Risk
6/10/2013
04:23 PM
50%
50%

Federal Agencies Graded On Cybersecurity

White House report on cybersecurity goals shows agencies are making progress to keep federal IT systems safe, but they might miss 2014 targets.

Military Drones Present And Future: Visual Tour
Military Drones Present And Future: Visual Tour
(click image for larger view and for slideshow)
Federal agencies have been making significant progress to improve their cybersecurity. However, much more needs to be done as agencies work toward achieving the Obama administration's cross-agency cybersecurity goals by the end of 2014, according to the latest progress report released by the White House.

Last March, federal cybersecurity coordinator Howard Schmidt unveiled a plan for agencies to implement priorities that safeguard federal IT systems against cyberattacks. The White House's objective by the end of 2014 is to have agencies achieve 95% implementation of critical administration cybersecurity capabilities on IT systems in the areas of trusted Internet connections (TIC), continuous monitoring, and strong authentication. The effort is part of the Cross Agency Priority (CAP) Goals initiative on Performance.gov, which feds use to grade agencies on their improvement efforts.

In the second quarter of fiscal year 2013, the government saw significant developments across all three cybersecurity goals and an increase in overall CAP scores. Adoption of cybersecurity capabilities by agencies increased 5%, bringing the overall score to 81%, compared to 76% in the first quarter. When breaking down individual goals, continuous monitoring got a score of 84%, strong authentication scored 67%, TIC consolidation was 84%, and TIC capabilities was 85%.

[ The U.S. isn't ready for a cyberattack, say other sources. Read U.S. Cybersecurity Status Weak, Reports Charge. ]

The government also reported an improvement of 14% in the use of Personal Identity Verification (PIV) cards to access federal information systems under Homeland Security Presidential Directive-12 (HSPD-12). The Department of Defense (DOD) contributed significantly to this improvement. PIV usage increased at the DOD, as well as the number of users remotely and interactively accessing its network. The agency saw almost two million more instances of PIV use than in the first quarter, single-handedly driving the CAP score up by double digits. But not all agencies were quick to adopt two-factor authentication. One-third of agencies are still at 0% for implementing such smart cards for accessing networks, and a quarter are at 5% or less.

When it comes to trust Internet connections, 16 agencies reached the CAP goal of 95%, with the General Services Administration (GSA) making significant gains. Several agencies -- including the Department of Education (DOE), the Department of Health and Human Services (HHS) and the Department of Veterans Affairs (VA) -- came in below the consolidation minimum set for trusted connections, while the Department of Homeland Security (DHS) and the Department of Commerce (DOC) have slipped below the minimum as well.

Twenty agencies have reached the minimum target of 80% for automated asset management, which is part of continuous monitoring, and 11 agencies reached or exceeded the goal of 95%. Across the board, automated configuration management jumped 11.2%, automated asset management rose 2.2%, and automated vulnerability management rose 2.1%. The Department of Agriculture (USDA) and the Social Security Administration (SSA) are among the agencies that saw the biggest increases. For continuous monitoring, agencies are required to submit a monthly security report through CyberScope, an online compliance tool. This mandate is part of the Federal Information Security Management Act (FISMA).

Much work still remains for agencies to implement the White House's cybersecurity capabilities. In fact, according to the progress report, based on current performance plans the federal government will not achieve the CAP 2014 goal.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
anon9697038972
50%
50%
anon9697038972,
User Rank: Apprentice
7/18/2013 | 4:07:53 PM
re: Federal Agencies Graded On Cybersecurity
Thanks for the good insight Elena. This is something that may actually help federal agencies dealing with cybersecurity issues: http://themodernnetwork.com/se...
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.