The Federal Communications Commission still has data flowing through its network without proper encryption, according to an April 24 report from the Government Accountability Office.<\/p>\n\n\n\n
The GAO report looked at the implementation status of 136 information security recommendations from a September 2019 evaluation by the watchdog agency. As of November 2019, it found that the FCC has fully implemented 85 of the recommendations, with 10 partially implemented and another 41 not addressed.<\/p>\n\n\n\n
Key steps that the FCC must take, the GAO wrote, include resolving known vulnerabilities, applying security patches and improving network-monitoring capabilities.<\/p>\n\n\n\n
The FCC is in the process of correcting basic cybersecurity shortfalls, like properly protecting data, giving IT systems proper authorization to operate and speeding up incident response. According to the GAO, the FCC has created action plans to address the remaining recommendations by April 2021.<\/p>\n\n\n\n
In seven instances, the GAO found, the commission didn\u2019t properly secure data with strong encryption or establish a secure communications path between a user and an information system.<\/p>\n\n\n\n
\u201cThese deficiencies existed primarily because commission personnel did not adequately monitor configuration settings,” the GAO wrote. \u201cBy not consistently deploying strong encryption capabilities, FCC limits its ability to protect the confidentiality and integrity of its sensitive information.\u201d<\/p>\n\n\n\n
As of November 2019, the commission was still working to implement proper encryption capabilities, according to the GAO.<\/p>\n\n\n\n
The GAO also found that the FCC was using two systems whose authorization to operate, or ATO, had expired. The FCC granted a full ATO to one of the systems after September last year, but the other system won\u2019t receive its full ATO until \u201clater in 2020\u201d the GAO wrote.<\/p>\n\n\n\n
\u201cBy not regularly updating the risk assessment of one system and continuing to operate another system without a current authorization to operate, FCC unnecessarily exposed the information on these systems to increased risks of unauthorized changes and access to information,\u201d the GAO wrote.<\/p>\n\n\n\n
The GAO also said that the FCC didn\u2019t specify several cybersecurity control requirements to its cloud service provider, such as retaining audit records, meeting incident reporting time frames and protecting system boundaries as mandated by the Federal Risk and Authorization Management Program. The FCC plans to solve this issue by May this year.<\/p>\n\n\n\n
\u201cBy not specifying its specific control requirements when procuring services from its cloud provider, FCC increased the risk that its data and sensitive regulatory information will not be adequately protected in the event that its cloud service provider experiences a security breach,\u201d the GAO wrote.<\/p>\n\n\n\n
The report said the FCC had developed a plan of action and milestone for the remaining open recommendations.<\/p>\n\n\n\n
By May 1, the FCC aims to reduce the number of open recommendation to 23. By April 30, 2021, the commission wants all problems resolved.<\/p>\n\n\n\n
\u201cUntil FCC fully implements these recommendations and resolves the associated deficiencies, its information systems and information will remain at increased risk of misuse, improper disclosure or modification, and loss,\u201d GAO officials wrote.<\/p>\n","protected":false},"excerpt":{"rendered":"
A GAO report found that the commission lacks security basic measures, such as encryption.<\/p>\n","protected":false},"author":7,"featured_media":47999,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":63,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[63,106,31,110,14,33,9,40],"tags":[],"coauthors":[3242],"class_list":["post-28427","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud","category-daily-brief","category-home","category-it-cloud-report","category-it-networks","category-newsletters","category-federal-oversight","category-watchdogs"],"acf":{"subheadline":"","legacy_arc_id":"S7MDUH4XEBCNFKI2VTUPVZSVME","arc_canonical_url":"\/dod\/2020\/04\/27\/the-fcc-needs-to-address-basic-cyber-hygiene-issues\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n