1. IT Security Update to NOAA SES December 15-17, 2004 Carl P. Staton Chief Information Officer

2. 2December 15 -17, 2004 Current Issues Results of DOC review of certification and accreditation (C&A) not consistent with OIG review Sustained level of hacker probes and attempted hacks Appropriate testing of national critical systems Results of financial audit Increasing expectations from Congress and OMB

3. 3December 15 -17, 2004 Results of DOC review of C&A not consistent with OIG review Varying expectations on level of detail needed in C&A documentation NOAA and DOC team developing an affordable and repeatable process for C&A documentation NOAA and DOC team developing an affordable and repeatable process for C&A documentation Will engage OIG in reviewing output of NOAA process for concurrence Will engage OIG in reviewing output of NOAA process for concurrence NOAA will develop executable schedule to apply process NOAA will develop executable schedule to apply process National critical systems first National critical systems first

4. 4December 15 -17, 2004 Sustained level of hacker probes and attempted hacks Percentage of intrusion attempts rejected

5. 5December 15 -17, 2004 Appropriate testing of national critical systems Doing penetration testing Rigorous test Rigorous test Can be expensive Can be expensive Can identify vulnerabilities other tests and process do not Can identify vulnerabilities other tests and process do not Not doing penetration testing Would we pass the test of “ … sitting in front of a subcommittee hearing explaining our lack of testing of the pathway into the “hacked” system that we knew existed and was exploited” Would we pass the test of “ … sitting in front of a subcommittee hearing explaining our lack of testing of the pathway into the “hacked” system that we knew existed and was exploited”

6. 6December 15 -17, 2004 Results of financial audit Any financial IT system (hardware, software, network, process) under increasing scrutiny “Material weakness” sustained as result of recently published audit

7. 7December 15 -17, 2004 Increasing expectations from Congress and OMB Federal Information Security Act 2002 Greater accountability Greater accountability More monitoring and reporting More monitoring and reporting Language in the OMB FY06 pass back

8. 8December 15 -17, 2004 Takeaways from SES Retreat IT Security is: Mission Impossible Possible to implement and manage Possible to implement and manage Makes NOAA’s mission possible Makes NOAA’s mission possible Integrate into planning and culture Apply the same planning and intellectual investments as applied to the product/service being developed and/or provided Apply the same planning and intellectual investments as applied to the product/service being developed and/or provided