Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

New FISMA Report Shows Progress, Gaps in Federal Cybersecurity

No major incidents mixed with continuing gaps in implementation paint an improving, but still muddy, picture of cybersecurity in the federal government.

Each year, the Office of Management and Budget (OMB) is required to report to Congress on the state of federal cybersecurity, as per the Federal Information Security Modernization Act of 2014 (FISMA). The latest version of the report, for fiscal 2018, is mostly filled with the sort of information common in previous versions — with one big exception: For the first time since "major incident" was defined, not even one was reported.

That's not to say there were no cybersecurity incidents. In fact, 31,107 were reported in 2018 — but even that number is a 12% decrease from the 35,277 incidents reported in fiscal year 2017.

Kiersten Todt, managing director of the Cyber Readiness Institute, believes investments in government security seem to be paying off. "I do think we have comprehensively, in both government and industry, been more effective in taking a risk management approach to cybersecurity, focusing on prevention when possible and resiliency — defined as minimizing disruption — when an incident does occur," she says.

As noted, cybersecurity incidents against federal IT continue. The report notes email remains a top attack vector, with 6,930 incidents reported in 2018. These targeted phishing attacks are no surprise to Sean Finnegan, vice president, federal services, at Coalfire. "It is unlikely there has been a reduction in the number of threat actors and more probable the sophistication of attacks has increased, resulting in a smaller volume with the same level of risk," he says.

The shift may reflect actions of the government as much as changes in criminal priorities. "This could be an indication that the government is improving defense of low-level attacks and threat actors are adapting their tactics to be more focused," Finnegan explains.

While the report contains individual assessments of incidents at 97 agencies, ranging from the American Battle Monuments Commission to the Department of Homeland Security, the aggregated statistics show the government as a whole has yet to meet the implementation targets established by FISMA. Best results came in implementing privileged network access management, where agencies showed, on average, they have hit 94% of the target goal, and 96% of the mobile asset management goal.

The worst performance is in software asset management, where the 58% implementation average is down from 69% in FY 2017. "The federal government is assuredly getting better," says Phil Reitinger, president and CEO at the Global Cyber Alliance. "But so are the bad guys — and they do not take summers off. Incidents also may not have been discovered yet."

Even within the incidents reported, many observers are concerned about gaps, one of which is in fully understanding the threats against federal systems. In 27% of the reported incidents, no attack vector could be identified.

Another area of ongoing concern is the security of contractors and other third parties with legitimate access to federal systems and data. "There have also been successful attacks leveraged against government contractors," says Terence Jackson, CISO at Thycotic. "The malicious actors are targeting the weaker links in the supply chain." Tthe report also notes significant disparities in the state of contractor security for different agencies.

Still, the report is seen as progress by most. And based on budgets, cybersecurity remains a priority within the federal government, with nearly $15 billion set to be invested in non-classified security for fiscal year 2018.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Avoid Technical Debt in Open Source Projects."

 

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jon M. Kelley
50%
50%
Jon M. Kelley,
User Rank: Moderator
8/22/2019 | 12:54:56 PM
OMB issues a nothing happened security report?? really?
An Office of Management and Budget (OMB) data exfiltration was 1st discovered 20Mar2014, but they had no knowledge of when they were hacked, or what was taken. 

Less than two months later, on 7May2014, OMB was hacked again and lost control of their databases until 15Apr2015.  The hackers exfiltrated detailed security investigation reports on 21.5 MILLION American people that had applied for clearances.  OMB 1st reported that no important information was lost. 

I don't think that I would ever trust another OMB report saying that nothing bad had happened, and no important information was lost. 
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
New Attack Campaigns Suggest Emotet Threat Is Far From Over
Jai Vijayan, Contributing Writer,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-3622
PUBLISHED: 2020-01-22
A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18.
CVE-2020-5221
PUBLISHED: 2020-01-22
In uftpd before 2.11, it is possible for an unauthenticated user to perform a directory traversal attack using multiple different FTP commands and read and write to arbitrary locations on the filesystem due to the lack of a well-written chroot jail in compose_abspath(). This has been fixed in versio...
CVE-2019-19834
PUBLISHED: 2020-01-22
Directory Traversal in ruckus_cli2 in Ruckus Wireless Unleashed through 200.7.10.102.64 allows a remote attacker to jailbreak the CLI via enable->debug->script->exec with ../../../bin/sh as the parameter.
CVE-2019-19836
PUBLISHED: 2020-01-22
AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote code execution via a POST request that uses tools/_rcmdstat.jsp to write to a specified filename.
CVE-2019-19843
PUBLISHED: 2020-01-22
Incorrect access control in the web interface in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote credential fetch via an unauthenticated HTTP request involving a symlink with /tmp and web/user/wps_tool_cache.