The Government Accountability Office (GAO) wants the Department of Homeland Security (DHS) to push agencies harder on cybersecurity directives, and to engage stakeholders earlier.
DHS issues mandatory cybersecurity directives for most federal agencies. For example, one directive requires agencies to better secure their websites and email systems. If the actions specified in these directives are not addressed, agency systems can remain at risk.
A GAO review has found that these directives have often been effective in strengthening federal cybersecurity. However, agencies and DHS didnt always complete the directives actions on time. DHS also did not consistently ensure that agencies fully complied with the directives.
Since 2015, DHS has issued directives that instruct agencies to mitigate critical vulnerabilities discovered by DHS through its scanning of agencies internet-accessible systems; address urgent vulnerabilities in network infrastructure devices identified by DHS; and better secure the governments highest value and most critical information and system assets.
DHS has established a process for developing and overseeing the implementation of binding operational directives, as authorized by theFederal Information Security Modernization Act of 2014(FISMA). The process includes DHS coordinating with stakeholders early in the directives development process and validating agencies actions on the directives. GAOs review found that when implementing this process, DHS did not coordinate with stakeholders early enough and did not consistently validate agencies self-reported actions.
In addition to being a required step in the directives process, FISMA requires DHS to coordinate with the National Institute of Standards and Technology (NIST) to ensure that the directives do not conflict with existing NIST guidance for federal agencies. However, NIST officials told GAO that DHS often did not reach out to NIST on directives until one to two weeks before the directives were to be issued, and then did not always incorporate the NIST technical comments. DHS and NIST have recently started regular coordination meetings to discuss directive-related issues earlier in the process.
Regarding the validation of agency actions, GAO found that DHS has done so for selected directives, but not for others. GAOs February 4 report said DHS is not well-positioned to validate all directives because it lacks a risk-based approach as well as a strategy to check selected agency-reported actions to validate their completion.
Directives implementation often has been effective in strengthening federal cybersecurity. For example, a 2015 directive on critical vulnerability mitigation required agencies to address critical vulnerabilities discovered by DHS cyber scans of agencies internet-accessible systems within 30 days. This was a new requirement for federal agencies. While agencies did not always meet the 30-day requirement, their mitigations were validated by DHS and reached 87 percent compliance by 2017. DHS officials attributed a recent decline in percentage completion to a 35-day partial government shutdown in late 2018/early 2019. Nevertheless, for the 4-year period under review, agencies mitigated within 30 days about 2,500 of the 3,600 vulnerabilities identified.
Federal civilian agencies have made many significant improvements in cybersecurity by implementing the directives requirements. However, an important performance metric for addressing vulnerabilities identified by high value asset (HVA) assessments does not align with the process DHS has established.
GAO said DHS has only completed about half of the required assessments for fiscal year 2019. In addition, DHS does not plan to issue the guidance, standards, and methodologies on Tier 2 and 3 systems until at least the end of fiscal year 2020. Given these shortcomings, DHS has been reassessing key aspects of the HVA program. However, GAOs review found there was no schedule or plan for completing the HVA reassessment and for addressing the outstanding issues on completing the required assessments, identifying needed resources, and finalizing guidance for Tier 2 and 3 systems.
Without effective schedules and plans, agencies may continue to face increased and prolonged cyber threats. To help address these vulnerabilities, GAO has made four recommendations to DHS.
Determine when in the directive development processfor example, during early development and at directive approvalcoordination with relevant stakeholders, including NIST and GSA, should occur.
Develop a strategy to independently validate selected agencies self-reported actions on meeting binding operational directive requirements, where feasible, using a risk-based approach.
Ensure that the binding operational directive performance metric for addressing vulnerabilities identified by HVA assessments aligns with the process DHS has established.
Develop a schedule and plan for completing the HVA program reassessment and addressing the outstanding issues on completing the required HVA assessments, identifying needed resources, and finalizing guidance for Tier 2 and 3 HVA systems.
DHS agreed with the recommendations and described steps planned or already underway to address them. For example, DHS is working to formalize a risk-based strategy to validate agency results with an estimated completion date of September 30, 2020. The department is also working with the Office of Management and Budget (OMB) to address the need for independent validation.
While figures for 2019 are yet to be released, OMB announced in September that more than 31,000 cyber incidents hit federal agencies in 2018, including phishing attacks and breaches resulting from errors made by authorized users. Threat actors continue to employ persistent and increasingly sophisticated techniques to attack and compromise information systems, and federal agencies and their systems are prime targets. With the added concern this year of election security, it is imperative that DHS works quickly to close gaps in order to strengthen the federal cyber base.
Read the full report at GAO
(Visited 44 times, 45 visits today)
Read this article:
GAO: DHS and Agencies Must Work to Improve Cybersecurity - HSToday