Risk
6/10/2013
04:23 PM
50%
50%

Federal Agencies Graded On Cybersecurity

White House report on cybersecurity goals shows agencies are making progress to keep federal IT systems safe, but they might miss 2014 targets.

Military Drones Present And Future: Visual Tour
Military Drones Present And Future: Visual Tour
(click image for larger view and for slideshow)
Federal agencies have been making significant progress to improve their cybersecurity. However, much more needs to be done as agencies work toward achieving the Obama administration's cross-agency cybersecurity goals by the end of 2014, according to the latest progress report released by the White House.

Last March, federal cybersecurity coordinator Howard Schmidt unveiled a plan for agencies to implement priorities that safeguard federal IT systems against cyberattacks. The White House's objective by the end of 2014 is to have agencies achieve 95% implementation of critical administration cybersecurity capabilities on IT systems in the areas of trusted Internet connections (TIC), continuous monitoring, and strong authentication. The effort is part of the Cross Agency Priority (CAP) Goals initiative on Performance.gov, which feds use to grade agencies on their improvement efforts.

In the second quarter of fiscal year 2013, the government saw significant developments across all three cybersecurity goals and an increase in overall CAP scores. Adoption of cybersecurity capabilities by agencies increased 5%, bringing the overall score to 81%, compared to 76% in the first quarter. When breaking down individual goals, continuous monitoring got a score of 84%, strong authentication scored 67%, TIC consolidation was 84%, and TIC capabilities was 85%.

[ The U.S. isn't ready for a cyberattack, say other sources. Read U.S. Cybersecurity Status Weak, Reports Charge. ]

The government also reported an improvement of 14% in the use of Personal Identity Verification (PIV) cards to access federal information systems under Homeland Security Presidential Directive-12 (HSPD-12). The Department of Defense (DOD) contributed significantly to this improvement. PIV usage increased at the DOD, as well as the number of users remotely and interactively accessing its network. The agency saw almost two million more instances of PIV use than in the first quarter, single-handedly driving the CAP score up by double digits. But not all agencies were quick to adopt two-factor authentication. One-third of agencies are still at 0% for implementing such smart cards for accessing networks, and a quarter are at 5% or less.

When it comes to trust Internet connections, 16 agencies reached the CAP goal of 95%, with the General Services Administration (GSA) making significant gains. Several agencies -- including the Department of Education (DOE), the Department of Health and Human Services (HHS) and the Department of Veterans Affairs (VA) -- came in below the consolidation minimum set for trusted connections, while the Department of Homeland Security (DHS) and the Department of Commerce (DOC) have slipped below the minimum as well.

Twenty agencies have reached the minimum target of 80% for automated asset management, which is part of continuous monitoring, and 11 agencies reached or exceeded the goal of 95%. Across the board, automated configuration management jumped 11.2%, automated asset management rose 2.2%, and automated vulnerability management rose 2.1%. The Department of Agriculture (USDA) and the Social Security Administration (SSA) are among the agencies that saw the biggest increases. For continuous monitoring, agencies are required to submit a monthly security report through CyberScope, an online compliance tool. This mandate is part of the Federal Information Security Management Act (FISMA).

Much work still remains for agencies to implement the White House's cybersecurity capabilities. In fact, according to the progress report, based on current performance plans the federal government will not achieve the CAP 2014 goal.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
anon9697038972
50%
50%
anon9697038972,
User Rank: Apprentice
7/18/2013 | 4:07:53 PM
re: Federal Agencies Graded On Cybersecurity
Thanks for the good insight Elena. This is something that may actually help federal agencies dealing with cybersecurity issues: http://themodernnetwork.com/se...
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9676
Published: 2015-02-27
The seg_write_packet function in libavformat/segment.c in ffmpeg 2.1.4 and earlier does not free the correct memory location, which allows remote attackers to cause a denial of service ("invalid memory handler") and possibly execute arbitrary code via a crafted video that triggers a use after free.

CVE-2014-9682
Published: 2015-02-27
The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.

CVE-2015-0655
Published: 2015-02-27
Cross-site scripting (XSS) vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184.

CVE-2015-0884
Published: 2015-02-27
Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.

CVE-2015-0885
Published: 2015-02-27
checkpw 1.02 and earlier allows remote attackers to cause a denial of service (infinite loop) via a -- (dash dash) in a username.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.