Risk
11/10/2009
12:20 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Department Of Interior Fails Cybersecurity Audit

An inspector general assessment of the agency's IT security performance finds poor governance, unqualified staff, and defense technologies that were paid for but not implemented.

The Department of the Interior inspector general has issued a report that's sharply critical of the agency's cybersecurity performance, concluding that its efforts fall short of federal government requirements.

The recently issued report points to broad problems at the agency, from a decentralized IT organization to "fragmented governance processes." It says that the agency has "substantially under-qualified" cybersecurity personnel and that its IT leadership hasn't been as involved in cybersecurity as it should be.

"Personnel responsible for management of the IT programs are not accountable for results, and existing investments are not leveraged to their full potential," the report says. Interior has budgeted $182 million for cybersecurity this year and has 677 employees and contractors devoted to information security and another 3,531 with "significant" responsibilities in that area.

The Department of Interior has CIOs for each of its large bureaus, and those CIOs are supposed to have responsibility for their organizations' IT and cybersecurity. However, the inspector general found that responsibilities were delegated to smaller offices, resulting in inefficiencies and higher costs.

The report describes IT and cybersecurity governance at the department as being inefficient, wasteful, and lacking accountability. It says that Interior has been cited for similar problems in the past by the inspector general and by the Government Accountability Office, but that recommendations for fixing the situation haven't been applied.

A cybersecurity assessment management tool at Interior is used to track cybersecurity progress, but status updates aren't verified or followed up on, so documented problems often go unfixed or inadequately fixed.

Despite guidance from Interior's former CIO that offices should move to an agency-wide remote access system by the beginning of 2007, the Bureau of Land Management and several other agencies continued to maintain separate systems until 2009. What's more, only four bureaus or offices made use of a $900,000 vulnerability-scanning system. And mobile encryption software, though licensed, was never installed.

Among cybersecurity staff, Interior required only self-certified training. The inspector general found that only 13.5% of self certifications were relevant and complete.

The security levels of some IT systems were incorrectly categorized. For example, the U.S. Geological Survey said it had no "high impact" systems, despite the fact that it manages computer systems for earthquake monitoring and research and for toxic substance analysis.

The Department of the Interior manages federal land and administers programs for Native Americans at 2,400 locations. The agency spent $965 million of its annual $17.1 billion budget last year on IT, though only a small percentage of the $182 million spent on cybersecurity is under the direct authority of its CIO.

Sanjeev Bhagowalia became Interior's CIO late last year, after serving as CIO for Indian Affairs and previously in IT management with the FBI and Boeing. In 14 months at Indian Affairs, he was credited with a turnaround of the IT department there.



NewScale shined in our test of four service catalog offerings: portfolios of services that an IT organization offers its end users. But the competitors--CA, PMG, and Service-now.com--also have compelling strengths. Download our report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: nice one
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1235
Published: 2015-04-19
The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy via a crafted HTML document with an IFRAME element.

CVE-2015-1236
Published: 2015-04-19
The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a cr...

CVE-2015-1237
Published: 2015-04-19
Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages ...

CVE-2015-1238
Published: 2015-04-19
Skia, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.

CVE-2015-1240
Published: 2015-04-19
gpu/blink/webgraphicscontext3d_impl.cc in the WebGL implementation in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebGL program that triggers a state inconsistency.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.