US embassy cable - 04THEHAGUE586

UNCLAS SECTION 01 OF 02 THE HAGUE 000586 
 
SIPDIS 
 
STATE FOR AC/CB, NP/CBM, VC/CCB, L/ACV, IO/S 
SECDEF FOR OSD/ISP 
JOINT STAFF FOR DD PMA-A FOR WTC 
COMMERCE FOR BIS (GOLDMAN) 
NSC FOR CHUPA 
WINPAC FOR LIEPMAN 
 
E.O. 12958: N/A 
TAGS: PARM, PREL, CWC 
SUBJECT: CHEMICAL WEAPONS CONVENTION (CWC): FOURTH SECURITY 
AUDIT TEAM, 23-27 FEBRUARY 2004 
 
 This is CWC-29-04. 
 
1. The fourth Security Audit Team (SAT-IV) found that the 
OPCW Technical Secretariat (TS) had done little to further 
secure its IT infrastructure since the 2001 security audit. 
The team noted that significant personnel resources have been 
directed toward documenting processes and procedures, but few 
practical steps have been taken to ensure the safe and secure 
handling of information assets at the TS.  Additionally, the 
SAT-IV noted that paper handling-processes continue to pose a 
significant vulnerability, and the ability of the TS to 
assess threat levels from the introduction and use of new 
technologies is very limited. 
 
2.  SAT-IV convened its first session 23 to 27 February 2004 
in The Hague and reviewed the TS gap analysis and self 
assessment as related to implementation of international 
standards organization (ISO) 17799. (Comment:  previous SATs 
have recommended the adoption of the ISO standard of best 
practice, as a notional baseline, but cautioned the TS not to 
expend significant resources seeking ISO certification 
standards). 
 
3.  SAT-IV notes that, as directed by the Office of 
Confidentiality and Security (OCS), the TS has devoted 
 
SIPDIS 
significant time and manpower resources to documentation of 
its information technology (IT) procedures, using as its 
justification the previous SAT recommendation to adopt the 
ISO standard.  In the view of SAT-IV, this effort has done 
little to promote the overall security of the TS IT 
environment.  Much of the documentation produced remains 
fragmented, largely due to TS lack of a critically needed IT 
asset inventory and risk assessment. 
 
4.  The consequences of the OCS documentation effort are 
many.  First, the Information Systems Branch (ISB) is 
producing volumes of systems design and testing documentation 
but is not developing needed systems until the documentation 
effort is completed.  The SCN upgrade and data migration have 
been delayed because OCS determined that the necessary 
documentation is insufficient and relevant testing has not 
been done. 
 
5.  The current SCN/Electronic Document Management System 
(EDMS) has changed little since 2001, except for a 
system-wide installation of new network hardware.  (Comment: 
this installation appears to have been done over the past 
year to year and a half, with network servers being procured 
and put into place.  The software upgrades remain in planning 
and testing.)  ISB is developing a test environment and 
implementation plan for upgrading the network operating 
system, but the actual upgrade has been delayed twice and is 
now projected for the April - July 2004 timeframe.  The 
delays are a consequence of inadequate documentation, 
resource limitations (i.e., competing priorities), 
modification to inspector laptops, and inadequate evidence of 
test results.  The upgrade of the operating system to Windows 
2000/server, Office 2000/desktop, Unicenter, Info Image, and 
SQL 7.0 are seen by both the TS and the SAT-IV as critical to 
the enhanced SCN.  SAT-IV offered its assistance in testing 
the operating system prior to live implementation, and SAT-IV 
indicated that this will be a critical component of the 
system-wide audit later this year.  A list of suggested 
automated auditing/testing tools for Windows 2000 environment 
will be made available to the TS by the USG member of the 
SAT-IV. 
 
6.  A system-wide operational audit of the SCN and inspector 
laptop environments is proposed for December 2004.  Interim 
documentation reviews and meetings may be requested by 
SAT-IV, depending on implementation schedule for the 
operating system upgrade. 
 
------------------------- 
RDBMS Development Efforts 
------------------------- 
 
7.   The RDBMS development remains in a planning and 
documentation stage.  Functional, technical, and security 
requirements are being drafted and coordinated among ISB, 
OCS, VER/DEB, and the development contractor.  An expanded 
functional database has been proposed which would include 
declaration processing, declaration redaction, document 
tracking, inspectable site selection, and generation of a 
variety of reports. A working prototype is expected in late 
2004, and will be available for SAT-IV evaluation. 
 
8.  Ito sends. 
 
SOBEL