In response to the ongoing threats to federal systems and operations posed by cyber attacks, Pres. Bush established the Comprehensive National Cybersecurity Initiative (CNCI) in 2008. This initiative consists of a set of projects aimed at reducing vulnerabilities, protecting against intrusions, and anticipating future threats. This report determined: (1) what actions have been taken to develop interagency mechanisms to plan and coordinate CNCI activities; and (2) what challenges CNCI faces in achieving its objectives related to securing federal information systems. To do this, the report reviewed CNCI plans, policies, and other documentation and interviewed officials at OMB, DHS, and the ODNI, among other agencies. Charts and tables.
Cloud computing, an emerging form of computing where users have access to scalable, on-demand capabilities that are provided through Internet-based technologies, has the potential to provide info. technology (IT) services more quickly and at a lower cost, but also to introduce IT risks. This report: (1) identified the models of cloud computing; (2) identified the info. security implications of using cloud computing services in the fed. gov¿t.; and (3) assessed fed. guidance and efforts to address info. security when using cloud computing. The auditor reviewed relevant pub., white papers, and other documentation from fed. agencies and industry groups; conducted interviews with rep. from these org.; and surveyed 24 major fed. agencies. Illus.
Weaknesses in information security (IS) in the fed. gov¿t. are a problem with potentially devastating consequences -- such as intrusions by malicious users, compromised networks, & the theft of personally identifiable info; it is a high-risk issue. Concerned by reports of significant vulnerabilities in fed. computer systems, Congress passed the Fed. Info. Security Mgmt. Act of 2002 (FISMA), which authorized & strengthened the IS program, eval¿n., & reporting require. for fed. agencies. This testimony discusses security incidents reported at fed. agencies, the continued weaknesses in IS controls at major fed. agencies, agencies¿ progress in performing key control activities, & oppor. to enhance FISMA reporting & independent evaluations. Tables.
Discusses the cyber threats to critical infrastructure and the Amer. economy. Pervasive and sustained cyber attacks against the U.S. continue to pose a potentially devastating impact on fed. and non-fed. systems and operations. In Feb. 2011, the Dir. of National Intelligence testified that, in the past year, there had been a dramatic increase in malicious cyber activity targeting U.S. computers and networks, incl. a more than tripling of the vol. of malicious software since 2009. This testimony describes: (1) cyber threats to cyber-reliant critical infrastructures and federal information systems; and (2) the continuing challenges federal agencies face in protecting the nation's cyber-reliant critical infrastructures and federal systems. A print on demand report.
Over the past several years, federal agencies have rapidly adopted the use of wireless networks (WN) for their info. systems. This report: (1) identifies leading practices and state-of-the-art technologies for deploying and monitoring secure WN; and (2) assesses agency efforts to secure WN, incl. their vulnerability to attack. To do so, the auditor reviewed publications and interviewed experts in wireless security. He also interviewed agency officials on wireless security at 24 major federal agencies and conducted additional testing at 5 agencies. This report identifies a range of leading security practices for deploying and monitoring secure WN and technologies that can help secure these networks. Illus. This is a print on demand report.
Pervasive and sustained cyber attacks continue to pose a potentially devastating threat to the systems and operations of the fed. gov¿t. Many nation states, terrorist networks, and organized criminal groups have the capability to target elements of the U.S. info. infrastructure for intelligence collection, intellectual property theft, or disruption. The dependence of fed. agencies on info. systems to carry out essential, everyday operations can make them vulnerable to an array of cyber-based risks. This statement describes: (1) cyber threats to fed. info. systems and cyber-based critical infrastructures; (2) control deficiencies that make fed. systems vulnerable to those threats; and (3) opportunities that exist for improving fed. cybersecurity.
Pervasive and sustained cyber attacks continue to pose a potentially devastating threat to the systems and operations of the fed. government. In recent months, fed. officials have cited the continued efforts of foreign nations and criminals to target government and private sector networks; terrorist groups have expressed a desire to use cyber attacks to target the U.S.; and press accounts have reported attacks on the Web sites of government agencies. This statement describes: (1) cyber threats to fed. information systems and cyber-based critical infrastructures; (2) control deficiencies at fed. agencies that make these systems and infrastructures vulnerable to cyber threats; and (3) opportunities that exist for improving fed. cybersecurity.
Fed. agencies are facing a set of cybersecurity threats that are the result of increasingly sophisticated methods of attack & the blending of once distinct types of attack into more complex & damaging forms. Examples of these threats include: spam (unsolicited commercial e-mail), phishing (fraudulent messages to obtain personal or sensitive data), & spyware (software that monitors user activity without user knowledge or consent). This report determines: the potential risks to fed. systems from these emerging cybersecurity threats; the fed. agencies' perceptions of risk & their actions to mitigate them, fed. & private-sector actions to address the threats on a nat. level; & governmentwide challenges to protecting fed. systems from these threats. Illus.
The Freedom of Info. Act (FOIA) requires fed. agencies to provide the public with access to gov¿t. info. In Dec. 2005, the Pres. issued an Exec. Order that required each agency to review its operations and develop plans for improvement. Since its establishment, the Dept. of Homeland Security (DHS) has accounted for a major and increasing portion of pending FOIA requests governmentwide. While it has reported achieving a notable reduction since 2006, DHS still possesses the largest backlog of overdue requests in the gov¿t. This report determines: (1) what key steps DHS has taken to enhance its FOIA program; and (2) what opportunities exist to improve the efficiency and cost-effectiveness of FOIA operations across the dept. Illus.
Federal laws and policy have assigned important roles and responsibilities to the Dept. of Homeland Security (DHS) and the Nat. Inst. of Standards and Tech. (NIST) for securing computer networks and systems. DHS is charged with coordinating the protection of computer-reliant critical infrastructure -- much of which is owned by the private sector -- and securing its own computer systems, while NIST is responsible for developing standards and guidelines for implementing security controls over information and information systems. This report describes cybersecurity efforts at DHS and NIST -- including partnership activities with the private sector -- and the use of cybersecurity performance metrics in the fed. gov¿t. Table and graphs.
The Office of Personnel and Management (OPM) Should Better Monitor Implementation of Privacy-Related Policies and Procedures for Background Investigations
The Office of Personnel and Management (OPM) Should Better Monitor Implementation of Privacy-Related Policies and Procedures for Background Investigations
This is a print on demand edition of a hard to find publication. Approximately 90 percent of all federal background investigations are provided by OPM¿s Federal Investigative Services (FIS) division. In fiscal year 2009, FIS conducted over 2 million investigations of varying types, making the organization a major steward of personal information on U.S. citizens. This report: (1) describes how OPM uses personally identifiable information (PII) in conducting background investigations; and (2) assesses the extent to which OPM's privacy policies and procedures for protecting PII related to investigations meet statutory requirements and align with widely accepted privacy practices. The report compared OPM and FIS policies and procedures with key privacy laws and widely accepted practices. Illustrations.
Information security is a critical consideration for any organization that depends on info. systems and computer networks to carry out its mission or business. It is especially important for gov¿t. agencies, where maintaining the public's trust is essential. The need for a vigilant approach to info. security has been demonstrated by the pervasive and sustained computerbased (cyber) attacks againimpactst the U.S. and others that continue to pose a potentially devastating to systems and the operations and critical infrastructures that they support. This report describes: (1) cyber threats to fed. info. systems and cyberbased critical infrastructures; and (2) control deficiencies that make these systems and infrastructures vulnerable to those threats. Ill.
Addresses additional questions arising from the May 19, 2009, hearing on federal information security held by the Subcommittee on Government Management, Organization, and Procurement. In that hearing, there was a discussion on the current state of information security throughout the federal government and agency efforts to comply with the requirements of the Federal Information Security Management Act of 2002 (FISMA). Congress had the following two questions: (1) Comment on the need for improved cyber security relating to S.773, the proposed Cybersecurity Act of 2009; and (2) Provide recommendations to improve the Federal Information Security Management Act. This report provides the responses.
Without proper safeguards, fed. computer systems are vulnerable to intrusions by individuals who have malicious intentions and can obtain sensitive info. The need for a vigilant approach to info. security (IS) has been demonstrated by the pervasive and sustained cyber attacks against the U.S. Concerned by reports of weaknesses in fed. systems, Congress passed the Fed. IS Management Act (FISMA), which authorized and strengthened IS program, evaluation, and annual reporting requirements for fed. agencies. This testimony discusses fed. IS and agency efforts to comply with FISMA. It summarizes: (1) fed. agencies¿ efforts to secure info. systems and (2) opportunities to enhance fed. cybersecurity. Charts and tables.
The control systems that regulate the nation¿s critical infrastructures face risks of cyber threats, system vulnerabilities, and potential attacks. Securing these systems is therefore vital to ensuring national security, economic well-being, and public health and safety. While most critical infrastructures are privately owned, the Tennessee Valley Authority (TVA), a fed. corp. and the nation¿s largest public power company, provides power and other services to a large swath of the American Southeast. This testimony discusses the security controls in place over TVA¿s critical infrastructure control system. The author examined the security practices in place at TVA facilities, and analyzed the agency¿s information security policies, plans, and procedures.
Statement of Gregory C. Wilshusen, Dir., Information Security Issues, GAO. Federal government agencies and the nation’s critical infrastructures have become increasingly dependent on computerized information systems and electronic data to carry out their operations. While creating significant benefits, this can also introduce vulnerabilities to cyber-threats which could have a serious impact on national security, the economy, and public health and safety. GAO has designated federal information security as a high-risk area since 1997 and in 2003 expanded this to include cyber critical infrastructure protection. This testimony discusses challenges facing the government in effectively implementing cybersecurity and the extent to which the national cybersecurity strategy includes desirable characteristics of a national strategy. Figures. This is a print on demand report.
This will help us customize your experience to showcase the most relevant content to your age group
Please select from below
Login
Not registered?
Sign up
Already registered?
Success – Your message will goes here
We'd love to hear from you!
Thank you for visiting our website. Would you like to provide feedback on how we could improve your experience?
This site does not use any third party cookies with one exception — it uses cookies from Google to deliver its services and to analyze traffic.Learn More.