IG: USDA monitoring system improves IT security

he Agriculture Department has taken numerous steps to heighten program managers’ awareness of the need to implement effective information security, the department’s Office of Inspector General said.

USDA's chief information officer has also improved oversight of information technology security, including establishing a system to monitor security controls, auditors wrote in a report released Oct. 20 that evaluated the department's compliance with the Federal Information Security Management Act in fiscal 2008.

However, more actions are needed to establish an effective security program, said Phyllis Fong, USDA's IG.

USDA’s most significant accomplishment was deploying a cybersecurity assessment and management system that the Justice Department developed for monitoring FISMA compliance, the report states. The system lets USDA identify common threats and vulnerabilities, supports a security control baseline to help achieve FISMA compliance, and tracks IT weaknesses by monitoring security controls, the report states.

“However, until this system is fully populated and the department’s policies and procedures are in place and are fully operational, IT will continue to be a material weakness,” the report states.

Although USDA has strengthened its IT security program, some improvements were not thorough and complete, including a computer systems inventory, security plans of actions and milestones, and the certification and accreditation of systems, the report states. The IG’s office recommends that USDA create a plan in cooperation with its 29 agencies that tackles each weakness in a systematic way.

To fix department weaknesses, the IG’s report states that USDA should:
* Finish encrypting all laptop PCs.
* Follow the National Institute of Standards and Technology’s security configuration checklist.
* Identify and report security incidents internally to USDA’s CIO and IG and externally to the U.S. Computer Emergency Readiness Team.
* Routinely apply software patches for known vulnerabilities.

About the Author

Mary Mosquera is a reporter for Federal Computer Week.

Featured

  • Cybersecurity

    DHS floats 'collective defense' model for cybersecurity

    Homeland Security Secretary Kirstjen Nielsen wants her department to have a more direct role in defending the private sector and critical infrastructure entities from cyberthreats.

  • Defense
    Defense Secretary James Mattis testifies at an April 12 hearing of the House Armed Services Committee.

    Mattis: Cloud deal not tailored for Amazon

    On Capitol Hill, Defense Secretary Jim Mattis sought to quell "rumors" that the Pentagon's planned single-award cloud acquisition was designed with Amazon Web Services in mind.

  • Census
    shutterstock image

    2020 Census to include citizenship question

    The Department of Commerce is breaking with recent practice and restoring a question about respondent citizenship last used in 1950, despite being urged not to by former Census directors and outside experts.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.