AOH :: ISN-3146.HTM

IG: DHS makes progress on FISMA

IG: DHS makes progress on FISMA
IG: DHS makes progress on FISMA

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

Content-Type: TEXT/PLAIN; charset=UTF-8
Content-Transfer-Encoding: QUOTED-PRINTABLE 

By Brian Robinson
Oct. 16, 2006

The Homeland Security Department received a failing grade for security 
in 2005, but recent progress in implementing an agencywide information 
security program may finally get it out of the compliance basement.

According to a recent report by DHS=C2=92 inspector general, department 
officials have taken several steps toward meeting Federal Information 
Security Management Act (FISMA) requirements. That includes updating 
policies on systems certification and accreditation, improving wireless 
communication and configuration management, and expanding guidance for 
handling sensitive but unclassified systems.

However, DHS is not completely out of the woods. For every area of 
progress, the IG also listed issues that the department still must 

For example, although DHS now requires certification and accreditation 
of sensitive but unclassified systems, the IG found that 27 of 35 
systems have incomplete accreditation packages, with some critical 
information missing from various security documents. Without it, DHS 
cannot make credible risk-based decisions on whether to authorize the 
system to operate, the IG said.

In another instance, the IG identified six Citizenship and Immigration 
Services systems in which at least one security objectives did not match 
the security plan.

The IG also reported that several DHS agencies did not satisfy baseline 
security configurations, including the Federal Emergency Management 
Agency, U.S. Immigration and Customs Enforcement and the Preparedness 

Tests on various systems, including laptop PCs, radio frequency 
identification technology and Transportation Worker Identification 
Credential systems, revealed inadequate password controls, patch 
management concerns and configuration management problems.

DHS has not yet implemented a departmentwide program for information 
technology security awareness training.

In response to a congressional request, DHS has implemented a 
departmentwide plan to certify and accredit its operational systems.  
The IG added that the department is taking corrective measures to 
eliminate other problems.

Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Visit the InfoSec News store! 

Site design & layout copyright © 1986-2014 CodeGods