GAO: FBI's internal network has critical security flaws

Information Security: FBI Needs to Address Weaknesses in Critical Network

The FBI could be exposing critical networks and information to attacks and insider threats, the Government Accountability Office says.

In a report published today, GAO found that the FBI uses inadequate information technology security controls on its critical internal networks. The combined security problems could lead to a breach of sensitive information or an insider attack, the report states.

The problems include:
  • Inconsistent configurations for network devices.
  • Inadequate control over identification and authentication to ensure that only authorized individuals can access networks.
  • Individuals’ ability to access information and functions outside what they need to perform their jobs.
  • Unencrypted sensitive data.
  • Patches that were not installed in a timely manner.
  • Employees not following physical security policies with their equipment.
Additionally, although the FBI established the Enterprise Security Operations Center to monitor and protect information systems, the center could not effectively audit and monitor all security-related activity on the network.

“These weaknesses place sensitive information transmitted on the network at risk of unauthorized disclosure or modification, and could result in a disruption of service, increasing the bureau’s vulnerability to insider threats,” the report states.

The report also notes that many of the FBI’s insecurities could violate the Federal Information Security Management Act.

FBI Deputy Chief Information Officer Dean Hall concurred with many of the findings, but told GAO the bureau didn’t believe the weaknesses added up to an increased risk to FBI information.

“The FBI has made significant strides in reducing these risks by establishing policy, processes and procedures to ensure the confidentiality, integrity and availability of law enforcement, investigative and intelligence information,” Hall said.

Featured

  • Contracting
    8 prototypes of the border walls as tweeted by CBP San Diego

    DHS contractors face protests – on the streets

    Tech companies are facing protests internally from workers and externally from activists about doing for government amid controversial policies like "zero tolerance" for illegal immigration.

  • Workforce
    By Mark Van Scyoc Royalty-free stock photo ID: 285175268

    At OPM, Weichert pushes direct hire, pay agent changes

    Margaret Weichert, now acting director of the Office of Personnel Management, is clearing agencies to make direct hires in IT, cyber and other tech fields and is changing pay for specialized occupations.

  • Cloud
    Shutterstock ID ID: 222190471 By wk1003mike

    IBM protests JEDI cloud deal

    As the deadline to submit bids on the Pentagon's $10 billion, 10-year warfighter cloud deal draws near, IBM announced a legal protest.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.