Report: Nearly One-Third Of Federal Agencies Experience Daily Cybersecurity Incident

 

CDW Government Inc. recently released its 2009 Federal Cybersecurity Report, which found that across federal civilian and Department of Defense agencies, the number and severity of cybersecurity incidents has stayed the same or increased in the last year, with nearly one-third of Federal agencies experiencing a cybersecurity incident daily.

The report, based on a September survey of 300 federal IT security professionals, identifies agency cybersecurity threats, steps federal IT professionals are taking to combat them and opportunities for improvement. 

Defense and civilian IT security professionals say external sources are their agency/network’s biggest threat overall, with defense agencies indicating state-sponsored cybersecurity-warfare programs as their most significant external cybersecurity issue.  For civilian agencies, independent international hackers and software problems are the biggest external challenges. 

At the same time, internal threats such as inappropriate Web surfing, lax user authentication and loss of computing devices continue to leave agencies vulnerable to cybersecurity threats.  Respondents cite malware, inappropriate employee activity and remote-user access as the top cybersecurity challenges they face each day -- and that remote computing challenges are increasing more than all others.

“Fundamentally, cybersecurity is not just a technology issue -- it is a management and cultural challenge for federal agencies,” said Andy Lausch, vice president of federal sales for CDW-G.  “Federal IT security professionals are engaging in the cybersecurity war on multiple fronts, and they need the participation of the Federal employees, managers and senior staff that they support.  First and foremost, federal IT security professionals are calling for increased end-user education, both to reduce internal cybersecurity incidents and to close the door to external threats.”

In response to growing threats, the majority of Federal IT security professionals on the front lines say their requirements for network monitoring/intrusion prevention, encryption, user authentication, end-user education, patch management and network access control have increased or significantly increased during the last year -- yet just half say they have adequate budget to meet their cybersecurity needs. 

Agencies may see budget relief during the next few years, according to an October forecast on information security spending by market research firm INPUT, which projects Federal spending on information security products and services will increase from $7.9 billion in 2009 to $11.7 billion in 2014 in direct response to heightened attacks, evolving threats and presidential and congressional focus on cybersecurity improvements. 

To address cybersecurity issues, agencies are taking a multifaceted approach, focusing on end-user training for internal challenges and cybersecurity tools for external threats.  To address avoidable end-user mistakes and reduce vulnerabilities, 82 percent of agencies provide ongoing training classes on security policies and procedures.  To combat external threats, 81 percent have an Internet firewall and 71 percent have intrusion protection/detection. 

However, despite agency training commitments and technology implementations, many agencies still experience avoidable internal risks.  More than 70 percent of agencies have experienced inappropriate Web surfing/downloads in the last 12 months, and more than 40 percent have seen the unauthorized transfer of sensitive information.  As a result, Federal civilian and defense agencies agree that their No. 1 priority for improving agency cybersecurity is more end-user education.

Based upon the findings of the 2009 Federal Cybersecurity Report, CDW-G recommends that federal agencies: 

  • Reassess end-user training:  Establish programs and metrics to measure training success. Communicate security policies that include guidelines for acceptable use and policy acknowledgement.  Establish consequences for non-compliance with agency cybersecurity policies.
  • Address the mobile threat:  Implement a tiered security architecture for mobile assets such as two-factor authentication, VPN sessions, data-at-rest encryption, remote Web filtering and end-point security software to ensure mobile devices are compliant and within policy.
  •  Implement industry-standard technologies:  To reduce malware threats and enforce acceptable use policies, assess the agency enterprise and implement basic cybersecurity tools across the agency enterprise.
  • Participate in the Federal Trusted Internet Connections (TIC) program, which reduces the number of agency Internet connections.  Participants confirm improved security.

“During the last several years, Federal agencies have proven they can do more with less in challenging budget environments,” Lausch said.  “Unfortunately, they are simply outpaced by organized crime, increasingly sophisticated hackers and state-sponsored professionals.  It is time for computer users to step up and take an active role in cybersecurity efforts.  Much like Americans have made recycling an everyday task, it is time for users to form a new habit -- making smart, network-protecting activity a part of their daily routines.”

CDW-G’s online survey, taken during September, collected responses from 150 Federal civilian and 150 defense IT professionals familiar with their agency’s cybersecurity measures and challenges.  The margin of error for the total sample is ±5.7 percent at a 95 percent confidence level. 

Featured

  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • Protecting Data is Critical

    To say that the Internet of Things (IoT) has become a part of everyday life would be a dramatic understatement. At this point, you would be hard-pressed to find an electronic device that is not connected to the internet. Read Now

  • Mobile Access Adoption

    Smartphones and other mobile devices have had a profound impact on how the world securely accesses the workplace and its services. The growing adoption of mobile wallets and the new generation of users is compounding this effect. Read Now

  • Changing Mindsets

    We have come a long way from the early days of fuzzy analog CCTV systems. During that time, we have had to migrate from analog to digital signals. When IP-based network cameras arrived, they opened a new world of quality and connectivity but also introduced plenty of challenges. Thankfully, network devices today have become smart enough to discover themselves and even self-configure to some degree. While some IT expertise is certainly required, things are much smoother these days. The biggest change is in how fast security cameras and supporting infrastructure are evolving. Read Now

Featured Cybersecurity

Webinars

New Products

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis. 3

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation. 3