Security weaknesses abound

The first-ever system-by-system analysis of information security at federal agencies showed that familiar vulnerabilities still exist across government, according to a Feb. 13 Office of Management and Budget report to Congress, but long-term fixes for the problems are under way.

The report is based on agency self-assessments sent to OMB last October, as required by the Government In.formation Security Reform Act (GISRA) of 2000. The law also requires OMB to report on the results to Congress.

"The evaluation and reporting requirements of [GISRA] have given OMB and federal agencies an opportunity to record a baseline of agency [information technology] security performance that we have not previously had to this degree of detail," said Mark Forman, OMB's associate director for IT and e-government.

This is the first time agencies have drilled down to the level of individual systems in their assessments of security.

These details, when used with the corrective action plans submitted shortly after the reports last fall, enable agency officials and OMB to identify specific security improvement measures for agencies' fiscal 2003 budget requests and to make better decisions on how to spend remaining fiscal 2002 funding, Forman said.

In fiscal 2002, agencies plan to spend more than $2.7 billion on security — almost 5.7 percent of a total IT investment of almost $48 billion. The fiscal 2003 request for $4.2 billion for security out of $52 billion raises that percentage to almost 8.1 percent.

The OMB analysis, however, uncovered no evidence that the percentage of money spent on security in any way affected the level of security performance, Forman said.

The attention from the Bush administration and agency managers is having an impact, said Sallie McDonald, assistant commissioner for information assurance and critical infrastructure protection at the General Services Ad.ministration. Just a few months ago, most federal employees did not know GISRA existed, but "people know what GISRA is now," she said.

The security weaknesses identified in the report fell into six categories, including inadequate performance measures, few security education and awareness programs, and virtually no meaningful systems to detect, report and share incident information.

However, the self-assessments reveal pockets of excellence, such as the Labor and Housing and Urban Development departments' well-developed programs to integrate security into their IT capital planning process, according to the report.

OMB is working with agencies to extend these and other initiatives to fix the weak security practices.


  • Defense
    Soldiers from the Old Guard test the second iteration of the Integrated Visual Augmentation System (IVAS) capability set during an exercise at Fort Belvoir, VA in Fall 2019. Photo by Courtney Bacon

    IVAS and the future of defense acquisition

    The Army’s Integrated Visual Augmentation System has been in the works for years, but the potentially multibillion deal could mark a paradigm shift in how the Defense Department buys and leverages technology.

  • Cybersecurity
    Deputy Secretary of Homeland Security Alejandro Mayorkas  (U.S. Coast Guard photo by Petty Officer 3rd Class Lora Ratliff)

    Mayorkas announces cyber 'sprints' on ransomware, ICS, workforce

    The Homeland Security secretary announced a series of focused efforts to address issues around ransomware, critical infrastructure and the agency's workforce that will all be launched in the coming weeks.

Stay Connected