A recent bipartisan report by the US Senate’s Homeland Security and Governmental Affairs Committee shows that key government agencies have made little progress in terms of cybersecurity over the past two years. A report published in 2019 found that eight federal agencies failed to meet even the basic cybersecurity standards and protocols. Two years later, cybersecurity at those agencies was again analyzed and the findings are as described in the new report “stark.”
The new report, titled “Federal Cybersecurity: America’s Data Still at Risk,” is based on recent inspector general audits. The targeted agencies are the Department of Homeland Security, Department of State, Department of Transportation, Department of Housing and Urban Development, Department of Agriculture, Department of Health and Human Services, Department of Education, and the Social Security Administration.
According to the report, only the DHS has established an effective cybersecurity program, while the rest made only minimal improvements. The findings are alarming considering that threat actors believed to be working for the Chinese and Russian governments successfully infiltrated many federal agencies since the previous report. Moreover, the White House reported 30,819 information security incidents across the federal government for 2020, which represents an 8 percent increase compared to the prior year.
“While several of the agencies made minimal improvements in one or more areas, inspectors general found essentially the same failures as the prior 10 years,” the 47-page report reads. “Only DHS had an effective cybersecurity program for 2020; every other agency failed to implement an effective cybersecurity program.” It adds, “It is clear that the data entrusted to these eight key agencies remain at risk. As hackers, both state-sponsored and otherwise, become increasingly sophisticated and persistent, Congress and the executive branch cannot continue to allow PII and national security secrets to remain vulnerable.”
Problems identified at the audited agencies included unpatched systems, the use of outdated systems and applications, failure to maintain accurate IT asset inventories, and failure to adequately protect personally identifiable information (PII). In addition to pointing out problems, the report makes some recommendations, including the OMB developing and requiring agencies to adopt a risk-based budgeting model for IT investments, a coordinated approach for government-wide cybersecurity to ensure accountability, CISA expanding shared services offerings to federal agencies, and Congress making some changes to the Federal Information Security Modernization Act of 2014.[1]
It is up to all organizations to take steps and adopt procedures to protect themselves from cyberattacks. Federal agencies have improvements to make on their own.
The following is what Red Sky Alliance recommends:
- All data in transmission and at rest should be encrypted.
- Proper data backup and off-site storage policies should be adopted and followed.
- Implement 2-Factor authentication-company-wide.
- For USA readers, join and become active in your local Infragard chapter, there is no charge for membership. infragard.org
- Update disaster recovery plans and emergency procedures with cyber threat recovery procedures. And test them.
- Institute cyber threat and phishing training for all employees, with testing and updating.
- Recommend/require cyber security software, services, and devices to be used by all at-home working employees and consultants.
- Review and update your cyber threat and information security policies and procedures. Make them a part of all emergency planning and training.
- Ensure that all software updates and patches are installed immediately.
- Enroll your company/organization in RedXray for daily cyber threat notifications are directed at your domains. RedXray service is $500 a month and provides threat intelligence on nine (9) cyber threat categories including Keyloggers, with having to connect to your network.
- Purchase annual cyber insurance coverage from Red Sky Alliance provided by Cysurance.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments, or assistance, please contact the office directly at 1-844-492-7225, or feedback@wapacklabs.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.wapacklabs.com/
- LinkedIn: https://www.linkedin.com/company/64265941
[1] https://www.securityweek.com/senate-report-federal-agencies-still-have-poor-cybersecurity-practices
Comments