IG: Energy's Web sites lack security

Visitors to Energy Department Web sites should not be redirected to pornography, the department’s Inspector General’s Office said in a report.

But that has happened, the oversight office found. DOE sites suffered 60 security incidents on public servers in the past three years, with some 22 incidents occurring in the past year, the report states.

More than half of those attacks resulted in defaced home pages, including the changing of the home page of Brookhaven National Laboratory’s Web site to route visitors to pornographic links.

The IG report also found that some sites had lax controls on publicly accessible information, resulting in eight incidents in which personally identifiable information was exposed. It noted that some of the sites did not meet National Institute of Standards and Technology standards for securing public Web servers.

The IG report recommended that DOE complete guidance on how to secure its agencies’ Web sites. Previous attempts to create such guidance stalled. The agency released a Web guidance manual in 2005 that was never released. DOE created another manual last year that has not been issued yet, but the IG report criticized the draft manual’s lack of specificity and a timeline.

“Facilitating communication with the citizenry is in the national interest,” Energy IG Gregory Friedman said in a letter attached to the March 13 report. “However, the unavoidable fact is that such communication may well impact agency cybersecurity vulnerabilities.”

The report found that some of the national labs have taken proactive steps toward securing their Web sites. The IG praised Oak Ridge, Lawrence Livermore, Los Alamos and Lawrence Berkeley national laboratories for implementing Web applications that detect possible vulnerabilities.

It also noted that the Los Alamos, Lawrence Livermore and Sandia labs developed separate Web sites for use in emergency situations. Additionally, Oak Ridge moved all of its systems and independent Web sites under its central information technology management, resulting in enhanced security and possible cost and time savings.

Featured

  • Contracting
    8 prototypes of the border walls as tweeted by CBP San Diego

    DHS contractors face protests – on the streets

    Tech companies are facing protests internally from workers and externally from activists about doing for government amid controversial policies like "zero tolerance" for illegal immigration.

  • Workforce
    By Mark Van Scyoc Royalty-free stock photo ID: 285175268

    At OPM, Weichert pushes direct hire, pay agent changes

    Margaret Weichert, now acting director of the Office of Personnel Management, is clearing agencies to make direct hires in IT, cyber and other tech fields and is changing pay for specialized occupations.

  • Cloud
    Shutterstock ID ID: 222190471 By wk1003mike

    IBM protests JEDI cloud deal

    As the deadline to submit bids on the Pentagon's $10 billion, 10-year warfighter cloud deal draws near, IBM announced a legal protest.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.