http://www.fcw.com/fcw/articles/2004/1025/web-dhsig-10-28-04.asp
By Florence Olsen
Oct. 28, 2004
The Homeland Security Department's inspector general has completed an
information security audit of the agency, which shows DHS officials
are still struggling with internal cybersecurity issues.
The report [1], released Oct. 27, highlights areas in which DHS
officials have improved the department's information security
practices and policies. But the overall tone of the report is
negative. "We recommend that DHS continue to consider its information
systems security program a significant deficiency for" fiscal 2004,
the IG auditors state in the report's summary.
The IG conducted the information security audit between April and
September 2004 according to guidelines set by Office of Management and
Budget officials. OMB developed the guidelines to help federal
agencies comply with the Federal Information Security Management Act
of 2002.
The report cited the chief information officer's lack of authority to
manage DHS' departmentwide information technology programs and
spending as a significant factor in the department's struggle to
secure its information systems. It stated that the absence of a formal
reporting relationship between the CIO and the program organizations
within the department continues to undermine DHS' information security
program.
Among the problems cited in the report, the inspector general found 12
systems had been accredited even though key documentation did not meet
the requirements for accreditation.
On a positive note, the IG commended DHS officials for developing
departmentwide security configurations policies and procedures for
Microsoft Corp. Windows 2000 and Sun Microsystems Inc. Solaris
systems. But the report also noted that no DHS organization had
completed configuration requirements for all of its systems.
Steven Cooper, DHS' CIO, was more positive in his written response to
the report. After stating that he generally concurred with the IG's
findings, Cooper wrote that DHS officials have begun a comprehensive
inventory of general support systems and major applications and will
review data captured in the agency's automated FISMA data collection
and reporting system, Trusted Agent FISMA.
The IG's audit revealed problems with verifying the data in the
automated system. For example, Trusted Agent FISMA does not identify
applications and systems that are due for recertification and
accreditation.
[1] http://www.dhs.gov/interweb/assetlibrary/OIG_04-41.pdf
_________________________________________
Open Source Vulnerability Database (OSVDB) Everything is Vulnerable -
http://www.osvdb.org/
