Cybersecurity

Despite improvement, Thrift Board infosec needs work

data protection (Ditty_about_summer/Shutterstock.com) 

The Federal Retirement Thrift Investment Board still has work to do to improve the information security of the systems that safeguard the retirement accounts of millions of armed services and federal workers.

In recent months, the Board has made efforts to firm up its security protocols for its Thrift Savings Plan participants. Retirees and employees hoping to access their spending accounts now have to implement two-factor authentication, a mandate that the Board implemented last December in an effort to cut down on phishing and fraud.

However, the fiscal year 2019 Federal Information Security Modernization Act review showed that FTRIB still had not "fully developed and implemented an effective, organization-wide information security program."

Patrick Bevill, the agency's chief information security office, presented the FISMA audit results at a Feb. 24 board meeting.

Security experts audited all eight of FRTIB's domains for Fiscal Year 2019 at both a systems-specific and agency-wide level. Seven of eight domains measured by the audit, such as risk-management, identity and access management, data protection and privacy, were graded with a maturity level of two or three out of five, indicating that policies are in place but are not consistently implemented.

FTRIB received a score of one in contingency planning, a category covering post-incident recovery. On the FISMA scale, a one indicates that the agency approach is "ad hoc".

Bevill said he's working on two recommendations from the report: to firm up and follow established policies and procedures that would secure and support FRTIB's operations, and to establish performance metrics and corrective actions processes.

About the Author

Lia Russell is a former staff writer and associate editor at FCW.

Featured

  • Defense
    Soldiers from the Old Guard test the second iteration of the Integrated Visual Augmentation System (IVAS) capability set during an exercise at Fort Belvoir, VA in Fall 2019. Photo by Courtney Bacon

    IVAS and the future of defense acquisition

    The Army’s Integrated Visual Augmentation System has been in the works for years, but the potentially multibillion deal could mark a paradigm shift in how the Defense Department buys and leverages technology.

  • Cybersecurity
    Deputy Secretary of Homeland Security Alejandro Mayorkas  (U.S. Coast Guard photo by Petty Officer 3rd Class Lora Ratliff)

    Mayorkas announces cyber 'sprints' on ransomware, ICS, workforce

    The Homeland Security secretary announced a series of focused efforts to address issues around ransomware, critical infrastructure and the agency's workforce that will all be launched in the coming weeks.

Stay Connected