More than two years after historic breach, OPM continues to struggle with cybersecurity

The agency's Inspector General said things haven't really gotten better since OPM's infamous breach.

The Office of Personnel Management continues to struggle with cybersecurity more than two years after the agency first publicly acknowledged they were breached due to poor security practices, according to a newly released Office of the Inspector General report.

The report, which focuses on the state of systems during fiscal year 2017, concludes that while OPM has “made improvements in its Security Assessment and Authorization (Authorization) program,” inspectors were nonetheless able to find a “significant deficiency in OPM’s information security management structure.”

This translated to a poor overall cybersecurity score, as defined by the National Institute of Standards and Technology, of two out of five for OPM. The score from the OIG is supposed to define the “maturity” level of an organization in relation to the security of information systems.

This lackluster rating is due in large part to inaction by the agency regarding prior security recommendations referenced in other audits.

“OPM is not making substantial progress in implementing our FISMA recommendations from prior audits,” the report reads. “While resource limitations certainly impact the effectiveness of OPM’s cybersecurity program, the staff currently in place is not fulfilling its responsibilities that are outlined in OPM policies and required by FISMA.”

A piece of legislation known as the Federal Information Security Modernization Act, or FISMA, which was enacted into law during the Obama administration in 2014, requires inspector general offices to conduct annual information security assessments within multiple federal agencies.

The OIG-OPM report disclosed Monday is a result of FISMA being implemented.

Although OPM has reportedly made improvements in several recognized issue areas, including for example with the agencies’ increased ability to quickly remediate cyberattacks due to a more competent incident response process, it “continues to struggle” in other domains. The OIG took note — repeatedly — of what they precisely described as a longstanding lack of “contingency planning” and a failure to enforce continuous monitoring program policies.

OPM failed to test contingency plans that it had devised — like those used in emergency situations, data breaches and unpredictable system failures — across a number of different divisions; representing a continuation of past problems, the report identified.

According to the OIG, the lack of such testing could one day be catastrophic.

“OPM’s failure to test the contingency plans for almost 90 percent of its systems is a symptom of the significant deficiency in the agency’s information security governance structure,” according to the OIG. “Failure to appropriately manage information system contingency plans in a changing environment increases the risk that contingency plans will not meet OPM’s system recovery time and business objectives should disruptive events occur.”

Under the Trump administration, OPM saw an overall budget boost in fiscal year 2017 of approximately $18 million. A significant portion of this new funding was allocated to upgrading legacy IT systems, which are typically more difficult to update and therefore maintain secure.

Jeff Pon, the White House’s nominee for the OPM director post, has said he will prioritize the recruitment of cybersecurity professionals; calling it his “number one” priority during a recent confirmation hearing.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure