Security weaknesses abound

The first-ever system-by-system analysis of information security at federal agencies showed that familiar vulnerabilities still exist across government, according to a Feb. 13 Office of Management and Budget report to Congress, but long-term fixes for the problems are under way.

The report is based on agency self-assessments sent to OMB last October, as required by the Government In.formation Security Reform Act (GISRA) of 2000. The law also requires OMB to report on the results to Congress.

"The evaluation and reporting requirements of [GISRA] have given OMB and federal agencies an opportunity to record a baseline of agency [information technology] security performance that we have not previously had to this degree of detail," said Mark Forman, OMB's associate director for IT and e-government.

This is the first time agencies have drilled down to the level of individual systems in their assessments of security.

These details, when used with the corrective action plans submitted shortly after the reports last fall, enable agency officials and OMB to identify specific security improvement measures for agencies' fiscal 2003 budget requests and to make better decisions on how to spend remaining fiscal 2002 funding, Forman said.

In fiscal 2002, agencies plan to spend more than $2.7 billion on security — almost 5.7 percent of a total IT investment of almost $48 billion. The fiscal 2003 request for $4.2 billion for security out of $52 billion raises that percentage to almost 8.1 percent.

The OMB analysis, however, uncovered no evidence that the percentage of money spent on security in any way affected the level of security performance, Forman said.

The attention from the Bush administration and agency managers is having an impact, said Sallie McDonald, assistant commissioner for information assurance and critical infrastructure protection at the General Services Ad.ministration. Just a few months ago, most federal employees did not know GISRA existed, but "people know what GISRA is now," she said.

The security weaknesses identified in the report fell into six categories, including inadequate performance measures, few security education and awareness programs, and virtually no meaningful systems to detect, report and share incident information.

However, the self-assessments reveal pockets of excellence, such as the Labor and Housing and Urban Development departments' well-developed programs to integrate security into their IT capital planning process, according to the report.

OMB is working with agencies to extend these and other initiatives to fix the weak security practices.


  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.