Agencies falter trying to meet security mandates

Earlier this year, an agency manager stood up during the question-and-answer period at a conference on the Federal Information Security Management Act. He had a gripe about the House Government Reform Committee's report cards on security.'Our security is higher than ever, but that's not reflected in the scorecards,' he said.His point'that agencies are better prepared for attacks but still are not getting credit for their efforts'was echoed by a security manager at the Defense Department, which received a D on its security report card.'I think DOD is doing better than a D,' said the manager, who asked not to be identified. 'In my 20-plus years of being in the government, I think we are more aware of security than ever before and we are taking more proactive steps to make sure we are more secure than ever before.'As a whole, the 24 major agencies under scrutiny got an overall grade of D on the latest report cards from Government Reform's Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census.A D grade for the government is simply not acceptable, said Rep. Adam Putnam (R-Fla.), chairman of the subcommittee.Putnam's report cards place significant weight on agencies' progress in developing and maintaining inventories of mission-critical IT assets and on certification and accreditation of those assets, as required under FISMA.In Putnam's latest grades, only five of 24 agencies reviewed had done their inventories.'Nobody seems to know what they own,' Putnam told GCN. 'That's a major concern.'But some independent security specialists think Putnam's report cards don't put enough emphasis on the section of FISMA that requires agencies to develop systems configuration management benchmarks.'The configuration management clause is at least equally important, and it's being systematically ignored,' said Alan Paller, director of research at the SANS Institute, a security think tank in Bethesda, Md.'The certification and accreditation process doesn't watch the systems on a continuing basis to see they're safe,' he said. 'It only checks them before anything happens.'On the other hand, configuration management maintains and monitors systems security settings and up-to-date patches on an ongoing basis.'Attacks are happening all the time,' Paller said. 'How are we making sure on a week-to-week basis that the systems remain safe? Isn't the [configuration management] clause in FISMA a way to do that?'Putnam agreed that configuration management is important.But, he said, 'Frankly, inventory management is more important. I come back to the point that you can't configure what you don't know you have. I'm not diminishing the importance of configuration management, but I've zeroed in on the fact that almost no one has a reliable inventory of assets.'Putnam said he will look into putting more weight on configuration management in the report cards. 'It's something that's worth exploring,' he said.Indeed, a key recommendation of the Corporate Information Security Working Group, convened by Putnam's subcommittee, was that the Office of Management and Budget closely monitor agency compliance with the systems configuration requirements in FISMA.'CIOs in most agencies are unfamiliar with this provision of the law, and action to implement it is nonexistent or lacking,' the panel said in its recent report.'The vast majority of successful hackings were enabled by security configuration errors caused, in large part, by users who accepted default security settings provided by vendors of the systems they purchased,' the panel said. 'Requiring agencies to find and enforce safe configuration settings for the systems they deploy will improve configuration and reduce the threat to agency systems created by misconfigurations.'Putnam said his staff is still sifting through all of the panel's recommendations. 'There's a lot of good stuff in there,' he said.Overall, Putnam expects that the government's grades will soon improve.'We've held staff-to-staff meetings with two-thirds of the agencies that were scored,' he said. 'I think we're going to see some real progress between [the current] report card and the next one. There seems to be a higher priority being placed on [meeting FISMA goals] and more resources are being put into these issues.'The subcommittee will issue the next report card near year's end.In the meantime, Putnam said, he wants to make sure that agency officials are held accountable for ensuring that systems are secure. In fact, he wants one neck to wring.'This chairman and this subcommittee will seek accountability of the highest agency official responsible for information technology investments to ensure that IT security is baked into the investment decision-making process,' he said at a recent hearing on FISMA.Putnam soon plans to introduce an amendment to the Clinger-Cohen Act that would require agencies to include IT security in the planning and acquisition phases of systems development.'We support OMB's efforts to broaden awareness and make all users partners in security, but at the end of the day, our oversight responsibility is to hold someone accountable for making sure that these systems are secure, that they are functioning properly and that they are running efficiently,' he said. 'I want to make sure that everyone's responsibility doesn't become no one's responsibility.'