporate Security Risk Register as part of the Departmental Security Plan.

Finding 3: IT Security Assessment and Monitoring

C&A procedures ensure that security requirements are addressed in IT systems as they are developed, implemented and upgraded to newer versions. We expected to find that IT systems were formally certified and accredited in compliance with a defined and documented departmental C&A process, and that IT security issues were appropriately identified and addressed prior to system implementation. We expected to see documented evidence of these C&A procedures applied to a sample of IT systems selected for the audit: GCMS, GCDocs and iCare. Finally, we expected to see continuous monitoring of IT security, which would help CIC to ensure that IT security risks are identified and addressed in a timely manner.

CIC has developed C&A procedures.

CIC has documented C&A procedures, updated in February 2013. The requirement to conduct C&A activities is outlined in section 6.1 of the CIC IT Security Policy. The C&A procedures include key components required of a comprehensive security assessment process, including defining specific C&A roles and responsibilities, developing a security requirements traceability matrix, and performing functional testing of security controls. The C&A procedures do not take a security controls-based approach, however, as recommended in government-wide IT security guidance (IT Security Guidance-33, issued by the Communications Security Establishment Canada). In addition, the C&A procedure does not specifically outline the requirements to complete Privacy Impact Assessments on systems that manage personal information, nor the methodology to perform them.

The Department has recently updated its system development lifecycle, and the current version includes security considerations related to C&A activities and deliverables throughout the process.

Implementation of the C&A procedures has not been consistent.

Systems that were initiated prior to the development of these C&A procedures and the updated system development lifecycle have not systematically considered security as part of the system development. In addition, for systems that have already been implemented, there is no formal process to determine what further assessment activity should be conducted. For instance, Threat and Risk Assessments (TRA) have been conducted for most releases to GCMS; for some assessments that did occur, there is no formal documentation or approval of the activity.

A specific GCMS Certification Plan, which is similar in nature to the new C&A procedures for the Department finalized in February 2013, was developed in 2008. Although baseline security requirements were developed for GCMS, the assessment was high level, and no system-specific security requirements were developed or implemented; nor were these requirements mapped to security controls. With the exception of access control and interface testing, no security controls have been formally tested for GCMS as part of the C&A process.

GCDocs is a system that has already been implemented for the management of documents related to GCMS (although in the near term, capabilities will be expanded to serve as a document management system for all CIC operations), and by the fall of 2013, CIC will also be hosting separate instances of GCDocs for other departments/agencies; some of these departments/agencies are already testing/piloting GCDocs. While GCDocs has already been partially implemented, C&A activities related to GCDocs have only recently begun, and no TRA has been performed.

C&A assessments for specific systems are not being consistently approved.

A risk management document serves as the C&A approval, outlining current risks (taken from previous TRAs) and planned mitigation measures. For GCMS, despite a significant amount of IT security assessment activity on GCMS extensions and changes to functionality, the last signed version of a risk management document is from March 2010. Furthermore, risks outlined in the risk management documents may remain risks over subsequent assessments and many years: for example, the lack of segregation of the CIC network has been a risk within GCMS risk management documents since at least 2006.

As the C&A process has only begun for GCDocs, there are no risk management documents for the application. A risk management document – as well as a TRA – has been developed for iCARE; however, the risk management document has not been formally approved. Without formal approval of C&A assessments, CIC cannot be sure that the risk mitigation strategies for IT systems meet the needs of senior management.

Continuous monitoring is not considered as part of C&A procedures, nor is a formal continuous monitoring plan/process documented elsewhere. IT systems can evolve continuously, changing the dynamics of the previous risk assessments. As well, the global IT environment presents new risks on a daily basis that could present cumulative threats to CIC’s IT infrastructure and systems. Without ensuring security is monitored in a continuous fashion, there is an increased risk that IT security issues will not be appropriately identified and addressed for specific systems, nor escalated to departmental attention.

Recommendation 3 (Medium Risk):

CIC should update its C&A and system development lifecycle processes to include:

1. a formal process to determine what IT security assessment activity should be conducted for systems that are modified or undergo revisions, and ensure they are implemented;
2. reference to the security controls as outlined in government-wide IT security guidance (IT Security Guidance-33);
3. reference to the completion of Privacy Impact Assessments on systems that manage personal information; and
4. a formal monitoring process to ensure security requirements are continually addressed.

Recommendation 4 (Medium Risk):

CIC should ensure that all systems adhere to the designed C&A process for the Department.

Appendix A – Detailed Audit Criteria

The objective of the audit was to provide assurance to senior management on the effectiveness of governance over IT security at CIC, including IT security risk management and, specifically, CIC’s C&A process.

Appendix B – Management Action Plan

Appendix C – Links to Applicable Legislation, Frameworks, Policies, Directives and Guidance

Provide links (if available) to all background information, including policies, studies and legislation.

• Policy on Government Security
• Directive on Departmental Security Management
• Operational Security Standard: Management of Information Technology Security (MITS)
• IT Security Guidance (ITSG) 33 - Overview of IT Security Risk Management: A Lifecycle Approach