Risk
6/10/2013
04:23 PM
50%
50%

Federal Agencies Graded On Cybersecurity

White House report on cybersecurity goals shows agencies are making progress to keep federal IT systems safe, but they might miss 2014 targets.

Military Drones Present And Future: Visual Tour
Military Drones Present And Future: Visual Tour
(click image for larger view and for slideshow)
Federal agencies have been making significant progress to improve their cybersecurity. However, much more needs to be done as agencies work toward achieving the Obama administration's cross-agency cybersecurity goals by the end of 2014, according to the latest progress report released by the White House.

Last March, federal cybersecurity coordinator Howard Schmidt unveiled a plan for agencies to implement priorities that safeguard federal IT systems against cyberattacks. The White House's objective by the end of 2014 is to have agencies achieve 95% implementation of critical administration cybersecurity capabilities on IT systems in the areas of trusted Internet connections (TIC), continuous monitoring, and strong authentication. The effort is part of the Cross Agency Priority (CAP) Goals initiative on Performance.gov, which feds use to grade agencies on their improvement efforts.

In the second quarter of fiscal year 2013, the government saw significant developments across all three cybersecurity goals and an increase in overall CAP scores. Adoption of cybersecurity capabilities by agencies increased 5%, bringing the overall score to 81%, compared to 76% in the first quarter. When breaking down individual goals, continuous monitoring got a score of 84%, strong authentication scored 67%, TIC consolidation was 84%, and TIC capabilities was 85%.

[ The U.S. isn't ready for a cyberattack, say other sources. Read U.S. Cybersecurity Status Weak, Reports Charge. ]

The government also reported an improvement of 14% in the use of Personal Identity Verification (PIV) cards to access federal information systems under Homeland Security Presidential Directive-12 (HSPD-12). The Department of Defense (DOD) contributed significantly to this improvement. PIV usage increased at the DOD, as well as the number of users remotely and interactively accessing its network. The agency saw almost two million more instances of PIV use than in the first quarter, single-handedly driving the CAP score up by double digits. But not all agencies were quick to adopt two-factor authentication. One-third of agencies are still at 0% for implementing such smart cards for accessing networks, and a quarter are at 5% or less.

When it comes to trust Internet connections, 16 agencies reached the CAP goal of 95%, with the General Services Administration (GSA) making significant gains. Several agencies -- including the Department of Education (DOE), the Department of Health and Human Services (HHS) and the Department of Veterans Affairs (VA) -- came in below the consolidation minimum set for trusted connections, while the Department of Homeland Security (DHS) and the Department of Commerce (DOC) have slipped below the minimum as well.

Twenty agencies have reached the minimum target of 80% for automated asset management, which is part of continuous monitoring, and 11 agencies reached or exceeded the goal of 95%. Across the board, automated configuration management jumped 11.2%, automated asset management rose 2.2%, and automated vulnerability management rose 2.1%. The Department of Agriculture (USDA) and the Social Security Administration (SSA) are among the agencies that saw the biggest increases. For continuous monitoring, agencies are required to submit a monthly security report through CyberScope, an online compliance tool. This mandate is part of the Federal Information Security Management Act (FISMA).

Much work still remains for agencies to implement the White House's cybersecurity capabilities. In fact, according to the progress report, based on current performance plans the federal government will not achieve the CAP 2014 goal.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
anon9697038972
50%
50%
anon9697038972,
User Rank: Apprentice
7/18/2013 | 4:07:53 PM
re: Federal Agencies Graded On Cybersecurity
Thanks for the good insight Elena. This is something that may actually help federal agencies dealing with cybersecurity issues: http://themodernnetwork.com/se...
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-8626
Published: 2014-11-22
Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding...

CVE-2014-8710
Published: 2014-11-22
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.

CVE-2014-8711
Published: 2014-11-22
Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?