Agencies still struggling with FISMA compliance
Connecting state and local government leaders
The latest GAO report on IT security shows "mixed progress" in implementing required security programs, citing inadequate reporting metrics and a focus on regulatory compliance as the culprits.
The latest assessment of federal IT security shows “mixed progress” in implementing required security programs in fiscal 2012, with inadequate reporting metrics and a focus on regulatory compliance being cited as core problems.
High-risk area
IT security has been designated by GAO as a high-risk area since 1997 and has remained so since. The status is not so much because there has been no improvement in security, but because government dependence on information technology continues to increase as threats evolve and become more complex, making it difficult for agencies to keep up.
The number of IT security incidents reported by agencies to US-CERT has risen steadily, from 42,854 in fiscal 2011 to 48,562 in 2012.
Not all data breaches are the result of hacking. Incidents involving the exposure of personally identifiable information at the 24 major federal agencies increased 110 percent over three years, from 10,207 in fiscal 2009 to 21,459 in 2012. The largest categories of causes were non-cyber (29 percent) and policy violations (19 percent). Malware accounted for 18 percent, and suspicious network activity and social engineering were 5 percent each.
“The security of our computer networks and systems, including federal information systems, continues to be an issue of pressing concern for the nation,” according to the Government Accountability Office report.
The Federal Information Security Management Act requires agencies to establish security programs incorporating eight key elements. In 24 major departments evaluated by GAO some components were more widely implemented in 2012 than in 2011, and some less widely. Although more agencies have security programs in place, 23 of the agencies had weaknesses in the controls that are intended to limit or detect access to computer resources.
One problem is that reporting metrics from the Office of Management and Budget and the Homeland Security Department, which share FISMA oversight, to not cover all requirements and are focused on compliance rather than effectiveness. They also lack performance targets.
DHS agreed with recommendations that reporting metrics should be refocused on the periodic assessment or risk, with tools for evaluating the effectiveness of information security programs. The department responded that it already is shifting from compliance to Continuous Diagnostics and Mitigation (CDM).
“With the advent of CDM, the focus will shift to security outcomes and prioritization of risks, whereas under current FISMA compliance framework, specific data as to the effectiveness of mitigations and the true cost of non-compliance remain limited,” the department’s GAO liaison wrote.
FISMA is the foundation for federal IT security requirements, but agencies and overseers have been challenged to find a way to evaluate compliance that also reflects the security status of systems. Reporting requirements evolve each year, and agencies now are required to provide automated reporting to DHS through CyberScope.
Still, GAO and agency inspectors general continue to report weaknesses in programs. Eighteen agencies had risk management programs in place in 2012, a significant improvement over 2011, but periodic assessments are uneven. Documentation of security programs was widespread, but implementation was inconsistent. Most agencies had weaknesses in access controls (23 agencies out of 24), configuration management (all 24), and segregation of duties (18 of 24).
One of the most significant shifts in IT security is the move to replace periodic testing and evaluation with continuous monitoring. Most agencies reported overall improvement in automated monitoring and reporting capabilities for asset management, configuration and vulnerability assessments. But weaknesses in monitoring remain in most agencies.
“Until steps are taken to address these persistent challenges, overall progress in improving the nation’s cybersecurity posture is likely to remain limited,” GAO concluded.