This message is in MIME format. The first part should be readable text,
while the remaining parts are likely unreadable without MIME-aware tools.
Content-Type: TEXT/PLAIN; charset=UTF-8
By Brian Robinson
Oct. 16, 2006
The Homeland Security Department received a failing grade for security
in 2005, but recent progress in implementing an agencywide information
security program may finally get it out of the compliance basement.
According to a recent report by DHS=C2=92 inspector general, department
officials have taken several steps toward meeting Federal Information
Security Management Act (FISMA) requirements. That includes updating
policies on systems certification and accreditation, improving wireless
communication and configuration management, and expanding guidance for
handling sensitive but unclassified systems.
However, DHS is not completely out of the woods. For every area of
progress, the IG also listed issues that the department still must
For example, although DHS now requires certification and accreditation
of sensitive but unclassified systems, the IG found that 27 of 35
systems have incomplete accreditation packages, with some critical
information missing from various security documents. Without it, DHS
cannot make credible risk-based decisions on whether to authorize the
system to operate, the IG said.
In another instance, the IG identified six Citizenship and Immigration
Services systems in which at least one security objectives did not match
the security plan.
The IG also reported that several DHS agencies did not satisfy baseline
security configurations, including the Federal Emergency Management
Agency, U.S. Immigration and Customs Enforcement and the Preparedness
Tests on various systems, including laptop PCs, radio frequency
identification technology and Transportation Worker Identification
Credential systems, revealed inadequate password controls, patch
management concerns and configuration management problems.
DHS has not yet implemented a departmentwide program for information
technology security awareness training.
In response to a congressional request, DHS has implemented a
departmentwide plan to certify and accredit its operational systems.
The IG added that the department is taking corrective measures to
eliminate other problems.
Content-Type: text/plain; charset="us-ascii"
Visit the InfoSec News store!