GAO uncovers wireless holes
Connecting state and local government leaders
BY Michael Arnone The wireless networks that many federal agencies use in their Washington, D.C. offices lack essential safeguards to keep information secure, the Government Accountability Office reported today.
BY Michael Arnone
The wireless networks that many federal agencies use in their Washington, D.C. offices lack essential safeguards to keep information secure, the Government Accountability Office reported today.
'Without implementing key controls, agencies cannot adequately secure federal wireless networks and, as a result, their information may be at increased risk of unauthorized disclosure, modification, or destruction,' Gregory Wilshusen, director of information security issues at GAO, warned in the report.
The security lapses exist despite common knowledge that wireless networks are hard to keep secure, the report stated.
The report, which has research from September 2004 to March 2005, found that of the 24 major federal agencies, nine lack any policy at all on wireless networks. Two agencies ban all wireless devices and networks.
Thirteen agencies have policies governing the use and operation of wireless networks, the report found. Seven of the 13, however, have not developed policies on what kind of information employees and contractors may safely transmit wirelessly.
Of those 13 agencies with wireless policies, 12 extend the policies to contractors, the report found. But 18 agencies do not provide training to secure wireless networks to either their staff members or contractors.
Most agencies don't monitor wireless signals to make sure that their employees comply with requirements, the report found. They also do not prevent the leakage of signals outside facilities, or detected unauthorized wireless access.
The agencies have not yet established important protections for their wireless networks, the report found. That includes policies on use, security configuration requirements, continuous and comprehensive monitoring of wireless signals, and training employees and contractors in the agencies' wireless policies.
Asked to evaluate how secure the wireless networks are in federal facilities, the GAO evaluated six unnamed federal agencies in Washington, D.C.
GAO investigators detected wireless signals outside each agency's buildings, which can draw the attention of potential cyberattackers and permit eavesdropping of confidential information. 'In one case, we were able to detect an agency's network while we were testing at another agency several blocks away,' the report stated.
All six agencies had insecure wireless devices operating on their wireless networks, the report found. Some of the wireless devices were also plugged into agencies' internal networks.
One unnamed agency had more than 90 laptops hard-wired into its network but also connected to wireless networks. That setup could allow wireless attackers to get access to the internal, hard-line network, the report stated.
All six agencies had unauthorized individual wireless access points running on their machines and ad hoc networks set up among multiple machines. None of the agencies monitor continuously for unauthorized wireless access.
The federal government must protect against wireless attacks against its networks, physical hijacking of its wireless devices, and preventing unsanctioned networks from infiltrating its facilities, the report read.
The report recommended that the White House's Office of Management and Budget require all federal agencies to improve the security of their wireless networks. Agencies must also integrate wireless security into their information security programs as ordered under FISMA.
In the report, OMB concurred with the GAO's findings. OMB officials said that the National Institute for Standards in Technology is updating its guidance for wireless technology and will send the revisions for comment in August.
OMB officials stated that it is up to agencies to meet FISMA requirements for information security. OMB officials also told the GAO that they would consider including wireless security as a metric in performance reviews of agencies' information security programs.
NEXT STORY: Donley tapped for DOD management planning post