Agencies falter trying to meet security mandates

OMB's plan of attack

The following are key points in the Office of Management and Budget's latest plan of action to improve IT security, as outlined by Karen Evans, OMB administrator for e-government and IT, in recent testimony before the House Government Reform Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census.


Prioritize IT funding to correct IT security weaknesses


No security, no funding. OMB says agencies' failure to integrate security into new and existing IT assets will imperil funding for those investments.

In their IT budget materials agencies must:


  • Report security costs for IT investments.

  • Document in their business cases that adequate security controls have been incorporated into the lifecycle planning of each IT investment.

  • Reflect the agency's security priorities as reported separately in their 'plans of action and milestones' for fixing programs and systems found to have security vulnerabilities.

  • Tie those plans of action and milestones for an IT investment directly to the business case for that investment.


Expand oversight of agency IT security through the President's Management Agenda scorecard


Gotta get to green. To get to green on the e-government scorecard for IT security, agencies must:

  • Demonstrate consistent progress in resolving IT security weaknesses.

  • Have their inspectors general assess and verify their plans of actions and milestones for fixing systems.

  • Attain certification and accreditation for 90 percent of their systems.


Move closer to performance measurement in IT security requirements


Get ready for performance measures. OMB wants to fold more performance measurement into security mandates and requirements.

Agencies will have to go beyond simple status reporting and also identify the quality of the work done. For example, this year OMB wants agencies to report the extent to which security incidents'such as widespread viruses and worms'occurred on certified and accredited systems and identify the causes.

OMB says performance reporting will help identify areas for improvement and enhance OMB and National Institute of Standards and Technology FISMA guidance.

Florida Republican Rep. Adam Putnam: 'Nobody seems to know what they own."

Henrik G. de Gyor

Alan Paller of the SANS Institute says configuration management is crucial because it requires regular checks of system security, but it is often ignored in favor of inventory management.

Henrik G. de Gyor

Earlier this year, an agency manager stood up during the question-and-answer period at a conference on the Federal Information Security Management Act. He had a gripe about the House Government Reform Committee's report cards on security.

'Our security is higher than ever, but that's not reflected in the scorecards,' he said.

His point'that agencies are better prepared for attacks but still are not getting credit for their efforts'was echoed by a security manager at the Defense Department, which received a D on its security report card.

'I think DOD is doing better than a D,' said the manager, who asked not to be identified. 'In my 20-plus years of being in the government, I think we are more aware of security than ever before and we are taking more proactive steps to make sure we are more secure than ever before.'

As a whole, the 24 major agencies under scrutiny got an overall grade of D on the latest report cards from Government Reform's Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census.

A D grade for the government is simply not acceptable, said Rep. Adam Putnam (R-Fla.), chairman of the subcommittee.

Putnam's report cards place significant weight on agencies' progress in developing and maintaining inventories of mission-critical IT assets and on certification and accreditation of those assets, as required under FISMA.

In Putnam's latest grades, only five of 24 agencies reviewed had done their inventories.

'Nobody seems to know what they own,' Putnam told GCN. 'That's a major concern.'

But some independent security specialists think Putnam's report cards don't put enough emphasis on the section of FISMA that requires agencies to develop systems configuration management benchmarks.

Important clause

'The configuration management clause is at least equally important, and it's being systematically ignored,' said Alan Paller, director of research at the SANS Institute, a security think tank in Bethesda, Md.

'The certification and accreditation process doesn't watch the systems on a continuing basis to see they're safe,' he said. 'It only checks them before anything happens.'

On the other hand, configuration management maintains and monitors systems security settings and up-to-date patches on an ongoing basis.

'Attacks are happening all the time,' Paller said. 'How are we making sure on a week-to-week basis that the systems remain safe? Isn't the [configuration management] clause in FISMA a way to do that?'

Putnam agreed that configuration management is important.

But, he said, 'Frankly, inventory management is more important. I come back to the point that you can't configure what you don't know you have. I'm not diminishing the importance of configuration management, but I've zeroed in on the fact that almost no one has a reliable inventory of assets.'

Putnam said he will look into putting more weight on configuration management in the report cards. 'It's something that's worth exploring,' he said.

Indeed, a key recommendation of the Corporate Information Security Working Group, convened by Putnam's subcommittee, was that the Office of Management and Budget closely monitor agency compliance with the systems configuration requirements in FISMA.

'CIOs in most agencies are unfamiliar with this provision of the law, and action to implement it is nonexistent or lacking,' the panel said in its recent report.

Safe settings

'The vast majority of successful hackings were enabled by security configuration errors caused, in large part, by users who accepted default security settings provided by vendors of the systems they purchased,' the panel said. 'Requiring agencies to find and enforce safe configuration settings for the systems they deploy will improve configuration and reduce the threat to agency systems created by misconfigurations.'

Putnam said his staff is still sifting through all of the panel's recommendations. 'There's a lot of good stuff in there,' he said.

Overall, Putnam expects that the government's grades will soon improve.

'We've held staff-to-staff meetings with two-thirds of the agencies that were scored,' he said. 'I think we're going to see some real progress between [the current] report card and the next one. There seems to be a higher priority being placed on [meeting FISMA goals] and more resources are being put into these issues.'

The subcommittee will issue the next report card near year's end.

In the meantime, Putnam said, he wants to make sure that agency officials are held accountable for ensuring that systems are secure. In fact, he wants one neck to wring.

'This chairman and this subcommittee will seek accountability of the highest agency official responsible for information technology investments to ensure that IT security is baked into the investment decision-making process,' he said at a recent hearing on FISMA.

Putnam soon plans to introduce an amendment to the Clinger-Cohen Act that would require agencies to include IT security in the planning and acquisition phases of systems development.

'We support OMB's efforts to broaden awareness and make all users partners in security, but at the end of the day, our oversight responsibility is to hold someone accountable for making sure that these systems are secure, that they are functioning properly and that they are running efficiently,' he said. 'I want to make sure that everyone's responsibility doesn't become no one's responsibility.'

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above