Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

GAO Finds Agencies Lax On Data Protection

Departments that deal with highly sensitive information need better safeguards to secure it against contract workers, finds Government Accountability Office.




Slideshow: Next Generation Defense Technologies
(click for larger image and for full photo gallery)
Some federal agencies that deal with highly sensitive data are not adequately protecting it from contract workers, a new Government Accountability Office (GAO) report found.

The Departments of Defense (DoD), Homeland Security (DHS), and Health and Human Services (HHS) have some guidance and contract provisions in place for what data contractors can access while working at the federal government. However, they have not established appropriate safeguards to keep contract workers away from information they should not have access to, such as employees' personal, proprietary business, and agency-sensitive information, according to the report, released Friday.

The agencies also don't specify contractor responsibilities for prompt notification to the agency if unauthorized disclosure of information or misuse occurs, according to the report.

The Federal Acquisition Regulation (FAR) provides rules for how the government acquires goods and services -- including contract employees -- but it is lacking in these particular areas in terms of access to data, according to the report.

While the DoD, DHS, and HHS -- agencies that very often deal with classified and highly sensitive information -- have supplemented FAR with their own rules and regulations for contractors, they have not gone far enough to protect data, the GAO found.

Insider access to sensitive data on federal computer networks is a chief security concern of federal agencies, as data breaches often occur when someone with access to the network steals or misuses data, or loses a computer on which sensitive data is stored.

According to the report, there are currently pending regulatory changes to FAR to develop a standard approach to protect sensitive information from contractors.

However, FAR still does not cover two critical data-protection scenarios -- the use of nondisclosure agreements to protect sensitive data that contract workers access and the establishment of requirements for contractors to let agencies know when they've accessed such information.

The GAO is recommending that the Office of Federal Procurement Policy administrator work with the FAR Council to oversee changes in the guidelines to address this lack of safeguards.

Agency acquisition policy, IT security, and privacy officials; CIOs; and other affected parties also should be part of the process that adds regulations to FAR, according to the report.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
State of SMB Insecurity by the Numbers
Ericka Chickowski, Contributing Writer,  10/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16404
PUBLISHED: 2019-10-21
Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter.
CVE-2019-17400
PUBLISHED: 2019-10-21
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.
CVE-2019-17498
PUBLISHED: 2019-10-21
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a ...
CVE-2019-16969
PUBLISHED: 2019-10-21
In FusionPBX up to 4.5.7, the file app\fifo_list\fifo_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS.
CVE-2019-16974
PUBLISHED: 2019-10-21
In FusionPBX up to 4.5.7, the file app\contacts\contact_times.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.