Cybersecurity

Broadcasting Board of Governors lacks cyber reporting system, IG says

concept cybersecurity art

The State Department's Office of Inspector General has criticized the Broadcasting Board of Governors' IT incident response and reporting program for "not operating effectively" in compliance with federal standards, according to a recent audit.

An effective incident response program is designed to detect cyber infiltrations and promote recovery, but auditors concluded that BBG, the State Department component that runs the Voice of America, did not achieve that goal.

In reviewing seven cybersecurity incidents that took place between October 2014 and May 2015, auditors determined that BBG did not comply with federal standards.

The board did not finalize its official incident response and reporting policy until May 7, 2015, but the report states that "even if the policies and procedures had been in place, the deficiencies would most likely have persisted." That's because the final policy did not comply with guidance from the U.S. Computer Emergency Readiness Team and the National Institute of Standards and Technology.

Furthermore, the policy lacked "essential processes...including risk assessment, host security, network security, malware prevention, and user awareness and training."

US-CERT requires agencies to report and designate a threat level (from zero to six) for all computer security incidents. Auditors concluded that "BBG did not assign category levels for any of the seven cybersecurity incidents tested."

Of those incidents, two unidentified breaches were not even reported to US-CERT, and a third was not reported in "a timely manner."

The report recommends that BBG amend its program to adhere to federal standards. BBG officials said they concurred with the recommendations.

About the Author

Chase Gunter is a former FCW staff writer.

Featured

  • Defense

    DOD wants prime contractors to be 'help desk' for new cybersecurity model

    The Defense Department is pushing forward with its unified cybersecurity standard for contractors and wants large companies and industry associations to show startups and smaller firms the way.

  • FCW Perspectives
    tech process (pkproject/Shutterstock.com)

    Understanding the obstacles to automation

    As RPA moves from buzzword to practical applications, agency leaders say it’s forcing broader discussions about business operations

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.