senate committtee

Senate Report: Federal Agencies Have Failed To Respond to Growing Cybersecurity Threats

Eight agencies, including the Department of Homeland Security and Education Department, are using outdated systems that have few security updates and have failed to protect Americans’ personal data.

Federal agencies tasked with protecting the personal and financial data of millions of Americans have failed to update their systems or implement basic cybersecurity defenses, according to a recent Senate report.

The June report, titled “Federal Cybersecurity: America’s Data at Risk,” is the product of a subcommittee’s 10-month review of a decades’ worth of inspectors general reports of core government agencies. Eight agencies, including the Department of Homeland Security, the Department of State, the Department of Education and the Social Security Administration, were found to have several vulnerabilities in their cybersecurity systems and practices.

“The federal government remains unprepared to confront the dynamic cyber threats of today,” the report reads. “The longstanding cyber vulnerabilities consistently highlighted by Inspectors General illustrate the federal government’s failure to meet basic cybersecurity standards to protect sensitive data.”

Seven agencies were found to have failed to adequately protect personally identifiable information, and six agencies failed to install security patches in a timely manner. All eight agencies that were surveyed use “legacy,” or outdated, systems that are no longer supported by the vendor with security updates, leading to substantial risk of breaches.

Most shockingly, the Department of Transportation was using a 48-year-old system to track hazardous materials data. The program was finally phased out at the end of May because there were very few employees who knew how to use it, according to the report.

But other agencies are also using old systems to carry out their core responsibilities. Homeland Security continues to use Windows XP and Windows Server 2003 for many of its internal systems, despite the fact that Microsoft discontinued support for those programs years ago.

These findings are compounded by the fact that the federal government experiences tens of thousands of cyber incidents and breaches per year. More than 77,000 incidents were reported in 2015, with that number dropping significantly in recent years due to a rule change that allows agencies to report fewer kinds of attacks, according to NBC News.

Investigators found that the Education Department is particularly vulnerable to these incidents. The agency has been unable to prevent unauthorized devices from connecting to its network for years, according to the report.

Only recently has the department been able to limit unauthorized access to 90 seconds, which is still plenty of time to “launch an attack or gain intermittent access to internal network resources,” the report said. Those resources include the personal and financial data of millions of Americans who have applied for federal student loans.

In addition to its findings, the subcommittee offered some recommendations, including the hiring of more cybersecurity experts, prioritizing funds for systems updates and having more regular reports on the status of cyber threats. Jake Olcott, vice president of government affairs at the cybersecurity company BitSight, told Fortune that government officials should be held accountable for breaches just as corporate executives are.

“The reality is, unlike in the commercial sector today, where CEOs and board members are being fired because of data breaches, there is not the same level of accountability and responsibility in the federal government,” Olcott told Fortune. “Start holding people accountable for improving security performance…Those are the things you need congressional and executive leadership.”

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Maximizing Your Security Budget This Year

    The Importance of Proactive Security Measures: 4 Stories of Regret

    We all want to believe that crime won’t happen to us. So, some business owners hope for the best and put proactive security measures on the back burner, because other things like growth, attracting new customers, and meeting deadlines all seem more pressing. Read Now

  • Today's Enterprise

    Protecting servers and data has evolved rapidly over the past 15-plus years. Early on, concerns centered around the environmental conditions of where servers were housed within a building and the effects of humidity, temperature and air quality on their performance. This led to a better understanding of the need for a controlled environment to maximize equipment lifespan and capacity. It was also a driving force behind consolidating servers in a common space, i.e., the data center. Read Now

  • Study Proves It: Security Awareness Training Reduces Phishing Attacks

    Attackers are increasingly targeting human-based vulnerabilities to infiltrate organizations. Humans have direct access to insider systems and data – any threat actor can easily phish users, steal their credentials and secure keys to the kingdom without having to fight advanced cybersecurity defenses. Studies show social engineering attacks and human errors are behind 68% of all breaches.  Read Now

  • Security Questions Persist After Attempted Assassination Attempt of Donald Trump

Featured Cybersecurity

Webinars

New Products

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises. 3

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3