Surprise, surprise, surprise – an internal audit of the US Government cyber security situation has uncovered widespread weaknesses, legacy systems and poor adoption of cyber controls and tooling.

US Government security has often been called into question but we’d hope in 2019 it would have gotten better and at least everyone would have adopted the anti-virus solution introduced in 2013..

A committee report (PDF) examining a decade of internal audits this week concluded that outdated systems, unpatched software, and weak data protection are so widespread that it’s clear American bureaucrats fail to meet even basic security requirements.

To produce this damning dossiers, the Senate’s Permanent Subcommittee on Investigations pored over a decade of findings from inspector-general-led probes into information security practices within the Department of Homeland Security, State Department, Department of Transportation, Department of Housing and Urban Development, Department of Agriculture, Department of Health and Human Services, Department of Education, and the Social Security Administration.

Of those eight organizations, seven were found to be unable to adequately protect personally identifiable information stored on their systems, six were unable to properly patch their systems against security threats, five were in violation of IT asset inventory-keeping requirements, and all eight were using either hardware or software that had been retired by the vendor and was no longer supported.

8 out of 8 agencies using end of life hardware or software that has been retired and is no longer supported – that’s pretty worrying.

Especially when one agency couldn’t account for how much of it’s $10 Billion budget was being spent on legacy systems, some having been around since 2005..

“Despite major data breaches like OPM, the federal government remains unprepared to confront the dynamic cyber threats of today,” the report noted.

“The longstanding cyber vulnerabilities consistently highlighted by Inspectors General illustrate the federal government’s failure to meet basic cybersecurity standards to protect sensitive data.”

In delivering the report, the Senate panel pointed out some of the previously reported security findings, such as a 2017 Homeland Security audit that found a malware scanning tool first introduced in 2013 was at the time only successfully running at 65 per cent of agencies. Or the 2018 inspector general finding that the department wasn’t even able to comply with its own standards for an effective security program.

And it’s not like they have a place to be complacent, the US government is a global cyber terrorism target and there have been many high visibility breaches across key government agencies.

Source: The Register