GSA wiki sets bad example

The General Services Administration is setting a bad example on how to monitor its public-facing social media websites, according to a new audit report from the agency’s Office of Inspector General.

While the GSA is increasingly utilizing social media to make its public communications more transparent and participatory, it is falling short on protecting against spam, inappropriate comments and configuration errors, the Sept. 28 report states.

In one case, auditors found that a GSA public wiki displayed spam postings that could have contained malicious malware, and also displayed comments that had not been reviewed by the agency, contrary to the GSA’s own policy.


Related coverage:

GSA tests crowdsourcing wiki for acquisitions


The spam and the unreviewed comments were displayed on the wiki for several months, creating a risk for the GSA that its wiki was being used as a channel for malware or inappropriate comments.

“These postings can affect the organization’s image where visitors view the submitted content as an endorsement,” Carolyn Presley-Doss, deputy assistant inspector general for finance and IT audits, wrote in the report. “They may also affect the website’s availability by making it difficult for users to find necessary content.”

The report did not identify the specific wiki in question. A spokeswoman for the inspector general's office declined to identify the wiki, citing security reasons and the need to protect against cyberattacks. The GSA’s BetterBuy Wiki is probably its best known wiki, providing vendors an avenue to provide feedback on acquisitions. However, the spokeswoman declined to confirm whether BetterBuy was the wiki in the report.

In another example, the GSA improperly configured one of its social media websites so that users’ private communications could have been compromised, the audit report states. The problem occurred because system officials did not follow GSA guidance for Web application security.

The audit recommended updating GSA’s policies and guidance for social media IT security, strengthening reviews of GSA’s social media sites and establishing IT security standards for the social media platforms widely used at GSA.

The report found problems, and advised changes in several other areas, including configuration management, security documentation labeling and contractor background investigations.

GSA Chief Information Officer Casey Coleman said in the report she agreed with the findings and recommendations.

About the Author

Alice Lipowicz is a staff writer covering government 2.0, homeland security and other IT policies for Federal Computer Week.

The Fed 100

Read the profiles of all this year's winners.

Featured

  • Then-presidential candidate Donald Trump at a 2016 campaign event. Image: Shutterstock

    'Buy American' order puts procurement in the spotlight

    Some IT contractors are worried that the "buy American" executive order from President Trump could squeeze key innovators out of the market.

  • OMB chief Mick Mulvaney, shown here in as a member of Congress in 2013. (Photo credit Gage Skidmore/Flickr)

    White House taps old policies for new government makeover

    New guidance from OMB advises agencies to use shared services, GWACs and federal schedules for acquisition, and to leverage IT wherever possible in restructuring plans.

  • Shutterstock image (by Everett Historical): aerial of the Pentagon.

    What DOD's next CIO will have to deal with

    It could be months before the Defense Department has a new CIO, and he or she will face a host of organizational and operational challenges from Day One

  • USAF Gen. John Hyten

    General: Cyber Command needs new platform before NSA split

    U.S. Cyber Command should be elevated to a full combatant command as soon as possible, the head of Strategic Command told Congress, but it cannot be separated from the NSA until it has its own cyber platform.

  • Image from Shutterstock.

    DLA goes virtual

    The Defense Logistics Agency is in the midst of an ambitious campaign to eliminate its IT infrastructure and transition to using exclusively shared, hosted and virtual services.

  • Fed 100 logo

    The 2017 Federal 100

    The women and men who make up this year's Fed 100 are proof positive of what one person can make possibile in federal IT. Read on to learn more about each and every winner's accomplishments.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group