IG: USDA monitoring system improves IT security

he Agriculture Department has taken numerous steps to heighten program managers’ awareness of the need to implement effective information security, the department’s Office of Inspector General said.

USDA's chief information officer has also improved oversight of information technology security, including establishing a system to monitor security controls, auditors wrote in a report released Oct. 20 that evaluated the department's compliance with the Federal Information Security Management Act in fiscal 2008.

However, more actions are needed to establish an effective security program, said Phyllis Fong, USDA's IG.

USDA’s most significant accomplishment was deploying a cybersecurity assessment and management system that the Justice Department developed for monitoring FISMA compliance, the report states. The system lets USDA identify common threats and vulnerabilities, supports a security control baseline to help achieve FISMA compliance, and tracks IT weaknesses by monitoring security controls, the report states.

“However, until this system is fully populated and the department’s policies and procedures are in place and are fully operational, IT will continue to be a material weakness,” the report states.

Although USDA has strengthened its IT security program, some improvements were not thorough and complete, including a computer systems inventory, security plans of actions and milestones, and the certification and accreditation of systems, the report states. The IG’s office recommends that USDA create a plan in cooperation with its 29 agencies that tackles each weakness in a systematic way.

To fix department weaknesses, the IG’s report states that USDA should:
* Finish encrypting all laptop PCs.
* Follow the National Institute of Standards and Technology’s security configuration checklist.
* Identify and report security incidents internally to USDA’s CIO and IG and externally to the U.S. Computer Emergency Readiness Team.
* Routinely apply software patches for known vulnerabilities.

About the Author

Mary Mosquera is a reporter for Federal Computer Week.

Featured

  • Workforce
    By Mark Van Scyoc Royalty-free stock photo ID: 285175268

    OPM nominee plans focus on telework, IT, retirement

    Kiran Ahuja, a veteran of the Office of Personnel Management, told lawmakers that she thinks that the lack of consistent leadership in the top position at OPM has taken a toll on the ability of the agency to complete longer term IT modernization projects.

  • Defense
    Soldiers from the Old Guard test the second iteration of the Integrated Visual Augmentation System (IVAS) capability set during an exercise at Fort Belvoir, VA in Fall 2019. Photo by Courtney Bacon

    IVAS and the future of defense acquisition

    The Army’s Integrated Visual Augmentation System has been in the works for years, but the potentially multibillion deal could mark a paradigm shift in how the Defense Department buys and leverages technology.

Stay Connected