DHS needs to step up its game in federal cybersecurity

The Homeland Security Department was given the lead in overseeing the Federal Information Security Management Act in 2010, but according to the DHS Office of Inspector General, government cybersecurity remains very much a work in process.

Efforts to make FISMA a more responsive tool for protecting government IT systems are hampered by a lack of a strategic plan with long-term goals and metrics, according to the recently released OIG report.  CyberScope, a primary tool for automating and enabling continuous monitoring of systems, provides only limited ability to assess security status and is itself not fully protected by baseline security configurations.

CyberScope System Architecture and Encryption Elements

Inspectors also found that security training for contractors running CyberScope is not documented, a finding that Rep. Bennie G. Thompson (D-Miss.) called disturbing in light of recent leaks from former Booz Allen Hamilton employee Edward Snowden abut National Security Agency surveillance programs.

“It is puzzling that DHS has not taken the solid steps to ensure its contractor workforce gets proper security training,” Thompson, ranking member of the House Homeland Security Committee, said in a statement. “With the recent national security leak revelations involving a contractor at NSA, we no longer have to speculate about whether contractors are capable of leaking sensitive information.”

The report contains six recommendations for the National Protection and Programs Directorate’s (NPPD), which DHS has agreed to and says it is working on implementing.

The Office of Management and Budget has statutory authority for overseeing FISMA and has designated DHS the lead agency, with NPPD’s Office of Cybersecurity and Communications, Federal Network Resilience division, managing FISMA reporting and cybersecurity evaluations. A major complaint of FISMA has long been that documenting compliance has siphoned away agency resources needed for improving security. This situation has improved somewhat under DHS.

Just two agencies of 10 interviewed by the OIG complained that the annual reporting process is a strain on available personnel resources. And just “one agency stated that, instead of spending resources to implement technical controls and automated capabilities to monitor and protect its networks, it had to divert available funding to ensure FISMA compliance and address the annual reporting metrics.”

CyberScope, a cornerstone of the automated reporting process, is a Web-based application for delivering monthly security and vulnerability data feeds intended to improve risk management and situational awareness. But although it has eased some reporting burdens, it has provided little other return so far.

“The current data feeds do not provide the fidelity or reliability required to provide a detailed vulnerability picture,” the report said. They “are useful for informing decision makers of large-scale trends and possible threats concerning the existence of unsupported (end-of-life) operating system and software. The feeds also provide useful (though rough) situational awareness data regarding the types of monitoring tools being used and the fullness of current implementations.” This lack of detailed analysis has contributed to a lack of feedback.

Current CyberScope feeds were called only a transitional tool toward more comprehensive continuous monitoring. Plans are under way to make CyberScope information more useful in spotting vulnerabilities and evaluating security.

Although the report stops short of saying CyberScope is not secure, it points out that DHS has not implemented all of the security controls and baseline configurations required for its IT systems, which could allow unauthorized access. Problems spotted included improper guest and default accounts on the system and the granting of elevated permissions to a public group that could expose parts of the system.

The lack of a strategic plan with milestones and metrics for fulfilling its cybersecurity responsibilities was a primary shortcoming identified in the report. This was partially the a result of a rapidly evolving role at DHS coupled with high management turnover in the last year. Michael Locatis left his post as assistant secretary in the Office of Cybersecurity and Communications in January; Matt Coose left his post as director of the Federal Network Security Branch in July; and the head of the Cybersecurity Performance Management branch left in March.

DHS has agreed with all six recommendations included in the report:

• Coordinate with the Office of Management and Budget to develop a strategic implementation plan identifying long-term goals and milestones for FISMA compliance.
• Update and finalize internal operating procedures and guidance documents so that cyber responsibilities and procedures are clearly defined.
• Improve communication and coordination with agencies by making FISMA reporting metrics more clear.
• Implement a process to analyze and provide detailed feedback on agencies’ monthly vulnerability data feeds.
• Establish a process to ensure that all CyberScope contractor system administrators have received adequate security training in compliance with applicable guidance.
• Implement all required DHS baseline configuration settings on the CyberScope database.