FDIC leads agencies in major cyber incidents


The Federal Deposit Insurance Corporation was responsible for 10 of 16 major information security incidents in FY2016, according to the annual report of the Office of Management and Budget.

The FDIC incidents, linked to a flaw in their system that permitted personally identifiable information to be downloaded to removable media, caused big headaches for tech officials at the agency when they were uncovered by Congress in May 2016.

Overall, however, the outlook appears to be improving for agencies' implementation of information security measures, including the use of dual-factor authentication for employee logins, the adoption of the Einstein 3A security screen by agencies (now said to cover 93 percent of federal employees), and the identification and protection of high value assets.

The annual Federal Information Security Modernization Act report sums up the observations and audits of inspectors general across the federal government and other agency data. Overall, agencies reported 30,899 cybersecurity incidents in fiscal 2016. Loss or theft of equipment was the most frequently reported attack vector with more than 5,300 incidents. Web and phishing attacks were also common, as well as attacks linked to improper usage. However, more than 11,000 incidents defied categorization, according to the report, and are listed only as "other."

Grant Schneider, the acting federal chief information security officer, said that despite improvements, more progress is needed, in a blog post accompanying the release of the report.

OMB was also encouraged by its quarterly review of data from the 23 civilian CFO Act agencies as part of the President's Management Council Cybersecurity Assessment.

According to the study, in the first quarter of fiscal 2016, only five CFO Act agencies had information security programs that met or exceeded government-wide performance goals. By the end of FY 2016 that number had more than doubled to 13 agencies meeting the goals, while all others were making significant progress, according to the report.

The report also said agencies stepped up their efforts to enforce the use of multi-factor Personal Identity Verification cards, with 81 percent of government users now using this credential to access federal networks. It said over 70 percent of federal agencies also have strong anti-phishing and malware capabilities and have also "made significant progress" in securing their high value IT.

About the Author

Mark Rockwell is a senior staff writer at FCW, whose beat focuses on acquisition, the Department of Homeland Security and the Department of Energy.

Before joining FCW, Rockwell was Washington correspondent for Government Security News, where he covered all aspects of homeland security from IT to detection dogs and border security. Over the last 25 years in Washington as a reporter, editor and correspondent, he has covered an increasingly wide array of high-tech issues for publications like Communications Week, Internet Week, Fiber Optics News, magazine and Wireless Week.

Rockwell received a Jesse H. Neal Award for his work covering telecommunications issues, and is a graduate of James Madison University.

Click here for previous articles by Rockwell. Contact him at [email protected] or follow him on Twitter at @MRockwell4.


  • Workforce
    White House rainbow light shutterstock ID : 1130423963 By zhephotography

    White House rolls out DEIA strategy

    On Tuesday, the Biden administration issued agencies a roadmap to guide their efforts to develop strategic plans for diversity, equity, inclusion and accessibility (DEIA), as required under a as required under a June executive order.

  • Defense
    software (whiteMocca/

    Why DOD is so bad at buying software

    The Defense Department wants to acquire emerging technology faster and more efficiently. But will its latest attempts to streamline its processes be enough?

Stay Connected