The State Department and 3 Other US Agencies Earn a D For Cybersecurity (arstechnica.com) 43
An anonymous reader quotes a report from Ars Technica: Cybersecurity at eight federal agencies is so poor that four of them earned grades of D, three got Cs, and only one received a B in a report issued Tuesday by a US Senate Committee. "It is clear that the data entrusted to these eight key agencies remains at risk," the 47-page report stated. "As hackers, both state-sponsored and otherwise, become increasingly sophisticated and persistent, Congress and the executive branch cannot continue to allow PII and national security secrets to remain vulnerable."
The report, issued by the Senate Committee on Homeland Security and Governmental Affairs, comes two years after a separate report found systemic failures by the same eight federal agencies in complying with federal cybersecurity standards. The earlier report (PDF) found that during the decade spanning 2008 to 2018, the agencies failed to properly protect personally identifiable information, maintain a list of all hardware and software used on agency networks, and install vendor-supplied security patches in a timely manner. The 2019 report also highlighted that the agencies were operating legacy systems that were costly to maintain and hard to secure. All eight agencies -- including the Social Security Administration and the Departments of Homeland Security, State, Transportation, Housing and Urban Development, Agriculture, Health and Human Services, and Education -- failed to protect sensitive information they stored or maintained.
Tuesday's report, titled Federal Cybersecurity: America's Data Still at Risk, analyzed security practices by the same agencies for 2020. It found that only one agency had earned a grade of B for its cybersecurity practices last year. "What this report finds is stark," the authors wrote. "Inspectors general identified many of the same issues that have plagued Federal agencies for more than a decade. Seven agencies made minimal improvements, and only DHS managed to employ an effective cybersecurity regime for 2020. As such, this report finds that these seven Federal agencies still have not met the basic cybersecurity standards necessary to protect America's sensitive data." State Department systems, the auditors found, frequently operated without the required authorizations, ran software (including Microsoft Windows) that was no longer supported, and failed to install security patches in a timely manner. The department's user management system came under particular criticism because officials couldn't provide documentation of user access agreements for 60 percent of sample employees that had access to the department's classified network. "This network contains data which if disclosed to an unauthorized person could cause 'grave damage' to national security," the auditors write. "Perhaps more troubling, State failed to shut off thousands of accounts after extended periods of inactivity on both its classified and sensitive but unclassified networks. According to the Inspector General, some accounts remained active as long as 152 days after employees quit, retired, or were fired. Former employees or hackers could use those unexpired credentials to gain access to State's sensitive and classified information, while appearing to be an authorized user. The Inspector General warned that without resolving issues in this category, 'the risk of unauthorized access is significantly increased.'"
Ars Technica adds that the Social Security Administration "suffered many of the same shortcomings, including a lack of authorization for many systems, use of unsupported systems, failure to Compile an Accurate and Comprehensive IT Asset Inventory, and Failure to Provide for the Adequate Protection of PII."
The report, issued by the Senate Committee on Homeland Security and Governmental Affairs, comes two years after a separate report found systemic failures by the same eight federal agencies in complying with federal cybersecurity standards. The earlier report (PDF) found that during the decade spanning 2008 to 2018, the agencies failed to properly protect personally identifiable information, maintain a list of all hardware and software used on agency networks, and install vendor-supplied security patches in a timely manner. The 2019 report also highlighted that the agencies were operating legacy systems that were costly to maintain and hard to secure. All eight agencies -- including the Social Security Administration and the Departments of Homeland Security, State, Transportation, Housing and Urban Development, Agriculture, Health and Human Services, and Education -- failed to protect sensitive information they stored or maintained.
Tuesday's report, titled Federal Cybersecurity: America's Data Still at Risk, analyzed security practices by the same agencies for 2020. It found that only one agency had earned a grade of B for its cybersecurity practices last year. "What this report finds is stark," the authors wrote. "Inspectors general identified many of the same issues that have plagued Federal agencies for more than a decade. Seven agencies made minimal improvements, and only DHS managed to employ an effective cybersecurity regime for 2020. As such, this report finds that these seven Federal agencies still have not met the basic cybersecurity standards necessary to protect America's sensitive data." State Department systems, the auditors found, frequently operated without the required authorizations, ran software (including Microsoft Windows) that was no longer supported, and failed to install security patches in a timely manner. The department's user management system came under particular criticism because officials couldn't provide documentation of user access agreements for 60 percent of sample employees that had access to the department's classified network. "This network contains data which if disclosed to an unauthorized person could cause 'grave damage' to national security," the auditors write. "Perhaps more troubling, State failed to shut off thousands of accounts after extended periods of inactivity on both its classified and sensitive but unclassified networks. According to the Inspector General, some accounts remained active as long as 152 days after employees quit, retired, or were fired. Former employees or hackers could use those unexpired credentials to gain access to State's sensitive and classified information, while appearing to be an authorized user. The Inspector General warned that without resolving issues in this category, 'the risk of unauthorized access is significantly increased.'"
Ars Technica adds that the Social Security Administration "suffered many of the same shortcomings, including a lack of authorization for many systems, use of unsupported systems, failure to Compile an Accurate and Comprehensive IT Asset Inventory, and Failure to Provide for the Adequate Protection of PII."
Maybe they should follow the DoD (Score:5, Interesting)
Reading the article some of the things they're doing would mean an IT director would be ousted at the DoD. I can say that the security there was very good, and it forced me to get my first certificate (Security+) Pretty much all IT staff at a minimum have to have it within 6 months of their date of hire, or they get ejected. All of these agencies have the basics to be good (PIV smartcard systems, tons of money)
I will say the agency I'm currently with (VA) is much more laxed than the DoD. The Doctors are spoiled brats, and if they don't get their way they'll call the hospital director, who will call your area manager, and basically shit will roll downhill. At the DoD if someone didn't get their mandatory training done, their PIV was turned off. for most windows access. They could come to the NEC and complete said training. VA that is completely tossed out the window. Fuck it, better to just clear the disable code out and re-enable before the doctor or student starts bitching.
I'd imagine it's much of the same at these other agencies, but just not as scrutinized as the DoD. Some director somewhere basically screaming at IT to "JUST MAKE IT WORK, I DON'T CARE" and it's done. No POAM, nothing.
Maybe if these other agencies had penalties as stiff as the DoD (Ranging from an area manager being ousted to jail time in Leavenworth) maybe they would take their cyber seriously. Until some examples are made, this is nothing more than farts in the wind and will likely to continue ad infinium.
Re: (Score:2)
Why does each Department and each branch of government have their own IT and cybersecurity and security? They are really bad at learning from each other or adapting best practices from each other.
Quite ironic coming from the organization that practically invented the word "interoperability".
There should be a single IT/cybersecurity group that provides those services to all of government. Any issue found anywhere could be corrected and implemented throughout the whole government.
Again, rather ironic coming from the organization that justified NIST 800-53/171. One would think they hold themselves to a single standard. At least now we know why they further justified CMMC, but honestly this grade was to be expected. We've been reading about "D" security scores across government since Bill Gates was a pauper. OPM hack still stands as one of the worst in history, and yet seems not much ha
Re: (Score:2)
There is the other side of that though..
While I realize that IT management rolling up into the same HR hierarchy and having the same managers does not mean that systems are all tightly integrated and tied together it probably does mean that even if different departments don't share things like authentication providers etc they would probably end up using the same technologies and in the same configurations, on the same refresh/update/patch cycles which would mean the same attacks would likely compromise all
Re:One IT Dept should provide all IT for all Depts (Score:5, Interesting)
Because they all have their own sets of problems and regulations and risk profiles. Why don't all systems just use the security controls that (at least mostly) protect highly classified information? Because compliance costs effort and money, and you need a cost/benefit analysis to figure out what makes sense.
If you were starting from scratch, it would make sense to have a template or five that could be used across the federal government. But there is history; agencies' critical systems were often developed before the Internet was so widely used, and they cannot afford to stop doing their statutory functions for years while replacing the IT infrastructure.
Ultimately, IT security is an overhead cost. It's not why these agencies exist. Resources spent on it are resources that are not spent on Job #1, so there needs to be constant pressure and accountability to define and meet the requirements. You can't do that with a single solution for the entire government.
Re: (Score:2)
Because they all have their own sets of problems and regulations and risk profiles. Why don't all systems just use the security controls that (at least mostly) protect highly classified information? Because compliance costs effort and money, and you need a cost/benefit analysis to figure out what makes sense.
Another issue is they do not necessarily trust another agency to do something for fear if the other agency screw it up they will get blamed, not the other agency.
>If you were starting from scratch, it would make sense to have a template or five that could be used across the federal government. But there is history; agencies' critical systems were often developed before the Internet was so widely used, and they cannot afford to stop doing their statutory functions for years while replacing the IT infrastructure.
Exactly. In some cases, legacy systems have grown so complex that properly documenting functions, processes, etc. to write a requirements document would take years; and by the time the system is in place it would already be outdated. Attempts to replace systems often collapse under their own weight.
Re: (Score:2)
A few elaborations, after further thought:
This report is an example of pressure and accountability in action. We'd prefer the agencies to pass, but they didn't.
Even within an agency, you'll find different systems with different security policies. This happens in the private sector as well: Companies who are root CAs protect those keys much differently than corporate email, which in turn is different from their public-facing web site.
Finally, if you want to see what a government-wide template for security
Re: (Score:2)
There isn't a cost/benefit analysis involved. It is a cost-of-doing/cost-of-not-doing issue. The cost of not doing is insurmountable, so all effort and money is necessary. It is also a "no time to lose" situation. It must be done NOW.
That's just the technical side. There is also a legal side of the issue, and the Federal government is breaking the law. These agencies are mandated to implement a set of controls that
Ransomware (Score:2)
This is the one benefit that these high profile ransomware attacks have had. An acquaintance of mine does plant floor cybersecurity for a major manufacturer. The plants were highly resistant to implementing even basic security, like not using one universal password to access certain panels, or timing out logins.
Then, Honda got shut down for a couple of weeks, costing, probably, hundreds of millions of dollars. All of a sudden plant floor security became a priority.
Implementing security is always considered
Less important data? (Score:3)
To be fair the VA is dealing with 'confidential' data that is personal rather than important to the US government, so unless the VA data indicates the vet had been in a country doing things that the US never admitted to doing, it's less important. Or Area 53 staff?!
Re: (Score:2)
Heads should roll over this, and I hope the right ones do. I work for a real estate company, and it seems I'm under far more pressure to maintain compliance than some of our most sensitive Federal agencies.
And you know it isn't the area managers who are at fault here. This is because of failures much further up the chain. Like, Assistant Deputy Directors or entre
Woohoo! (Score:3)
"D" is usually the lowest *passing* grade.
Re: Woohoo! (Score:2)
So that's why I got a "D" in home ec.
Thank you. I just won a bet. (Score:1)
He'll never pay up, he'll never even admit he's wrong, but I think he will read this and know.
Re: (Score:1)
Of course they knew. How much more of an open secret can you have then sending someone official e-mails to a separate domain?
I am going to moderated into oblivion for saying this but it was very much political. Hillary was head at State, Obama was Head of State and the bureaucrats supported them generally. So it was 'no big deal' when they bent the rules, nobody in an position of responsibility would stand up to them and call them out.
Enter Trump who they did not like and actually challenged their politic
Re: Is this from TheOnion or BabylonBee? (Score:1)
Re: (Score:1)
No that would dipshits that honestly believe Biden's 8million vote pickup of HRC was legit.
The Biden presidency is a fraud!
Terrorists? Overthrow? WTF???? (Score:2)
If the UNARMED thousands of people at the capitol on Jan 6th who raped nobody, murdered nobody, burned no buildings, kidnapped nobody, and shot nobody are "terrorists", you've got a mighty strange rhetorical scale. Tell me: what do you call the BLM activists who murdered nearly 30 people over the summer of 2020? Do words matter at all anymore, or are we now living under Orwellian rules?
Remember: the only person shot dead on Jan 6ths was an unarmed female USAF veteran Trump supporter who was gunned down by a
Many problems here (Score:2)
Are the salaries in the public sector high enough to attract really competent staff? Are they political appointees - could be given their wage rate - in which case the explanation is there...
Does Congress have the will to embarrass its party's appointees? Will it summons the secretaries of these departments and give them a good kicking? Is the budget sufficient to address these issues? Starting an impeachment process aimed at the assistant secretary of state responsible (yes, I know they'll have moved on, b
Re: (Score:3)
Are the salaries in the public sector high enough to attract really competent staff?
It depends on what a person wants for a lifestyle. Salaries are not has high in the private sector, but are decent and offer generous benefits, vacation time you can actually use, a lack of death marches to get code out, laws against unpaid overtime, and a real retirement with benefits. In addition, the chances of you getting a 2 weeks notice because your job has been outsourced or your company bought are virtually nil. It's a tradeoff that depends on the lifestyle you want. If a position warrants it they
Re: (Score:2)
A GS-
Re: (Score:2)
Well, you do have government shutdowns that could prevent you from getting a paycheck. And being in the DC area, it is hard to convince younger people to take federal pay given housing prices. It's not about wanting to afford a Porsche and a McMansion, but it would be nice to be able to live without needing 2 incomes. And is why I'm a consultant and not a fed employee. A retirement fund is nice, but given they are going after the DoD pension, I expect the civilian pensions to have numbered days. A GS-15, the top non-executive pay band, caps at 172k in the DC area. That sounds awesome until you realize that IT engineers can get more than that as a contractor. And the average DC house price is 700k. So yeah, the people that came here in the 90's are doing well, and the younger people are struggling. The government is addicted to contracting in IT. But they manage it terribly. Partly why there is a push to go to the cloud, it shifts the blame.
Yea ,shutdowns are crazy. TSA should have closed DCA / BWI / IAD so no elected official could leave town easily. Enjoy holidays alone in DC.
DC is expensive. A lot of feds commute in from surrounding areas, often with the various regional rail systems to the Metro. Still, that can ad an hour or more to your commute each way, but you get a DC salary at Baltimore or lower prices.
Re: (Score:1)
Re:Many problems here (Score:4, Informative)
Salaries are one thing, actually firing people for a lack of performance is another. You can pay as much as you want but if you're not getting rid of people who suck at their jobs you are not going to get anywhere. Tough ask in a government agency.
There's a simple and obvious fix. (Score:2)
Re: (Score:2)
The DOD actually did a significant bug bounty program a while back. I am going to disagree though with this being a good idea. The government is a little different animal than some e-tail site.
A public bug bounty would provide a lot of noise cover for very dangerous threat actors to hide their active recon activities in. I Think the better path here would be for government to hoover up all it can on methods, practices, and IOCs from the commercial world, tune up its IDS sensors and knock on the doors of ne
How to improve the grade (Score:3)
This is insanely easy but it requires managers to do more and it limits what managers can do. Which is why they won't do it.
Step 1: Don't place mission-critical systems on the public Internet. This includes all SCADA hardware.
Step 2: Implement firewall rules to exclude anything you don't absolutely need. Ideally, require outside users to go through proxies in the DMZ and don't allow any direct visibility into or out of the network. If you can, use AIDA, Snort or some other NIDS to alter firewall rules if an attack is detected.
Step 3: Secure systems as outlined by the Orange Book (so utilize SELinux and RBACS on Linux, for example) and related. Disable Bluetooth and all USB ports. All LAN traffic should be encrypted. Never, ever use rhosts and use public keys rather than passwords over networks where possible.
Step 4: Follow recommendations by security advisory software such as SARA (a systems checker) or Nessus (a remote vulnerability scanner).
Step 5: Avoid privilege escalation by limiting the privileges software has access to. Use Linux Capabilities to disable any features not in use anywhere and CGroups to disable features unless specifically needed by that group.
Step 6: In-house software should follow CERT guidelines for secure C, C++ and Java code, should be written as per NASA's Power of Ten guidelines and should be properly tested. If it's C or C++, Valgrind and DMalloc/Electric Fence are your friends. If it's critical, write the tests first as per test-driven development.
So you're basically running a bunch of scripts and applying some style guides. Hardly rocket science.
Remember when? (Score:1)
I remember when the State Dept had some self-entitled Karen hosting her email on her own private server... with some top secret shit in it. A while after the world found out about it, her IT guy was mysteriously shot dead.
Stuff like that is the reason why they should have an "F" grade until they fix their shit. I have been in places that are "eyes only" and air-gapped. And IMHO that is what high-level stuff should be.
Re: (Score:2)
Ironically, that Karen was right, because her server did not get hacked, but the State Dept did get hacked.
How much are they spending on "woke" training? (Score:2)
This problem exists because high-ranking bureaucrats prioritized their personal political prefe
A D! (Score:2)
What's the problem? Everyone knows that a D is good enough for government work.
Smart people don't want.. (Score:2)
..to follow government rules, dress codes and take drug tests
Say it isn't so. (Score:2)
Hrm.. let me see, I've got my surprised look around here somewhere.. Oh, here it is...*gasp!*
I believe this may have to do with the chaos and turmoil that was churned up in the last sets of turnover from administrations. You can't run these things like a business, because those get compromised by semi-state sponsored hacking groups. These things have to be run by dedicated professionals, who are immunized against political upheaval. When they aren't, your armor cracks and the enemy gets inside.
Don't mis
Who cares any more? (Score:2)