Risk
11/10/2009
12:20 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Department Of Interior Fails Cybersecurity Audit

An inspector general assessment of the agency's IT security performance finds poor governance, unqualified staff, and defense technologies that were paid for but not implemented.

The Department of the Interior inspector general has issued a report that's sharply critical of the agency's cybersecurity performance, concluding that its efforts fall short of federal government requirements.

The recently issued report points to broad problems at the agency, from a decentralized IT organization to "fragmented governance processes." It says that the agency has "substantially under-qualified" cybersecurity personnel and that its IT leadership hasn't been as involved in cybersecurity as it should be.

"Personnel responsible for management of the IT programs are not accountable for results, and existing investments are not leveraged to their full potential," the report says. Interior has budgeted $182 million for cybersecurity this year and has 677 employees and contractors devoted to information security and another 3,531 with "significant" responsibilities in that area.

The Department of Interior has CIOs for each of its large bureaus, and those CIOs are supposed to have responsibility for their organizations' IT and cybersecurity. However, the inspector general found that responsibilities were delegated to smaller offices, resulting in inefficiencies and higher costs.

The report describes IT and cybersecurity governance at the department as being inefficient, wasteful, and lacking accountability. It says that Interior has been cited for similar problems in the past by the inspector general and by the Government Accountability Office, but that recommendations for fixing the situation haven't been applied.

A cybersecurity assessment management tool at Interior is used to track cybersecurity progress, but status updates aren't verified or followed up on, so documented problems often go unfixed or inadequately fixed.

Despite guidance from Interior's former CIO that offices should move to an agency-wide remote access system by the beginning of 2007, the Bureau of Land Management and several other agencies continued to maintain separate systems until 2009. What's more, only four bureaus or offices made use of a $900,000 vulnerability-scanning system. And mobile encryption software, though licensed, was never installed.

Among cybersecurity staff, Interior required only self-certified training. The inspector general found that only 13.5% of self certifications were relevant and complete.

The security levels of some IT systems were incorrectly categorized. For example, the U.S. Geological Survey said it had no "high impact" systems, despite the fact that it manages computer systems for earthquake monitoring and research and for toxic substance analysis.

The Department of the Interior manages federal land and administers programs for Native Americans at 2,400 locations. The agency spent $965 million of its annual $17.1 billion budget last year on IT, though only a small percentage of the $182 million spent on cybersecurity is under the direct authority of its CIO.

Sanjeev Bhagowalia became Interior's CIO late last year, after serving as CIO for Indian Affairs and previously in IT management with the FBI and Boeing. In 14 months at Indian Affairs, he was credited with a turnaround of the IT department there.



NewScale shined in our test of four service catalog offerings: portfolios of services that an IT organization offers its end users. But the competitors--CA, PMG, and Service-now.com--also have compelling strengths. Download our report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2808
Published: 2015-04-01
The PRNG implementation in the DNS resolver in Bionic in Android before 4.1.1 incorrectly uses time and PID information during the generation of random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a rel...

CVE-2014-9713
Published: 2015-04-01
The default slapd configuration in the Debian openldap package 2.4.23-3 through 2.4.39-1.1 allows remote authenticated users to modify the user's permissions and other user attributes via unspecified vectors.

CVE-2015-0259
Published: 2015-04-01
OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.

CVE-2015-0800
Published: 2015-04-01
The PRNG implementation in the DNS resolver in Mozilla Firefox (aka Fennec) before 37.0 on Android does not properly generate random numbers for query ID values and UDP source ports, which makes it easier for remote attackers to spoof DNS responses by guessing these numbers, a related issue to CVE-2...

CVE-2015-0801
Published: 2015-04-01
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.