Federal Agencies Reported More Than 30,000 Cyber Incidents In FY22
Here, Atlas VPN covers the recently published FISMA report by the United States Office of Management and Budget (OMB) for the fiscal year 2022.
The FISMA report published by the OMB provides information about the overall state of government information security, including challenges, progress, and incidents.
In the fiscal year 2022, Federal agencies saw fewer cyber incidents overall, which decreased by around 6%.
There were 30,659 cyber incidents in FY 2022, according to the OMB's annual FISMA report to Congress, down from 32,509 in 2021.
The Federal Information Security Modernization Act (FISMA) requires Federal agencies to develop, document, and implement agency-wide information security programs to protect sensitive government information and operations.
Agency officials, like chief information officers and inspector generals, conduct annual reviews of an agency's information security program and submit those to the OMB.
The OMB gathers all those annual reviews and summarizes them in the FISMA report, which is then submitted to Congress.
These reports are publicly available on the Whitehouse.gov website.
Improper usage incidents were the most commonly reported by Federal agencies in FY 2022, with 10,467 total cases, a slight uptick from 10,123 in 2021.
Improper usage incidents result from violating the organization's acceptable usage policies, like using work computers for personal matters.
In addition, agencies said email or phishing attacks increased slightly to more than 3,010 last year from 2,962 in 2021.
The most significant growth in incidents was seen in the loss or theft of equipment category.
Around one thousand computing or media devices were lost or stolen in 2021, while in 2022, the number climbed to 1,786 incidents.
The most common attack vector remains in the "unknown" category.
According to OMB, 93% of the incidents in 2022 were classified as "baseline" or "unsubstantiated or inconsequential event[s]."
Four of almost 31 thousand incidents reported by agencies in FY 2022 were classified as major.
Government bodies affected by the incidents included the Department of Education, the Department of Treasury, and the Department of Agriculture.
One incident remains classified.
In contrast, agencies encountered seven major incidents in FY 2021.
Overall, the incidents' number and severity remain relatively similar in FY 2022 and 2021.
Administration focused on improving Nation's cybersecurity
The current US administration is acutely aware of the ever-increasing danger of cyber threats and is taking steps to protect themselves and US citizens.
“The United States faces persistent and increasingly sophisticated malicious cyber campaigns that threaten the public sector, the private sector, and ultimately the security and privacy of the American people," states President Biden's Executive Order (EO 14028) on improving the Nation's cybersecurity.
In FY 2022, the Administration took steps to continue implementing EO 14028, such as moving to a zero-trust architecture and aligning Federal agency investments in cybersecurity defenses with policy requirements.
By taking these steps, the Federal Government hopes to drastically lower the danger of successful cyberattacks on their digital infrastructure and quickly transition to a new cybersecurity paradigm.