senate committtee

Senate Report: Federal Agencies Have Failed To Respond to Growing Cybersecurity Threats

Eight agencies, including the Department of Homeland Security and Education Department, are using outdated systems that have few security updates and have failed to protect Americans’ personal data.

Federal agencies tasked with protecting the personal and financial data of millions of Americans have failed to update their systems or implement basic cybersecurity defenses, according to a recent Senate report.

The June report, titled “Federal Cybersecurity: America’s Data at Risk,” is the product of a subcommittee’s 10-month review of a decades’ worth of inspectors general reports of core government agencies. Eight agencies, including the Department of Homeland Security, the Department of State, the Department of Education and the Social Security Administration, were found to have several vulnerabilities in their cybersecurity systems and practices.

“The federal government remains unprepared to confront the dynamic cyber threats of today,” the report reads. “The longstanding cyber vulnerabilities consistently highlighted by Inspectors General illustrate the federal government’s failure to meet basic cybersecurity standards to protect sensitive data.”

Seven agencies were found to have failed to adequately protect personally identifiable information, and six agencies failed to install security patches in a timely manner. All eight agencies that were surveyed use “legacy,” or outdated, systems that are no longer supported by the vendor with security updates, leading to substantial risk of breaches.

Most shockingly, the Department of Transportation was using a 48-year-old system to track hazardous materials data. The program was finally phased out at the end of May because there were very few employees who knew how to use it, according to the report.

But other agencies are also using old systems to carry out their core responsibilities. Homeland Security continues to use Windows XP and Windows Server 2003 for many of its internal systems, despite the fact that Microsoft discontinued support for those programs years ago.

These findings are compounded by the fact that the federal government experiences tens of thousands of cyber incidents and breaches per year. More than 77,000 incidents were reported in 2015, with that number dropping significantly in recent years due to a rule change that allows agencies to report fewer kinds of attacks, according to NBC News.

Investigators found that the Education Department is particularly vulnerable to these incidents. The agency has been unable to prevent unauthorized devices from connecting to its network for years, according to the report.

Only recently has the department been able to limit unauthorized access to 90 seconds, which is still plenty of time to “launch an attack or gain intermittent access to internal network resources,” the report said. Those resources include the personal and financial data of millions of Americans who have applied for federal student loans.

In addition to its findings, the subcommittee offered some recommendations, including the hiring of more cybersecurity experts, prioritizing funds for systems updates and having more regular reports on the status of cyber threats. Jake Olcott, vice president of government affairs at the cybersecurity company BitSight, told Fortune that government officials should be held accountable for breaches just as corporate executives are.

“The reality is, unlike in the commercial sector today, where CEOs and board members are being fired because of data breaches, there is not the same level of accountability and responsibility in the federal government,” Olcott told Fortune. “Start holding people accountable for improving security performance…Those are the things you need congressional and executive leadership.”

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity

Webinars

New Products

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3