State Department gets failing cybersecurity grades again in new report

The State Department spends $1.92 billion annually on information technology. But one of America's most important government agencies cannot seem to get cybersecurity right.

Despite being one of the most tempting targets on the planet for hackers and spending $1.92 billion annually on information technology, the U.S. State Department earned more failing grades on cybersecurity from internal watchdogs this year who charged that leadership couldn’t ensure the department’s security program is effective against growing threats.

The state of security at the State Department has been widely criticized for nearly a decade while under the leadership of both Hillary Clinton and John Kerry. The spotlight turned hot in 2014 when suspected Russian hackers breached the department’s email system. The hack is considered among the “worst ever” to hit the U.S. government. The State Department plays a crucial role in the federal government as it is responsible for the country’s international relations.

A new report from the State Department’s Office of Inspector General (OIG) served as both a stark reminder of past failing grades and a warning that significant vulnerabilities are getting worse. In more than 55 percent of attacks and incidents reviewed by the watch dogs, the Department failed to comply with its own security policies, according to an Inspector General report from Spring 2016.

The report cited three specific problems facing the department. A bad network user account management process at State left 1,850 unneeded accounts inactive for over a year, providing potent attack vectors for hackers who can use an unneeded inactive account to gain access, elevate its permissions, compromise the integrity of the department’s network and cause “widespread damage across the department’s [information technology] infrastructure,” according to the Inspector General’s report.

Worse, hackers using inactive but undeleted accounts could have free reign on sensitive data “without being detected, creating the risk of data loss and theft and compromising user identities and the accountability of user actions.”

A lack of “IT contingency plans” both in Washington and overseas continues to plague the department five years after watchdogs first pointed out the deficiency. The Inspector General’s report also charged that the Department’s current reporting structure meant information security risks are not properly communicated and risk being miscommunicated “which in turn could increase the likelihood and impact of potential attacks.”

“Since 2010, OIG has reported that the Department lacks effective risk management for all phases of the system development lifecycle,” the report charged. “These problems, however, have persisted.”

There are wins listed in the report. In the last year, the State Department cyber team was a part of the launch of an interagency task force made up of the State Department, the National Security Agency, the Department of Homeland Security and industry experts to respond to security threats. The result of that program is “a new capacity to stop suspicious emails and identify malicious attachments that are designed to evade traditional security defenses.”

Additionally, cybersecurity awareness training reached over 140,000 network users in 2016.

If anything could overshadow the cybersecurity criticisms, it’s the marquee issue that plagued former Secretary Clinton’s recently ended presidential campaign: Email. Across the department and around the world, the OIG charged there were problems managing records “at many levels in the department” that increase “the risk of a loss of institutional knowledge and potentially creating an inability to locate and retrieve documents or communications necessary to support key operations.”

When the State Department did spend its $1.92 billion tech budget, a lack of oversight led to duplicated efforts and poor transparency, according to the report.

The State Department has not yet responded to a request for comment. Despite a string of scathing Inspector General reports in the last half-decade, State Department spokespeople have often disagreed and called their cybersecurity program “strong.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure