Federal agencies are failing to protect sensitive data, Senate report finds

Seven agencies use systems that no longer receive software updates from their vendor.

Of eight federal agencies audited for their cybersecurity programs, only the Department of Homeland Security showed improvements in 2020, according to a report from the Senate Homeland Security and Governmental Affairs Committee.

Released by the panel on Tuesday, the report expresses concerns about the state of federal agencies’ cyber posture during an overall 8% rise in security incidents across agencies.

The report underscores the increased scrutiny of federal cybersecurity by lawmakers in the aftermath of a months-long alleged Russian cyber-espionage campaign the private sector first uncovered in December 2020. Russian hackers used a flaw in network management software SolarWinds to infiltrate nine government agencies.

The report found that seven of the eight agencies reviewed still use legacy systems that no longer have security updates supported by their vendor. The practice can leave agencies vulnerable to foreign hacking, the report notes.

“It is clear that the data entrusted to these eight key agencies remain at risk,” the report states. “As hackers, both state-sponsored and otherwise, become increasingly sophisticated and persistent, Congress and the executive branch cannot continue to allow [personally identifiable information] and national security secrets to remain vulnerable.”

The report culls from 2020 inspector general reports for the Departments of Homeland Security, State, Transportation, Housing and Urban Development, Agriculture, Health and Human Services, Education and the Social Security Administration.

Among the specific agency findings the report highlights are that the State Department could not provide documentation for 60% of the employees sampled that had access to its classified networks. The Department of Education’s inspector general found in a test that it was able to steal hundreds of files of personal information from the agency, including credit card numbers, without the agency blocking it.

The report calls for Congress to update the 2014 Federal Information Security Modernization Act to require federal agencies to notify DHS’s Cybersecurity and Infrastructure Security Agency of cyber incidents and to formalize the agency’s role of leading federal cybersecurity operations. The report also recommends an expansion of CISA’s offerings to federal agencies and for the agency to produce a plan to update its intrusion detections system, EINSTEIN.

The committee recommends a primary office to coordinate with agencies for a federal-government-wide cybersecurity strategy. National Cyber Director Chris Inglis, who recently took the helm of the newly created office, says he is working on coordinating such an approach. President Biden in May signed an executive order setting a number of benchmarks to improve federal cybersecurity.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure