A new report released by the Government Accounting Office before a Congressional hearing last Thursday shows the government still has a lot of work to firm up its information security efforts. "The report (GAO-08-496), summarized agency progress in performing key control activities, the effectiveness of information security efforts, and opportunities to strengthen security, based upon prior audits, federal policies, and inspectors general reports," according to a story published last Friday on GovernmentExecutive.com.
"Significant weaknesses continue to threaten the confidentiality, integrity, and availability of critical information and information systems used to support the operations, assets and personnel of federal agencies," the report said. The issue is not isolated to just a handful of agencies. According to the story, "20 of 24 major agencies indicated that inadequate information security controls were either a significant deficiency or a material weakness."
In fact, according to the U.S. Computer Emergency Readiness Team (US-CERT), there has actually been an increase in security incidents reported by federal agencies over the past three years, from 3,634 in fiscal 2005 to 13,029 in fiscal 2007.
In the report, the GAO has organized the most significant information security weaknesses facing agencies into five categories:
- access controls that ensure only authorized users can view and alter data
- software configuration management controls
- separation of duties, which offers checks and balances over users' network activities
- continuity of operations planning to minimize risk of system outages in emergencies
- agencywide information security programs that meet the requirements of the 2002 Federal Information Security Management Act by properly assessing risk and defining policies for preventing data breaches
"The government has made progress in writing reports, but no progress in improving the [aspects of] security that matter -- keeping the wrong people out," Alan Paller, director of research at the SANS Institute, a nonprofit cybersecurity research organization in Bethesda, Md, was quoted as saying in the story. Paller also testified during the Congressional hearing where the GAO report was presented. During his presentation, Paller recommended "that FISMA requirements laid out by the National Institute of Standards and Technology need to be prioritized."
Given that FISMA has been on the books since 2002, the number of reported security incidents is actually increasing, nearly all Federal agencies are suffering deficiencies or material weaknesses, it is clear that something needs to change, and change fast.
For more on this issue, read my post from last Friday. If you are looking for some answers on how to address either FISMA compliance or the FDCC, I'd encourage you to watch both Standardizing Windows Desktop Configurations and FISMA Reporting with Ecora Auditor Pro.
Contributed by Mark Tordoff
Comments