The Office of Personnel Management\u2019s own inspector general recently completed an audit of the agency\u2019s security programs and practices and the findings were, at best, a mixed bag. Thorough and extensive, the resulting report could easily be applied to many agencies and is a piercing commentary on the state of cybersecurity in many federal agencies today.<\/p>\n\n\n\n
Interestingly, the audit used the NIST Cybersecurity Framework to measure the overall maturity level of the OPM security program with five levels of maturity ranging from \u201cAd Hoc\u201d to \u201cOptimized.\u201d<\/p>\n\n\n\n
The OIG report rates OPM\u2019s program overall level at 2 (\u201cDefined\u201d), although it gives the agency the high mark of 4 (\u201cManaged and Measurable\u201d) in their ability to respond to incidents. This comes as no surprise, given the high-profile breach of security clearance records in 2015 at OPM.<\/p>\n\n\n\n
The resulting OIG report offers three key lessons for agencies seeking to avoid the issues facing OPM today:<\/p>\n\n\n\n
1. Organize your assessment documents regularly.<\/b><\/p>\n\n\n\n
The tone of the report suggests a tension between the agency\u2019s security team and those performing the audit \u2014 an all-too-familiar situation seen today. In fact, the OIG notes that the agency has struggled with ongoing security control assessments for over a decade. Citing \u201caudit fatigue,\u201d the security team expresses that the audits are duplicative and strain already scarce resources. However, the OIG puts OPM\u2019s disorganization at fault, mentioning a specific occasion where auditors spent 600 hours evaluating a package of documents, only to discover the documents were outdated and incorrect.<\/p>\n\n\n\n
Whether an organization uses a simple folder or a high-end document management system, it is essential to implement and enforce a strict structure for organizing the voluminous documentation associated with assessment and authorization requirements. From time-stamping documents to making final copies read-only, agencies can save tremendous amounts of labor and time. But organizing documents is more than an administrative exercise. An accurate assessment of risk and planning for security program improvements rests squarely on the accuracy for documentation. If it isn\u2019t clear which documents are correct, how can an agency know how to improve their security posture?<\/p>\n\n\n\n
2. Resolve findings and enforce POA&Ms.<\/b><\/p>\n\n\n\n
The OIG report takes OPM to task for its failure to remediate findings from past audits, specifically citing weaknesses in continuous monitoring, contingency planning and Plans of Action and Milestones (POA&Ms). It notes that OPM has only closed 34 percent of the FISMA findings in the past two years \u2014 which is expected to only increase as FISMA audits continue. Some findings and recommendations have even been unresolved for over a decade.<\/p>\n\n\n\n
If POA&Ms are organized, it is much easier to stay ahead of audit findings and to resolve them before they become chronic issues. POA&Ms must have some \u201cteeth\u201d to be more than exercises in paperwork. Deadlines need to be taken seriously, and if a resource shortage is the cause of a continuous problem, agencies should document the reasons thoroughly to prepare for future audits. If findings are documented clearly, tension may also ease between security and audit teams \u2014 which can also lead to candid discussion and cooperation on how to improve an agency\u2019s overall security status.<\/p>\n\n\n\n
3. Don\u2019t wait for a major breach to happen.<\/b><\/p>\n\n\n\n
OPM\u2019s experience shows the agencies must develop a robust response capability before the face a major breach.<\/p>\n\n\n\n
As a result of the 2015 breach, OPM\u2019s reputation suffered and the agency head was asked to leave. More importantly, millions of people \u2014 including myself \u2014 found that their security clearance information had been compromised.<\/p>\n\n\n\n
Protection needs to be a reflexive action rather than a reaction. No agency is immune, but a robust and timely response capability could have mitigated the damage.<\/p>\n\n\n\n
Will IT modernization help?<\/b><\/p>\n\n\n\n
Unfortunately, many agencies see modernization as a complicated effort, rather than one that can resolve their security challenges. Support systems for new technology can be hard to find, and thus are more expensive. The transition period to a new system can also bring security issues itself, and there is always potential for new hardware and software to be vulnerable.<\/p>\n\n\n\n
Modernization is more than installing new software or eliminating unused and redundant legacy systems. It is an ongoing effort. It requires continuous upgrades, constant systems improvements, ongoing staff training, and a commitment to security from the top. It\u2019s essential for agencies to look at modernization as an opportunity to simplify and streamline systems, the types of efforts that can help them avoid the challenges facing OPM.<\/p>\n\n\n\n
The OPM OIG report could easily be applied to many agencies and is a piercing commentary on the state of cybersecurity in many federal agencies today.<\/p>\n","protected":false},"author":7,"featured_media":37684,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":26,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[106,31,33,26],"tags":[],"coauthors":[7659],"class_list":["post-24215","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-home","category-newsletters","category-opinions"],"acf":{"subheadline":"","legacy_arc_id":"XSD4OM74KREMNDYJPYR5WBYEEU","arc_canonical_url":"\/opinion\/2017\/12\/13\/what-agencies-can-learn-from-opms-cyber-challenges\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n