04:23 PM

Federal Agencies Graded On Cybersecurity

White House report on cybersecurity goals shows agencies are making progress to keep federal IT systems safe, but they might miss 2014 targets.

Military Drones Present And Future: Visual Tour
Military Drones Present And Future: Visual Tour
(click image for larger view and for slideshow)
Federal agencies have been making significant progress to improve their cybersecurity. However, much more needs to be done as agencies work toward achieving the Obama administration's cross-agency cybersecurity goals by the end of 2014, according to the latest progress report released by the White House.

Last March, federal cybersecurity coordinator Howard Schmidt unveiled a plan for agencies to implement priorities that safeguard federal IT systems against cyberattacks. The White House's objective by the end of 2014 is to have agencies achieve 95% implementation of critical administration cybersecurity capabilities on IT systems in the areas of trusted Internet connections (TIC), continuous monitoring, and strong authentication. The effort is part of the Cross Agency Priority (CAP) Goals initiative on Performance.gov, which feds use to grade agencies on their improvement efforts.

In the second quarter of fiscal year 2013, the government saw significant developments across all three cybersecurity goals and an increase in overall CAP scores. Adoption of cybersecurity capabilities by agencies increased 5%, bringing the overall score to 81%, compared to 76% in the first quarter. When breaking down individual goals, continuous monitoring got a score of 84%, strong authentication scored 67%, TIC consolidation was 84%, and TIC capabilities was 85%.

[ The U.S. isn't ready for a cyberattack, say other sources. Read U.S. Cybersecurity Status Weak, Reports Charge. ]

The government also reported an improvement of 14% in the use of Personal Identity Verification (PIV) cards to access federal information systems under Homeland Security Presidential Directive-12 (HSPD-12). The Department of Defense (DOD) contributed significantly to this improvement. PIV usage increased at the DOD, as well as the number of users remotely and interactively accessing its network. The agency saw almost two million more instances of PIV use than in the first quarter, single-handedly driving the CAP score up by double digits. But not all agencies were quick to adopt two-factor authentication. One-third of agencies are still at 0% for implementing such smart cards for accessing networks, and a quarter are at 5% or less.

When it comes to trust Internet connections, 16 agencies reached the CAP goal of 95%, with the General Services Administration (GSA) making significant gains. Several agencies -- including the Department of Education (DOE), the Department of Health and Human Services (HHS) and the Department of Veterans Affairs (VA) -- came in below the consolidation minimum set for trusted connections, while the Department of Homeland Security (DHS) and the Department of Commerce (DOC) have slipped below the minimum as well.

Twenty agencies have reached the minimum target of 80% for automated asset management, which is part of continuous monitoring, and 11 agencies reached or exceeded the goal of 95%. Across the board, automated configuration management jumped 11.2%, automated asset management rose 2.2%, and automated vulnerability management rose 2.1%. The Department of Agriculture (USDA) and the Social Security Administration (SSA) are among the agencies that saw the biggest increases. For continuous monitoring, agencies are required to submit a monthly security report through CyberScope, an online compliance tool. This mandate is part of the Federal Information Security Management Act (FISMA).

Much work still remains for agencies to implement the White House's cybersecurity capabilities. In fact, according to the progress report, based on current performance plans the federal government will not achieve the CAP 2014 goal.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
7/18/2013 | 4:07:53 PM
re: Federal Agencies Graded On Cybersecurity
Thanks for the good insight Elena. This is something that may actually help federal agencies dealing with cybersecurity issues: http://themodernnetwork.com/se...
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio