GAO on Government-wide Security Weaknesses

Posted June 12th, 2007 by

Interesting testimony by Mr. Gregory C. Wilshusen, Director, Information Security Issues Government Accountability Office. For those of you who don’t habla governmento, this is the overall government-wide audit results in a laylanguage.

Some of the findings that he highlights:

  • Access controls, which ensure that only authorized individuals can read, alter, or delete data;
  • Configuration management controls, which provide assurance that only authorized software programs are implemented;
  • Segregation of duties, which reduces the risk that one individual can independently perform inappropriate actions without detection;
  • Continuity of operations planning, which provides for the prevention of significant disruptions of computer-dependent operations; and
  • An agencywide information security program, which provides the framework for ensuring that risks are understood and that effective controls are selected and properly implemented.

At this point, those of you who read celebrity magazines have to be thinking “The Feds, they’re just like us. They need access controls and segregation of duties.”



Similar Posts:

Posted in FISMA, NIST | 6 Comments »

6 Responses

  1.  LonerVamp Says:

    Yeah, sounds like you could replace the bureau name with any company name and it’d still apply…

  2.  Darren Couch Says:

    Is there any movement government-wide to move to a more configureable(modular) system? Part of the problem where I work is implementing a good security posture on our ULLS-G machines. Our TAMMS clerks have to “bend” standard policy on the network to perform their jobs on a daily basis. It works for the moment because the individuals are few and honest and there is some oversight, but it certainly is not ideal.

  3.  rybolov Says:

    “Is there any movement government-wide to move to a more configureable(modular) system?”

    The trend is going “hells-bells” toward a single unified hardening standard. So no.
    http://www.guerilla-ciso.com/archives/126

    Some applications will break when you harden a box too much. The trick is that somewhere in there is a tradeoff.

  4.  Darren Couch Says:

    Thanks for the link — time for me to educate up =)

  5.  rybolov Says:

    Even better are the STIGs. I think that’s more of what you are looking for.
    http://www.guerilla-ciso.com/archives/103

  6.  Graydon McKee Says:

    I would say that if your clerks have to bend the rules to get their job done then it is time to go back and revisit the rules.

    True, we need to ensure that we are secure but security needs to be implemented in such a way that it does not hinder users doing their job. If exceptions need to be made to ensure least functionality then exceptions need to be made.

    Now a review may also reveal that the actions that bend the rules are not essential actions and could result in those actions being eliminated from certain roles.

    The point is that this situation should raise a caution flag and start an evaluation of the process.

    IMHO of course.

Leave a Comment

Please note: Comment moderation is enabled and may delay your comment. There is no need to resubmit your comment.


Visitor Geolocationing Widget: