IG: DHS makes progress on FISMA

[InfoSec News <alerts () infosecnews org>]

http://www.fcw.com/article96484-10-16-06-Web

By Brian Robinson
Oct. 16, 2006

The Homeland Security Department received a failing grade for security 
in 2005, but recent progress in implementing an agencywide information 
security program may finally get it out of the compliance basement.

According to a recent report by DHS’ inspector general, department 
officials have taken several steps toward meeting Federal Information 
Security Management Act (FISMA) requirements. That includes updating 
policies on systems certification and accreditation, improving wireless 
communication and configuration management, and expanding guidance for 
handling sensitive but unclassified systems.

However, DHS is not completely out of the woods. For every area of 
progress, the IG also listed issues that the department still must 
address.

For example, although DHS now requires certification and accreditation 
of sensitive but unclassified systems, the IG found that 27 of 35 
systems have incomplete accreditation packages, with some critical 
information missing from various security documents. Without it, DHS 
cannot make credible risk-based decisions on whether to authorize the 
system to operate, the IG said.

In another instance, the IG identified six Citizenship and Immigration 
Services systems in which at least one security objectives did not match 
the security plan.

The IG also reported that several DHS agencies did not satisfy baseline 
security configurations, including the Federal Emergency Management 
Agency, U.S. Immigration and Customs Enforcement and the Preparedness 
Directorate.

Tests on various systems, including laptop PCs, radio frequency 
identification technology and Transportation Worker Identification 
Credential systems, revealed inadequate password controls, patch 
management concerns and configuration management problems.

DHS has not yet implemented a departmentwide program for information 
technology security awareness training.

In response to a congressional request, DHS has implemented a 
departmentwide plan to certify and accredit its operational systems.  
The IG added that the department is taking corrective measures to 
eliminate other problems.


_________________________________
Visit the InfoSec News store!
http://www.shopinfosecnews.org