senate committtee

Senate Report: Federal Agencies Have Failed To Respond to Growing Cybersecurity Threats

Eight agencies, including the Department of Homeland Security and Education Department, are using outdated systems that have few security updates and have failed to protect Americans’ personal data.

Federal agencies tasked with protecting the personal and financial data of millions of Americans have failed to update their systems or implement basic cybersecurity defenses, according to a recent Senate report.

The June report, titled “Federal Cybersecurity: America’s Data at Risk,” is the product of a subcommittee’s 10-month review of a decades’ worth of inspectors general reports of core government agencies. Eight agencies, including the Department of Homeland Security, the Department of State, the Department of Education and the Social Security Administration, were found to have several vulnerabilities in their cybersecurity systems and practices.

“The federal government remains unprepared to confront the dynamic cyber threats of today,” the report reads. “The longstanding cyber vulnerabilities consistently highlighted by Inspectors General illustrate the federal government’s failure to meet basic cybersecurity standards to protect sensitive data.”

Seven agencies were found to have failed to adequately protect personally identifiable information, and six agencies failed to install security patches in a timely manner. All eight agencies that were surveyed use “legacy,” or outdated, systems that are no longer supported by the vendor with security updates, leading to substantial risk of breaches.

Most shockingly, the Department of Transportation was using a 48-year-old system to track hazardous materials data. The program was finally phased out at the end of May because there were very few employees who knew how to use it, according to the report.

But other agencies are also using old systems to carry out their core responsibilities. Homeland Security continues to use Windows XP and Windows Server 2003 for many of its internal systems, despite the fact that Microsoft discontinued support for those programs years ago.

These findings are compounded by the fact that the federal government experiences tens of thousands of cyber incidents and breaches per year. More than 77,000 incidents were reported in 2015, with that number dropping significantly in recent years due to a rule change that allows agencies to report fewer kinds of attacks, according to NBC News.

Investigators found that the Education Department is particularly vulnerable to these incidents. The agency has been unable to prevent unauthorized devices from connecting to its network for years, according to the report.

Only recently has the department been able to limit unauthorized access to 90 seconds, which is still plenty of time to “launch an attack or gain intermittent access to internal network resources,” the report said. Those resources include the personal and financial data of millions of Americans who have applied for federal student loans.

In addition to its findings, the subcommittee offered some recommendations, including the hiring of more cybersecurity experts, prioritizing funds for systems updates and having more regular reports on the status of cyber threats. Jake Olcott, vice president of government affairs at the cybersecurity company BitSight, told Fortune that government officials should be held accountable for breaches just as corporate executives are.

“The reality is, unlike in the commercial sector today, where CEOs and board members are being fired because of data breaches, there is not the same level of accountability and responsibility in the federal government,” Olcott told Fortune. “Start holding people accountable for improving security performance…Those are the things you need congressional and executive leadership.”

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Achieving Clear Communications

    Achieving Clear Communications

    Technology within the security industry has adapted to numerous changes through the years, from the early days of analog devices to today’s IP-based solutions, networked cameras, and access control solutions, in addition to analytics, cloud-based products, virtual security guards, and more. Read Now

  • Taking Flight

    Taking Flight

    Airport security is a complex system that incorporates multiple technologies to ensure the safety and security of travelers, employees and the facility itself. Sound-based technologies are integral pieces of this system, providing means of communication, notification and monitoring. Read Now

  • Live From ISC West 2023 Preview

    Live From ISC West 2023 Preview

    ISC West 2023 is right around the corner! This year’s trade show is scheduled from March 28–31 at the Venetian Expo in Las Vegas, Nevada. The Campus Security & Life Safety and Security Today staff will be on hand to provide live updates about the security industry’s latest innovations, trends, and products. Read Now

    • Industry Events
    • ISC West
  • A Break from Routine

    A Break from Routine

    It was three years ago right about now that COVID was bringing the world to its knees. In mid-March of 2020, the president put travel restrictions on all flights in and out of Europe, the NBA suspended its season, and Tom Hanks announced that he’d tested positive for the disease—all in the same night. It was officially a national emergency two days later. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity

New Products

  • XS4 Original+

    XS4 Original+

    The SALTO XS4 Original+ design is based on the same proven housing and mechanical mechanisms of the XS4 Original. The XS4 Original+, however, is embedded with SALTO’s BLUEnet real-time functionality and SVN-Flex capability that enables SALTO stand-alone smart XS4 Original+ locks to update user credentials directly at the door. Compatible with the array of SALTO platform solutions including SALTO Space data-on-card, SALTO KS Keys as a Service cloud-based access solution, and SALTO’s JustIn Mobile technology for digital keys. The XS4 Original+ also includes RFID Mifare DESFire, Bluetooth LE and NFC technology functionality. 3

  • Kangaroo Home Security System

    Kangaroo Home Security System

    Kangaroo is the affordable, easy-to-install home security system designed for anyone who wants an added layer of peace of mind and protection. It has several products, ranging from the fan-favorite Doorbell Camera + Chime, to the more comprehensive Front Door Security Kit with Professional Monitoring. Regardless of the level of desired security, Kangaroo’s designed to move with consumers - wherever that next chapter may be. Motion sensors, keypads and additional features can be part of the package to any Kangaroo system in place, anytime. Additionally, Kangaroo offers scalable protection plans with a variety of benefits ranging from 24/7 professional monitoring to expanded cloud storage, coverage for damage and theft. 3

  • Dinkle DKU Barrier Terminal Blocks

    Dinkle DKU Barrier Terminal Blocks

    New DKU screw type terminal blocks use a spring-guided system where the screws are integrated and captive within the terminal enclosure. These screws can be backed out so that ring- or U-shaped cable lugs can be inserted, without the possibility of losing the screw. 3