Nearly one-third of federal websites haven’t converted to HTTPS
Connecting state and local government leaders
Although federal agencies were to transition their websites to the more-secure HTTPS communications protocol by Dec. 31, some conversions remain a work in progress.
Although federal agencies were to transition their websites to the more-secure HTTPS communications protocol by Dec. 31, some conversions remain a work in progress.
The HTTPS protocol, although it has limitations, establishes an encrypted connection that protects most information exchanged between a website and its user.
In June 2015, an Office of Management and Budget memorandum mandated a governmentwide migration from the unencrypted HTTP to HTTPS for "all publicly accessible federal websites and web services," including application programming interfaces. The memo also included a call to prioritize federal domains that involve an exchange of sensitive or personally identifiable information or receive a substantial amount of traffic.
Since the OMB policy was issued, "HTTPS support among executive branch .gov domains has expanded greatly," a General Services Administration spokesperson told FCW, GCN’s sister site, adding that "web traffic data from analytics.usa.gov suggests that HTTPS is now used for most executive branch .gov web requests."
Most does not mean all. While many agencies have indeed moved to HTTPS, 31 percent of the approximately 1,200 .gov domains monitored by the Pulse dashboard have not completed these conversions.
Pulse was collaboratively built by GSA's 18F and Office of Government-wide Policy to measure progress across all branches of government.
Of the domains tested, 250 received an A+ grade from the Qualys SSL Labs encrypted network communication evaluation, the highest score possible. Many smaller agencies, however, have not yet switched any domains. And the U.S. Postal Service reports HTTPS on just one of six monitored domains, while the Department of Veterans Affairs has moved one of three.
"There is more work to be done in 2017, and agencies should continue closing gaps and preloading as many of their domains as possible," the spokesperson said.
To help transitioning agencies, GSA also launched a help site that provides technical advice and assistance and "works directly with federal staff who are working through migration issues," the spokesperson added.
GSA declined to comment on the migration status of the agencies that failed to meet the deadline.
NEXT STORY: NIST finalizes cyberattack recovery guidance