Risk
6/10/2013
04:23 PM
50%
50%

Federal Agencies Graded On Cybersecurity

White House report on cybersecurity goals shows agencies are making progress to keep federal IT systems safe, but they might miss 2014 targets.

Military Drones Present And Future: Visual Tour
Military Drones Present And Future: Visual Tour
(click image for larger view and for slideshow)
Federal agencies have been making significant progress to improve their cybersecurity. However, much more needs to be done as agencies work toward achieving the Obama administration's cross-agency cybersecurity goals by the end of 2014, according to the latest progress report released by the White House.

Last March, federal cybersecurity coordinator Howard Schmidt unveiled a plan for agencies to implement priorities that safeguard federal IT systems against cyberattacks. The White House's objective by the end of 2014 is to have agencies achieve 95% implementation of critical administration cybersecurity capabilities on IT systems in the areas of trusted Internet connections (TIC), continuous monitoring, and strong authentication. The effort is part of the Cross Agency Priority (CAP) Goals initiative on Performance.gov, which feds use to grade agencies on their improvement efforts.

In the second quarter of fiscal year 2013, the government saw significant developments across all three cybersecurity goals and an increase in overall CAP scores. Adoption of cybersecurity capabilities by agencies increased 5%, bringing the overall score to 81%, compared to 76% in the first quarter. When breaking down individual goals, continuous monitoring got a score of 84%, strong authentication scored 67%, TIC consolidation was 84%, and TIC capabilities was 85%.

[ The U.S. isn't ready for a cyberattack, say other sources. Read U.S. Cybersecurity Status Weak, Reports Charge. ]

The government also reported an improvement of 14% in the use of Personal Identity Verification (PIV) cards to access federal information systems under Homeland Security Presidential Directive-12 (HSPD-12). The Department of Defense (DOD) contributed significantly to this improvement. PIV usage increased at the DOD, as well as the number of users remotely and interactively accessing its network. The agency saw almost two million more instances of PIV use than in the first quarter, single-handedly driving the CAP score up by double digits. But not all agencies were quick to adopt two-factor authentication. One-third of agencies are still at 0% for implementing such smart cards for accessing networks, and a quarter are at 5% or less.

When it comes to trust Internet connections, 16 agencies reached the CAP goal of 95%, with the General Services Administration (GSA) making significant gains. Several agencies -- including the Department of Education (DOE), the Department of Health and Human Services (HHS) and the Department of Veterans Affairs (VA) -- came in below the consolidation minimum set for trusted connections, while the Department of Homeland Security (DHS) and the Department of Commerce (DOC) have slipped below the minimum as well.

Twenty agencies have reached the minimum target of 80% for automated asset management, which is part of continuous monitoring, and 11 agencies reached or exceeded the goal of 95%. Across the board, automated configuration management jumped 11.2%, automated asset management rose 2.2%, and automated vulnerability management rose 2.1%. The Department of Agriculture (USDA) and the Social Security Administration (SSA) are among the agencies that saw the biggest increases. For continuous monitoring, agencies are required to submit a monthly security report through CyberScope, an online compliance tool. This mandate is part of the Federal Information Security Management Act (FISMA).

Much work still remains for agencies to implement the White House's cybersecurity capabilities. In fact, according to the progress report, based on current performance plans the federal government will not achieve the CAP 2014 goal.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
anon9697038972
50%
50%
anon9697038972,
User Rank: Apprentice
7/18/2013 | 4:07:53 PM
re: Federal Agencies Graded On Cybersecurity
Thanks for the good insight Elena. This is something that may actually help federal agencies dealing with cybersecurity issues: http://themodernnetwork.com/se...
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5211
Published: 2015-01-27
Stack-based buffer overflow in the Attachmate Reflection FTP Client before 14.1.433 allows remote FTP servers to execute arbitrary code via a large PWD response.

CVE-2014-8154
Published: 2015-01-27
The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect buffer length declaration for the Gstreamer bindings, which allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, which trigger a heap-based buffer overf...

CVE-2014-9197
Published: 2015-01-27
The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, which allows remote attackers to obtain sensitive setup and configuration information via a direct request.

CVE-2014-9198
Published: 2015-01-27
The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an FTP session.

CVE-2014-9646
Published: 2015-01-27
Unquoted Windows search path vulnerability in the GoogleChromeDistribution::DoPostUninstallOperations function in installer/util/google_chrome_distribution.cc in the uninstall-survey feature in Google Chrome before 40.0.2214.91 allows local users to gain privileges via a Trojan horse program in the ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.