Risk
11/10/2009
12:20 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Department Of Interior Fails Cybersecurity Audit

An inspector general assessment of the agency's IT security performance finds poor governance, unqualified staff, and defense technologies that were paid for but not implemented.

The Department of the Interior inspector general has issued a report that's sharply critical of the agency's cybersecurity performance, concluding that its efforts fall short of federal government requirements.

The recently issued report points to broad problems at the agency, from a decentralized IT organization to "fragmented governance processes." It says that the agency has "substantially under-qualified" cybersecurity personnel and that its IT leadership hasn't been as involved in cybersecurity as it should be.

"Personnel responsible for management of the IT programs are not accountable for results, and existing investments are not leveraged to their full potential," the report says. Interior has budgeted $182 million for cybersecurity this year and has 677 employees and contractors devoted to information security and another 3,531 with "significant" responsibilities in that area.

The Department of Interior has CIOs for each of its large bureaus, and those CIOs are supposed to have responsibility for their organizations' IT and cybersecurity. However, the inspector general found that responsibilities were delegated to smaller offices, resulting in inefficiencies and higher costs.

The report describes IT and cybersecurity governance at the department as being inefficient, wasteful, and lacking accountability. It says that Interior has been cited for similar problems in the past by the inspector general and by the Government Accountability Office, but that recommendations for fixing the situation haven't been applied.

A cybersecurity assessment management tool at Interior is used to track cybersecurity progress, but status updates aren't verified or followed up on, so documented problems often go unfixed or inadequately fixed.

Despite guidance from Interior's former CIO that offices should move to an agency-wide remote access system by the beginning of 2007, the Bureau of Land Management and several other agencies continued to maintain separate systems until 2009. What's more, only four bureaus or offices made use of a $900,000 vulnerability-scanning system. And mobile encryption software, though licensed, was never installed.

Among cybersecurity staff, Interior required only self-certified training. The inspector general found that only 13.5% of self certifications were relevant and complete.

The security levels of some IT systems were incorrectly categorized. For example, the U.S. Geological Survey said it had no "high impact" systems, despite the fact that it manages computer systems for earthquake monitoring and research and for toxic substance analysis.

The Department of the Interior manages federal land and administers programs for Native Americans at 2,400 locations. The agency spent $965 million of its annual $17.1 billion budget last year on IT, though only a small percentage of the $182 million spent on cybersecurity is under the direct authority of its CIO.

Sanjeev Bhagowalia became Interior's CIO late last year, after serving as CIO for Indian Affairs and previously in IT management with the FBI and Boeing. In 14 months at Indian Affairs, he was credited with a turnaround of the IT department there.



NewScale shined in our test of four service catalog offerings: portfolios of services that an IT organization offers its end users. But the competitors--CA, PMG, and Service-now.com--also have compelling strengths. Download our report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.