Government still suffers from information insecurity

Federal agencies continue to struggle with information security, according to a new report from the Government Accountability Office. Weak access controls, network device configuration, and management procedures leave systems vulnerable to malicious attacks and data at risk of exposure.

The report (GAO-08-496), which GAO presented to Congress during a hearing Thursday, summarized agency progress in performing key control activities, the effectiveness of information security efforts, and opportunities to strengthen security, based upon prior audits, federal policies, and inspectors general reports.

"Significant weaknesses continue to threaten the confidentiality, integrity, and availability of critical information and information systems used to support the operations, assets and personnel of federal agencies," the report said. In their fiscal 2007 performance and accountability reports, 20 of 24 major agencies indicated that inadequate information security controls were either a significant deficiency or a material weakness. GAO audits returned similar findings for financial and non-financial systems.

Such weaknesses resulted in a number of reported breaches by agencies, and an increase in security incidents reported to the U.S. Computer Emergency Readiness Team (US-CERT) from 3,634 in fiscal 2005 to 13,029 in fiscal 2007.

GAO organized the most significant information security weaknesses facing agencies into five categories: access controls that ensure only authorized users can view and alter data; software configuration management controls; separation of duties, which offers checks and balances over users' network activities; continuity of operations planning to minimize risk of system outages in emergencies, and agencywide information security programs that meet the requirements of the 2002 Federal Information Security Management Act by properly assessing risk and defining policies for preventing data breaches.

In the area of access controls, GAO found that 19 of 24 major agencies reported weaknesses, including failure to identify and authenticate users, enforce measures to ensure access is appropriate, encrypt sensitive data on networks and mobile devices, and monitor network activities.

GAO pointed to failure to implement security programs as a primary cause of information security weaknesses. In one case, an agency assessed its security risk without any inventory of interconnections between systems. In another, an agency overlooked a number of vulnerabilities that GAO later identified. Program guidelines and testing are often insufficient or out of date, and training of employees on protocols for ensuring information security lacking, auditors found.

Some progress in information security has been made. According to the Bush administration's proposed fiscal 2009 budget, the percentage of certified and accredited systems rose from 88 percent to 92 percent in 2007, and testing of security controls increased from 88 percent to 95 percent of systems. Contingency plan testing increased from 77 percent to 86 percent, and 76 percent of agencies had an effective process in place for identifying and correcting weaknesses using management processes.

"The government has made progress in writing reports, but no progress in improving the [aspects of] security that matter -- keeping the wrong people out," said Alan Paller, director of research at the SANS Institute, a nonprofit cybersecurity research organization in Bethesda, Md. Paller also testified at the hearing, arguing that FISMA requirements laid out by the National Institute of Standards and Technology need to be prioritized.

Currently, agencies receive a list of standards required for FISMA compliance, and are scored according to the percentage met. "When you have children, there will be a time where you want them to do homework along with 10 other things," Paller said. "If you score them on the percentage of what they complete, and the homework is hard, they'll do all the other stuff that matters a whole lot less because it's easy."

Another way to improve information security in the federal government is to have vendors "bake it in with every procurement," Paller said. He pointed to a mandate from the Office of Management and Budget requiring agencies that run, or plan to run, Windows XP or Vista to adopt a specific security configuration. The guidelines include recommended language for use in bids for technology to ensure contractors incorporate the proper security configurations with procured systems.

"It's brilliant," Paller said. "It's the best thing at a high level going on in government to promote information security."

Stay up-to-date with federal news alerts and analysis — Sign up for GovExec's email newsletters.
Close [ x ] More from GovExec

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Sponsored by G Suite

    Cross-Agency Teamwork, Anytime and Anywhere

    Dan McCrae, director of IT service delivery division, National Oceanic and Atmospheric Administration (NOAA)

  • Data-Centric Security vs. Database-Level Security

    Database-level encryption had its origins in the 1990s and early 2000s in response to very basic risks which largely revolved around the theft of servers, backup tapes and other physical-layer assets. As noted in Verizon’s 2014, Data Breach Investigations Report (DBIR)1, threats today are far more advanced and dangerous.

  • Sponsored by One Identity

    One Nation Under Guard: Securing User Identities Across State and Local Government

    In 2016, the government can expect even more sophisticated threats on the horizon, making it all the more imperative that agencies enforce proper identity and access management (IAM) practices. In order to better measure the current state of IAM at the state and local level, Government Business Council (GBC) conducted an in-depth research study of state and local employees.

  • Sponsored by Aquilent

    The Next Federal Evolution of Cloud

    This GBC report explains the evolution of cloud computing in federal government, and provides an outlook for the future of the cloud in government IT.

  • Sponsored by LTC Partners, administrators of the Federal Long Term Care Insurance Program

    Approaching the Brink of Federal Retirement

    Approximately 10,000 baby boomers are reaching retirement age per day, and a growing number of federal employees are preparing themselves for the next chapter of their lives. Learn how to tackle the challenges that today's workforce faces in laying the groundwork for a smooth and secure retirement.

  • Sponsored by Hewlett Packard Enterprise

    Cyber Defense 101: Arming the Next Generation of Government Employees

    Read this issue brief to learn about the sector's most potent challenges in the new cyber landscape and how government organizations are building a robust, threat-aware infrastructure

  • Sponsored by Aquilent

    GBC Issue Brief: Cultivating Digital Services in the Federal Landscape

    Read this GBC issue brief to learn more about the current state of digital services in the government, and how key players are pushing enhancements towards a user-centric approach.


When you download a report, your information may be shared with the underwriters of that document.