Feds get an overall 'C-' on security; a third of agencies are given 'F' grades
Governmentwide grade improves from D+ on earlier versions of annual report card
Computerworld - The federal government today got an overall grade of C-minus in an annual computer security report card that evaluates the performance of 24 individual agencies covered by the Federal Information Security Management Act (FISMA).
Eight agencies -- including the departments of Defense, Interior and State as well as the Nuclear Regulatory Commission -- received failing grades. An equal number of agencies, including the General Services Administration, the Social Security Administration and the Department of Housing and Urban Development (HUD), scored at least an A-minus.
The grades in the seventh annual report card on federal computer security were released this morning by Rep. Tom Davis, (R-Va.), ranking member of the House Committee on Oversight and Government Reform (download PDF). The committee each year releases the Federal Computer Security Report Card based on security evaluations defined in FISMA. The evaluations are compiled by the committee based on information provided to Congress each year by the inspector general from each agency.
Asked at a news conference whether the U.S. public should be confident that government agencies are protecting against cyberterrorism, Davis said, "It doesn't give me a lot of confidence."
Davis defended the Department of Homeland Security, which got a "D," saying it is still working to integrate the 22 agencies merged to create it in 2002. The creation of the department was a "horrendous, complicated deal," he said.
"It's a work in progress, and it's going to take some time."
But Davis had no kind words for the Department of Defense. He called it a "badly managed agency" with each military branch focusing on its own technology.
Agencies are rated on issues such as their adherence to security configuration standards, their ability to detect and respond to intrusions, whether they certify and accredit their systems, inventory accuracy and the kind of security training programs they offer employees.
Overall, the government's C-minus performance marks a "slow but steady improvement from past years," said Davis in a statement, pointing to the D-plus and D grades he had given the government over the past three years. "Obviously, challenges remain. But there are some excellent signs of progress in this year's report, and that's encouraging."
Those showing the most improvement in this year's report were the Department of Justice and HUD, both of which jumped from Ds to As. Meanwhile, NASA and the Department of Education showed the biggest declines in security. The space agency dropped from a B-minus to a D-minus; the education department went from a C-minus to an F.
According to Davis, this year's reports show that more agencies are paying attention to issues such as the annual testing of security controls and contingency plans -- and there is much better reporting of security breaches. However, more progress needs to be made in areas such as configuration management and progress measurement, he said.
- Google I/O 2013's Coolest Products and Services
- 10 Star Trek Technologies That are Almost Here
- 19 Generations of Computer Programmers
- 25 Must-Have Technologies for SMBs
- A walking tour: 33 questions to ask about your company's security
- 15 social media scams
- The 7 elements of a successful security awareness program
- IT Certification Study Tips
- Register for this Computerworld Insider Study Tip guide and gain access to hundreds of premium content articles, cheat sheets, product reviews and more.
- Federal IT Innovation Caught in a Catch-22
- Fed resources shoring up old infrastructure, holding back new technologies.
- Harness IT -- An Introduction to Business Intelligence Solutions
- Learn the key selection criteria required to provide your organization with the capability to address structured data, unstructured data and mobile demands so...
- Business Intelligence Shows its Smarts
- Today's Business Intelligence (BI) tools provide a new way to think about data with self-service capabilities and user-friendly analytics that can be used...
- Proactive Planning for Big Data
- Big data is less about the terabytes and more about the query tools and business intelligence needed to make sense of massive amounts...
- Inquiry Spotlight: Consumer-Facing Identity
- The challenges of consumer-facing identity management, access management, and authentication differ in ways subtle and dramatic from those of the employee-facing variety. All Government IT White Papers
- Becoming An Analytics Driven Organization
- Join us on Tuesday, June 18, 2013, 11:00 AM EDT and learn how your agency can create an analytics culture that will enable...
- 3 Reasons Why Sepaton is the World's Fastest Backup Solution
- Leading analyst, Storage Switzerland learns how Sepaton backs up and deduplicates massive data volumes while maintaining the industry's fastest performance - all in...
- Enterprise File Sharing: All You Need to Know
- Security. Scalability. Control. These are just some of the many benefits of enterprise cloud file-sharing that you'll discover in this KnowledgeVault, packed with...
- Bridging HTTP and FTP with FileXpress Internet Server
- What if you could take an FTP server on your internal network, and allow external users (partners or customers) to securely access it...
- MFT and FileXpress - An Overview
- Business users and applications exchange files on a regular basis. File transfer is a core part of the flow of business activity. All Government IT Webcasts