CBP begins IT access control overhaul after watchdog finds vulnerabilities

U.S. Customs and Border Protection opened the door for attackers by neglecting necessary access controls, according to an audit by the Department of Homeland Security’s office of inspector general.

All CBP network users — amounting to more than 76,000 employees, contractors and other personnel — had access to a highly privileged service account and were able to perform privileged account functions. The oversight enabled any user to alter CBP account passwords, change system access permissions and modify security configurations. Users could also take over accounts that had access to sensitive data. 

Once personnel separated from CBP or transferred to a new role within the component, the agency did not review and remove access as it should have, per the watchdog. The DHS component had difficulties even identifying which accounts were privileged. 

“We identified multiple access control vulnerabilities, which could allow an attacker to compromise CBP’s network, gain access to sensitive information, and disrupt mission-critical operations,” the OIG said in its report. 

CBP told the watchdog office that the blunders occurred due to human error and an inability to accurately track account access changes over time, among other challenges.

While conducting the audit from October 2024 to December 2025, the OIG gathered data and system documentation, observed processes, interviewed officials and performed technical assessments and penetration testing. 

CBP worked quickly on remediation efforts earlier this year once the risks were identified, per the DHS component’s responses to the inspector general’s recommendations.

CBP revoked “all identified excessive privileges” and performed a “validation scan” and found that no other similar misconfiguration existed. Evidence of the work was provided to the OIG in April and July of this year, leading the watchdog to resolve and close one of its recommendations. 

The DHS component also complied with another OIG directive to implement better monitoring of access controls, a process CBP executed and provided evidence of the effort in April and July of this year. The watchdog, however, marked the recommendation as open and resolved, awaiting additional information that demonstrates the monitoring of new alert systems and response protocols. 

The OIG said CBP still has work to do. The watchdog requested the DHS component provide additional documentation that shows the 100-plus attack paths identified were analyzed and any unnecessary accesses were adjusted.

CBP set an end of August deadline for a number of its recommended actions, including the distribution of a memorandum outlining security policies, the development of new methods to remove contractors from directories after separation and the documentation of new IT system access procedures. 

“CBP remains committed to ensuring only authorized users have access to its systems and information,” it said in response to a draft report.

The stakes are high for the DHS unit to upgrade its processes. 

“CBP has more than 67,000 personnel, 4,500 facilities nationwide, and 100 major information technology applications, some of which store and access sensitive law enforcement and biometric information used at ports of entry and along the southern border,” the OIG said in its report. “As a result, CBP’s systems and networks are high-visibility targets for attackers who aim to disrupt mission-essential operations or steal sensitive information.”