Risk
11/10/2009
12:20 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Department Of Interior Fails Cybersecurity Audit

An inspector general assessment of the agency's IT security performance finds poor governance, unqualified staff, and defense technologies that were paid for but not implemented.

The Department of the Interior inspector general has issued a report that's sharply critical of the agency's cybersecurity performance, concluding that its efforts fall short of federal government requirements.

The recently issued report points to broad problems at the agency, from a decentralized IT organization to "fragmented governance processes." It says that the agency has "substantially under-qualified" cybersecurity personnel and that its IT leadership hasn't been as involved in cybersecurity as it should be.

"Personnel responsible for management of the IT programs are not accountable for results, and existing investments are not leveraged to their full potential," the report says. Interior has budgeted $182 million for cybersecurity this year and has 677 employees and contractors devoted to information security and another 3,531 with "significant" responsibilities in that area.

The Department of Interior has CIOs for each of its large bureaus, and those CIOs are supposed to have responsibility for their organizations' IT and cybersecurity. However, the inspector general found that responsibilities were delegated to smaller offices, resulting in inefficiencies and higher costs.

The report describes IT and cybersecurity governance at the department as being inefficient, wasteful, and lacking accountability. It says that Interior has been cited for similar problems in the past by the inspector general and by the Government Accountability Office, but that recommendations for fixing the situation haven't been applied.

A cybersecurity assessment management tool at Interior is used to track cybersecurity progress, but status updates aren't verified or followed up on, so documented problems often go unfixed or inadequately fixed.

Despite guidance from Interior's former CIO that offices should move to an agency-wide remote access system by the beginning of 2007, the Bureau of Land Management and several other agencies continued to maintain separate systems until 2009. What's more, only four bureaus or offices made use of a $900,000 vulnerability-scanning system. And mobile encryption software, though licensed, was never installed.

Among cybersecurity staff, Interior required only self-certified training. The inspector general found that only 13.5% of self certifications were relevant and complete.

The security levels of some IT systems were incorrectly categorized. For example, the U.S. Geological Survey said it had no "high impact" systems, despite the fact that it manages computer systems for earthquake monitoring and research and for toxic substance analysis.

The Department of the Interior manages federal land and administers programs for Native Americans at 2,400 locations. The agency spent $965 million of its annual $17.1 billion budget last year on IT, though only a small percentage of the $182 million spent on cybersecurity is under the direct authority of its CIO.

Sanjeev Bhagowalia became Interior's CIO late last year, after serving as CIO for Indian Affairs and previously in IT management with the FBI and Boeing. In 14 months at Indian Affairs, he was credited with a turnaround of the IT department there.



NewScale shined in our test of four service catalog offerings: portfolios of services that an IT organization offers its end users. But the competitors--CA, PMG, and Service-now.com--also have compelling strengths. Download our report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2012-2588
Published: 2014-09-19
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, or (3) Subject header or (4) body in an SMTP e-mail message.

CVE-2012-6659
Published: 2014-09-19
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-3614
Published: 2014-09-19
Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets.

Best of the Web
Dark Reading Radio