OMB: Federal IT security's better but still not good enough

By William Jackson

Connecting state and local government leaders

| May 27, 2003

Agencies have made progress in evaluating and securing systems, but serious and pervasive problems persist and much work remains to be done, according to the Office of Management and Budget.<br>

Planning and testing is the weakest area of performance measured, OMB concluded. Only about a third of federal systems have contingency plans that agencies have tested in the last year.OMB sited overall performance as best in the first step of the IT security process: identifying systems and assessing their risk. About 65 percent of identified systems have been assessed, up from 43 percent last year. Performance in this area ranges from six agencies'the Education Department, Environmental Protection Agency, NASA, the National Science Foundation, the Nuclear Regulatory Commission and the Social Security Administration'that reported 100 percent of systems evaluated to the two'Transportation Department and Office of Personnel Management'with 12 percent each.OMB found that spending on IT security is increasing, from a total of about $2.7 billion last year to an estimated $4.7 billion for fiscal 2004. Security spending by agency in 2002 ranged from 1.5 percent of the IT budget at the Federal Emergency Management Agency to 22 percent at the State Department. The average was around 3 percent to 4 percent.But OMB added, 'Spending is not a statistically significant factor in determining agency security performance. Rather, the key is effectively incorporating IT security in agency management actions and early in the life of IT systems.'One of the best-performing agencies according to OMB's metrics is NASA, which spent 4 percent of its 2002 IT budget on security. With all of its systems assessed for risk, nearly all of them certified and accredited for operation, and with security policies and tested contingency plans in place for most systems, it appears to be a model agency.But even at NASA, a detailed evaluation revealed problems.OMB was not satisfied with the procedures and guidelines used to evaluate NASA systems, and for the second year found the agency's security program to be a material weakness. The program was not consistently applied, security policies were not adequately enforced, security plans were outdated and incident response was inadequate, OMB said.Although NASA's CIO had concluded that a number of weaknesses reported in 2001 had been corrected, the agency's inspector general disagreed with that assessment.These problems are in part a reflection of NASA's size and decentralized organizational structure. With more than 1,600 systems, it has more than twice the number of most agencies. It illustrates the challenge of achieving a secure IT environment even when metrics are moving in the right direction.

Agencies have made progress in evaluating and securing systems, but serious and pervasive problems persist and much work remains to be done, according to the Office of Management and Budget.

OMB released its second report to Congress last month under the Government Information Security Reform Act. The report compares the performance of 14 departments and 10 independent agencies in fiscal 2002 with baseline data collected in 2001. Future reports will be made under the Federal Information Security Management Act.

Agencies were evaluated individually and not given an overall score or ranked against one another. Despite across-the-board improvements in eight areas, more than a third of federal systems overall still have not been assessed for risk and lack up-to-date security plans, and less than half have been certified and accredited for use.

The 2001 GISRA report identified governmentwide areas of weakness: lack of performance measures and senior management attention, poor security education and awareness, failure to include security in IT capital planning, failure to ensure security of contractor services, and poor information sharing.

'A year later, progress is clearly evident across these areas,' the latest report concluded. 'While additional efforts are still warranted, the federal government is heading in the right direction.'

The report also identified new areas of concern:

The same weaknesses recur year after year.

Inspectors general and CIOs within the same departments have 'vastly different views of the state of the agency's security programs.'

Many agencies are planning new IT programs before they have secured existing ones.

Systems are not being evaluated annually.

Agency program officials are not taking adequate responsibility for the security of their systems.

NEXT STORY: House committee wants data on cyber R&D funds

This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. / Do Not Sell My Personal Information

Accept Cookies