Posts RSS
Subscribe via Email
GAO on Government-wide Security Weaknesses
Posted June 12th, 2007 by rybolov
Interesting testimony by Mr. Gregory C. Wilshusen, Director, Information Security Issues Government Accountability Office. For those of you who don’t habla governmento, this is the overall government-wide audit results in a laylanguage.
Some of the findings that he highlights:
- Access controls, which ensure that only authorized individuals can read, alter, or delete data;
- Configuration management controls, which provide assurance that only authorized software programs are implemented;
- Segregation of duties, which reduces the risk that one individual can independently perform inappropriate actions without detection;
- Continuity of operations planning, which provides for the prevention of significant disruptions of computer-dependent operations; and
- An agencywide information security program, which provides the framework for ensuring that risks are understood and that effective controls are selected and properly implemented.
At this point, those of you who read celebrity magazines have to be thinking “The Feds, they’re just like us. They need access controls and segregation of duties.”
Similar Posts:
Posted in FISMA, NIST | 
6 Comments »
June 13th, 2007 at 11:15 am
Yeah, sounds like you could replace the bureau name with any company name and it’d still apply…
June 13th, 2007 at 2:41 pm
Is there any movement government-wide to move to a more configureable(modular) system? Part of the problem where I work is implementing a good security posture on our ULLS-G machines. Our TAMMS clerks have to “bend” standard policy on the network to perform their jobs on a daily basis. It works for the moment because the individuals are few and honest and there is some oversight, but it certainly is not ideal.
June 13th, 2007 at 4:14 pm
“Is there any movement government-wide to move to a more configureable(modular) system?”
The trend is going “hells-bells” toward a single unified hardening standard. So no.
http://www.guerilla-ciso.com/archives/126
Some applications will break when you harden a box too much. The trick is that somewhere in there is a tradeoff.
June 13th, 2007 at 4:22 pm
Thanks for the link — time for me to educate up =)
June 13th, 2007 at 9:51 pm
Even better are the STIGs. I think that’s more of what you are looking for.
http://www.guerilla-ciso.com/archives/103
June 15th, 2007 at 12:09 pm
I would say that if your clerks have to bend the rules to get their job done then it is time to go back and revisit the rules.
True, we need to ensure that we are secure but security needs to be implemented in such a way that it does not hinder users doing their job. If exceptions need to be made to ensure least functionality then exceptions need to be made.
Now a review may also reveal that the actions that bend the rules are not essential actions and could result in those actions being eliminated from certain roles.
The point is that this situation should raise a caution flag and start an evaluation of the process.
IMHO of course.