Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 05/03/04 issue

Agencies falter trying to meet security mandates

By Richard W. Walker, GCN Staff

Earlier this year, an agency manager stood up during the question-and-answer period at a conference on the Federal Information Security Management Act. He had a gripe about the House Government Reform Committee’s report cards on security.

“Our security is higher than ever, but that’s not reflected in the scorecards,” he said.

His point—that agencies are better prepared for attacks but still are not getting credit for their efforts—was echoed by a security manager at the Defense Department, which received a D on its security report card.

“I think DOD is doing better than a D,” said the manager, who asked not to be identified. “In my 20-plus years of being in the government, I think we are more aware of security than ever before and we are taking more proactive steps to make sure we are more secure than ever before.”

As a whole, the 24 major agencies under scrutiny got an overall grade of D on the latest report cards from Government Reform’s Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census.

A D grade for the government is simply not acceptable, said Rep. Adam Putnam (R-Fla.), chairman of the subcommittee.

Putnam’s report cards place significant weight on agencies’ progress in developing and maintaining inventories of mission-critical IT assets and on certification and accreditation of those assets, as required under FISMA.

In Putnam’s latest grades, only five of 24 agencies reviewed had done their inventories.

“Nobody seems to know what they own,” Putnam told GCN. “That’s a major concern.”

But some independent security specialists think Putnam’s report cards don’t put enough emphasis on the section of FISMA that requires agencies to develop systems configuration management benchmarks.

Important clause

“The configuration management clause is at least equally important, and it’s being systematically ignored,” said Alan Paller, director of research at the SANS Institute, a security think tank in Bethesda, Md.

“The certification and accreditation process doesn’t watch the systems on a continuing basis to see they’re safe,” he said. “It only checks them before anything happens.”

On the other hand, configuration management maintains and monitors systems security settings and up-to-date patches on an ongoing basis.

“Attacks are happening all the time,” Paller said. “How are we making sure on a week-to-week basis that the systems remain safe? Isn’t the [configuration management] clause in FISMA a way to do that?”

Putnam agreed that configuration management is important.

But, he said, “Frankly, inventory management is more important. I come back to the point that you can’t configure what you don’t know you have. I’m not diminishing the importance of configuration management, but I’ve zeroed in on the fact that almost no one has a reliable inventory of assets.”

More news on related topics: Business Process Management, Executive Center, Management, IT Management, IT Security