The Department of Energy is lacking in multifactor authentication for cybersecurity, according to an audit by the department\u2019s Office of Inspector General.<\/p>\n\n\n\n
Despite longstanding federal requirements for multifactor authentication, in which users must provide multiple types of authentication before logging in, DOE\u2019s procedures still have weaknesses, the IG found.<\/p>\n\n\n\n
\u201cOur review of 18 federal information systems, including those systems operated by contractors, identified weaknesses related to ensuring adequate protections over access to network and application resources, and noted that information reported to [the Office of Management and Budget] related to the Cybersecurity Sprint was not always consistent,\u201d said the audit.<\/p>\n\n\n\n
\u201cAlthough requirements existed for more than 10 years, none of the locations reviewed had fully implemented multifactor authentication for secure access to information systems and resources,\u201d the audit said.<\/p>\n\n\n\n
In addition, government and contractor sites have sometimes not even considered applying multifactor authentication for software, including apps that contain sensitive personal information.<\/p>\n\n\n\n
\u201cThe weaknesses identified occurred, in part, because officials had not fully planned for implementation of multifactor authentication on information systems,\u201d the IG concluded. \u201cDepartment guidance and requirements related to multifactor authentication technologies also were not always communicated effectively.\u201d<\/p>\n\n\n\n
The IG recommended that DOE fully develop and disseminate multifactor authentication plans, and that authentication meet federal requirements.<\/p>\n","protected":false},"excerpt":{"rendered":"
Despite longstanding federal requirements for multifactor authentication, the Department of Energy\u2019s procedures still have weaknesses, according to the department\u2019s Office of Inspector General.<\/p>\n","protected":false},"author":7,"featured_media":54040,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":40,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"9":{"categories":["cyber"],"primary_category":"cyber"}}},"categories":[106,110,14,33,9,40],"tags":[],"coauthors":[3339],"class_list":["post-18335","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-it-cloud-report","category-it-networks","category-newsletters","category-federal-oversight","category-watchdogs"],"acf":{"subheadline":"","legacy_arc_id":"EVJREXFDWFGVBCRMB44WVGEIGA","arc_canonical_url":"\/federal-oversight\/watchdogs\/2017\/09\/27\/audit-finds-weaknesses-in-doe-cybersecurity\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n