The Department of Energy’s Unclassified Cybersecurity Program for Fiscal Year 2023

Implement procedures to ensure a complete and updated listing of administrative user accounts of Linux servers are included in the review process.

Implement a formalized process to validate or follow up on account removal actions identified during the semi-annual review process to ensure that user accounts align with job responsibilities and least privilege concepts.

Ensure that audit log collection and retention is implemented in accordance with Federal and site-level policies and procedures.

Update and implement existing configuration management procedures for all servers, printers, and services on the production network to enforce changing default credentials before the server or printer is connected to the network.

We recommend that the Manager, Thomas Jefferson Site Office (TJSO), direct Jefferson Science Associates, LLC (JSA) to ensure application security controls are implemented in the Management Information System (MIS) portal to protect against known types of attacks, including cross-site scripting and unauthorized actions.

We recommend that the Manager, TJSO, direct JSA to update the vulnerability remediation process, including monitoring corrective actions for vulnerabilities identified during the scanning process and monitoring patching tools to ensure patches are applied as intended.

Update the vulnerability remediation process to ensure vulnerabilities are appropriately monitored and patches are applied in a timely manner.

Enhance operational vulnerability management procedures to ensure vulnerabilities that cannot be patched, such as configuration weaknesses and unsupported software, are investigated and resolved in a timely manner.

Update and implement vulnerability management procedures to ensure that security vulnerabilities involving anonymous access, default credentials, and vulnerable services are identified, monitored, and remediated.

Update existing web application security risk assessment and testing processes for the WAPA Portal and remediate known web application vulnerabilities.

Enhance operational vulnerability and software patch management procedures to ensure vulnerabilities that cannot be patched, such as configuration weaknesses and unsupported software, are investigated and resolved in a timely manner, or implement a risk acceptance or POA&Ms process.

We continue to recommend that the Manager, Fermi Site Office, direct Fermi Research Alliance, LLC to enhance operational vulnerability management procedures to ensure vulnerabilities that cannot be patched, such as configuration weaknesses and unsupported software, are validated as unfixable, required for the mission, and mitigated to an acceptable risk with Authorizing Official concurrence.

We continue to recommend that the Manager, ORNL Site Office, direct ORNL to:B. Enhance operational vulnerability management procedures to ensure vulnerabilities that cannot be patched, such as configuration weaknesses and unsupported software, are investigated and resolved in a timely manner.

Update existing web application security risk assessment and testing processes for the National Atmospheric Release Advisory Center application and remediate known web application vulnerabilities. (21-LLNL-PT-01)

We continue to recommend that the Manager, ORNL Site Office, direct the contractor responsible for operating the WARS to implement security controls to correct the identified vulnerabilities by taking the following actions:B. Upgrade or replace unsupported software and install the latest security updates/patches for all servers, workstations, and networked devices within the system boundary.

We continue to recommend that the Manager, ORNL Site Office, direct the contractor responsible for operating the WARS to implement security controls to correct the identified vulnerabilities by taking the following actions:D. Disable unencrypted services and replace them with alternate services that are configured to use strong encryption. Establish a configuration monitoring process to prevent future use of unencrypted services and services using weak encryption settings.

"Finalize implementation of the updated vulnerability management plan to ensure corrective actions for vulnerabilities identified are applied to effectively implement patches and fixes, as required. If required remediation timelines cannot be adhered to, consistently document the risk acceptance, business rationale, and/or technical issue(s) related to vulnerability remediation."

Install endpoint protection software on all applicable servers, workstations, and networked devices and ensure that this software can receive regular updates.

Ensure that audit log collection and retention is implemented in accordance with Federal and site-level policies and procedures.

Ensure application security controls are implemented in the MIS portal to protect against known types of attacks, including cross-site scripting and unauthorized actions.

Update the vulnerability remediation process, including monitoring corrective actions for vulnerabilities identified during the scanning process and monitoring patching tools to ensure patches are applied as intended.

Update and implement existing configuration management procedures for all servers and services on the production network to enforce changing default credentials before the server is connected to the network.

Ensure application security controls are implemented in the WAPA development Portal to protect against known types of attacks, including cross-site scripting and unauthorized actions.

Update the vulnerability identification and software patch management process to ensure vulnerabilities are appropriately monitored and patches are applied in a timely manner.

Update the vulnerability remediation process, including monitoring corrective actions for vulnerabilities identified during the scanning process, monitoring vendor patch releases and end-of-life notifications, and monitoring patching tools to ensure patches are applied, as intended.

Identify all servers, workstations, and networked devices within the WARS boundary that are necessary for its successful operation. Remove any unnecessary assets, update system documentation to include relevant details, monitor the WARS for future changes, and maintain an accurate asset list.