Shocking Lack Of Cybersecurity At Federal Agencies

In a world where cyber-resilience is sorely lacking, one would hope U.S. government agencies would be well prepared in the fight against cybercrime. Not so fast – a recent joint report from the Department of Homeland Security (DHS) and the Office of Management and Budget (OMB) found otherwise. A cyber-risk report ordered by the President finds that out of 96 federal agencies, 71 are at “risk or high risk” of cyber intrusion. Overall, 74% of government agencies aren’t even close to being prepared against cyberattacks. Not at all a comforting prospect.

Other report findings are just as disturbing. It finds allocating adequate resources is a huge snafu for cyber preparedness. The report shows the agencies lack information about how hackers get access to their systems. From there, limited resources can’t be adequately appropriated to the areas they’re most needed.

Out of the 30,899 cyber incidents in 2016 that led to data compromise in government agencies, 38% (11,802) of the attacks happened without being able to find out how or why – 16 of those incidents met the threshold of being major hacks. In other words, the agencies don’t know where the system weaknesses are, so they don’t get the funds to fix them. A true recipe for disaster.

Last year alone, several government agencies faced successful hacks, many of which gained national notoriety. Wikileaks released a list of CIA hacking tools they obtained while the data passed between government employees and contractors. This happened because the information was being transmitted in an “unauthorized manner” by both parties and was easily obtained by Wikileaks. From 2016 to 2017, the IRS had over 100,000 users of its Free Application for Student Aid tax information breached. Hackers managed to file 8,000 applications that stole $30 million from the U.S. government. In another case, U.S. Forces Korea and Republic of Korea Armed Forces were hacked by a North Korean group. They stole joint operation wartime plans along with other data including information about power plants and key military facilities.

The above are just a few of the ongoing hacks and data breaches U.S. government agencies continually face. Clearly there’s a desperate need for greater cybersecurity, yet plans to boost security are slow in coming about. While the DHS and OMB report sheds light on cybersafe inadequacies in the U.S. government, knowing they exist is not nearly enough. According to the report, all agencies must “take bold approaches to improve federal cybersecurity.” The report suggests actions toward that goal. Standardizing and consolidating cybersecurity practices throughout the agencies is key. If every agency is on the same cybersecurity page for policy and procedure, progress can start from there.

In a bipartisan letter from the senate to national security advisor John Bolton, it said in part “Our country’s cybersecurity should be a top priority; therefore, it is critically important that the U.S. government present a unified front in defending against cyberattacks.” Easier said than done.