IG: USDA monitoring system improves IT security

he Agriculture Department has taken numerous steps to heighten program managers’ awareness of the need to implement effective information security, the department’s Office of Inspector General said.

USDA's chief information officer has also improved oversight of information technology security, including establishing a system to monitor security controls, auditors wrote in a report released Oct. 20 that evaluated the department's compliance with the Federal Information Security Management Act in fiscal 2008.

However, more actions are needed to establish an effective security program, said Phyllis Fong, USDA's IG.

USDA’s most significant accomplishment was deploying a cybersecurity assessment and management system that the Justice Department developed for monitoring FISMA compliance, the report states. The system lets USDA identify common threats and vulnerabilities, supports a security control baseline to help achieve FISMA compliance, and tracks IT weaknesses by monitoring security controls, the report states.

“However, until this system is fully populated and the department’s policies and procedures are in place and are fully operational, IT will continue to be a material weakness,” the report states.

Although USDA has strengthened its IT security program, some improvements were not thorough and complete, including a computer systems inventory, security plans of actions and milestones, and the certification and accreditation of systems, the report states. The IG’s office recommends that USDA create a plan in cooperation with its 29 agencies that tackles each weakness in a systematic way.

To fix department weaknesses, the IG’s report states that USDA should:
* Finish encrypting all laptop PCs.
* Follow the National Institute of Standards and Technology’s security configuration checklist.
* Identify and report security incidents internally to USDA’s CIO and IG and externally to the U.S. Computer Emergency Readiness Team.
* Routinely apply software patches for known vulnerabilities.

About the Author

Mary Mosquera is a reporter for Federal Computer Week.

Featured

  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.