Cybersecurity

Broadcasting Board of Governors lacks cyber reporting system, IG says

concept cybersecurity art

The State Department's Office of Inspector General has criticized the Broadcasting Board of Governors' IT incident response and reporting program for "not operating effectively" in compliance with federal standards, according to a recent audit.

An effective incident response program is designed to detect cyber infiltrations and promote recovery, but auditors concluded that BBG, the State Department component that runs the Voice of America, did not achieve that goal.

In reviewing seven cybersecurity incidents that took place between October 2014 and May 2015, auditors determined that BBG did not comply with federal standards.

The board did not finalize its official incident response and reporting policy until May 7, 2015, but the report states that "even if the policies and procedures had been in place, the deficiencies would most likely have persisted." That's because the final policy did not comply with guidance from the U.S. Computer Emergency Readiness Team and the National Institute of Standards and Technology.

Furthermore, the policy lacked "essential processes...including risk assessment, host security, network security, malware prevention, and user awareness and training."

US-CERT requires agencies to report and designate a threat level (from zero to six) for all computer security incidents. Auditors concluded that "BBG did not assign category levels for any of the seven cybersecurity incidents tested."

Of those incidents, two unidentified breaches were not even reported to US-CERT, and a third was not reported in "a timely manner."

The report recommends that BBG amend its program to adhere to federal standards. BBG officials said they concurred with the recommendations.

About the Author

Chase Gunter is a former FCW staff writer.

Featured

  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.