The program is in limbo while the tool awaits an ATO, prompting the inspector general’s office to express its “concerns.”
The inspector general for the Federal Deposit Insurance Corporation—the independent government agency charged with regulating national banks—is raising an alarm about the lack of security authorizations for a tool used to stand up secure, temporary Wi-Fi networks.
The wireless solution in question “allows users to set up, monitor and configure wireless networks through a cloud-based service,” according to a memo released publicly Tuesday citing “Concerns Related to the FDIC’s Pending Authorization to Operate Its External Wireless Network Solution Cloud Service.” The FDIC IG noticed the discrepancy while working on a report on the overall security posture of the agency’s wireless networks.
The “wireless solution” tool was originally developed in 2017 to help the Division of Resolutions and Receiverships stand up secure Wi-Fi networks during bank closings. Over time, it has been used by other FDIC units, including the Corporate University, which used it for exams that have web-based components, and the Division of Information Technology, or DIT, which uses it to help set up mobile devices.
By early 2018, the solution was ready to get approval from FDIC’s Security and Enterprise Architecture Technical Advisory Board, including an authority to operate, or ATO. However, the board came back to DIT suggesting that the program did not fit the National Institute of Standards and Technology’s definition of a cloud service, but rather should be categorized as an “outsourced solution.”
Without an official “cloud service” designation, the wireless solution did not need an ATO. Instead, it went through a process called the Outsourced Solution Assessment Methodology, or OSAM.
“In April 2019, DIT determined that it had completed the necessary OSAM processes to move the wireless solution into the production environment for use,” the audit states. “DRR first used the wireless solution for a bank closing in October 2019.”
But a year prior, NIST made changes to its risk management framework that made the OSAM program redundant by adding supply chain risk management to the RMF process. By June 2020, FDIC cybersecurity officials rescinded the OSAM approval for the wireless solution and told DIT the program would need an official ATO.
The program office started the ATO process by reaching out to the vendor. “The vendor, however, was not able to provide sufficient documentation to support an ATO,” the IG found, though the product was moving through the process for a provisional ATO from the Federal Risk and Authorization Management Program, or FedRAMP.
FedRAMP was created for just such a scenario: enabling a vendor to run its product through the ATO process with the Joint Authorization Board, or JAB, which can then be tweaked for use at individual agencies and programs across government.
But more than a year and a half later, the ATO is in limbo.
“As of April 2021, according to a DIT information security manager, the FedRAMP readiness assessment for the wireless solution was delayed until July 2021 with a FedRAMP authorization expected approximately a year later, in July 2022,” the report states.
Without the proper authorizations in place, FDIC can’t use a program it has spent more than $1.2 million developing, including services and devices.
“Although the [Chief Information Officer Organization] followed the OSAM processes prior to placing the wireless solution in operation, the CIOO has not been able to fully assess the risks and authorize the wireless solution to operate in the FDIC’s IT environment consistent with NIST guidance,” the report states. “Therefore, the CIOO should consider whether additional actions should be taken such as putting in place an acceptance of risk for the wireless solution pending the completion of the FedRAMP authorization process and ATO.”
In their response, FDIC officials cited a July 2021 memo titled, “Acknowledgement of Systems Operating Under Legacy Approvals,” which identified legacy apps and tools that were approved under now-outdated frameworks like OSAM. The memo outlines the process for getting those legacy apps authorized and approves their use in the interim.
“With this memo, the FDIC authorizing official recorded the decision to allow the continued operation of the FDIC systems currently operating under legacy approval,” the response states, noting the chief information security officer is working through each identified legacy system. “While actions are ongoing to fully implement the [risk management framework], the FDIC has approved the wireless solution to be used across all divisions and offices under a legacy approval process.”
While the lack of ATO is concerning for the IG, the report notes the agency “has not had a business need to use the wireless solution since February 2020.”
