Risk
11/10/2009
12:20 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Department Of Interior Fails Cybersecurity Audit

An inspector general assessment of the agency's IT security performance finds poor governance, unqualified staff, and defense technologies that were paid for but not implemented.

The Department of the Interior inspector general has issued a report that's sharply critical of the agency's cybersecurity performance, concluding that its efforts fall short of federal government requirements.

The recently issued report points to broad problems at the agency, from a decentralized IT organization to "fragmented governance processes." It says that the agency has "substantially under-qualified" cybersecurity personnel and that its IT leadership hasn't been as involved in cybersecurity as it should be.

"Personnel responsible for management of the IT programs are not accountable for results, and existing investments are not leveraged to their full potential," the report says. Interior has budgeted $182 million for cybersecurity this year and has 677 employees and contractors devoted to information security and another 3,531 with "significant" responsibilities in that area.

The Department of Interior has CIOs for each of its large bureaus, and those CIOs are supposed to have responsibility for their organizations' IT and cybersecurity. However, the inspector general found that responsibilities were delegated to smaller offices, resulting in inefficiencies and higher costs.

The report describes IT and cybersecurity governance at the department as being inefficient, wasteful, and lacking accountability. It says that Interior has been cited for similar problems in the past by the inspector general and by the Government Accountability Office, but that recommendations for fixing the situation haven't been applied.

A cybersecurity assessment management tool at Interior is used to track cybersecurity progress, but status updates aren't verified or followed up on, so documented problems often go unfixed or inadequately fixed.

Despite guidance from Interior's former CIO that offices should move to an agency-wide remote access system by the beginning of 2007, the Bureau of Land Management and several other agencies continued to maintain separate systems until 2009. What's more, only four bureaus or offices made use of a $900,000 vulnerability-scanning system. And mobile encryption software, though licensed, was never installed.

Among cybersecurity staff, Interior required only self-certified training. The inspector general found that only 13.5% of self certifications were relevant and complete.

The security levels of some IT systems were incorrectly categorized. For example, the U.S. Geological Survey said it had no "high impact" systems, despite the fact that it manages computer systems for earthquake monitoring and research and for toxic substance analysis.

The Department of the Interior manages federal land and administers programs for Native Americans at 2,400 locations. The agency spent $965 million of its annual $17.1 billion budget last year on IT, though only a small percentage of the $182 million spent on cybersecurity is under the direct authority of its CIO.

Sanjeev Bhagowalia became Interior's CIO late last year, after serving as CIO for Indian Affairs and previously in IT management with the FBI and Boeing. In 14 months at Indian Affairs, he was credited with a turnaround of the IT department there.



NewScale shined in our test of four service catalog offerings: portfolios of services that an IT organization offers its end users. But the competitors--CA, PMG, and Service-now.com--also have compelling strengths. Download our report here (registration required).

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Equifax CIO, CSO Step Down
Dark Reading Staff 9/15/2017
Cloud Security's Shared Responsibility Is Foggy
Ben Johnson, Co-founder and CTO, Obsidian Security,  9/14/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.