GAO reminds White House of cyber backlog

An 80-page report from the government watchdog details the cybersecurity policy to-do list for the White House.

A congressional watchdog is sending a reminder to the White House that it has a long laundry list of cybersecurity regulations to address as the 2024 election draws near.

The Government Accountability Office is breaking biennial tradition with the latest update to its “high-risk list,” a term the watchdog uses to denote areas that are “vulnerable to waste, fraud, abuse, or mismanagement, or in need of transformation.”

Cybersecurity has been on the GAO’s high-risk list since 1997, Sarah Kaczmarek, acting managing director for GAO’s Office of Public Affairs, said during a call with reporters this week.

“That high-risk area has evolved as technology has changed, of course, and while this is an off year for the high-risk list, the comptroller general felt it was important to issue an update on our work on cybersecurity,” Kaczmarek said.

The more than 80-page report goes over four main areas: establishing a comprehensive cybersecurity strategy with effective oversight, securing federal systems and information, protecting critical infrastructure and protecting privacy and sensitive data.

The White House has yet to implement 567 out of 1,610 cybersecurity-related recommendations the government watchdog has issued since 2010, according to the report.

“A lot of them are really, really critical to securing the cybersecurity of our nation,” said Marisol Cruz Cain, director of information technology and cybersecurity at the GAO.

One of the biggest recent recommendations focused on implementing the national cybersecurity strategy. The GAO reported in February that the White House’s cybersecurity strategy implementation plan lacked performance measures and estimated costs, limiting the ability to determine the effectiveness of the strategy — a particularly salient point since the strategy is an evolving document meant to be updated once a year to keep up with the fast-changing field.

The Office of the National Cyber Director disagreed with the assertion, however, claiming that the field does not have “outcome-oriented performance measures to assess cybersecurity effectiveness.” Last month, the White House issued the first update to the implementation plan, which added 31 more initiatives.

However, the added measures did not address the GAO’s criticism, Cruz Cain said. “It did not establish any outcome-oriented performance measures, and we think that’s really important because there was a lot of time and effort put into both the strategy and the implementation plan. And how are we going to know if it’s successful if we don’t base that on certain outcomes that we want to see?”

Another major challenge is in critical infrastructure protection, with more than half of the 126 recommendations on the topic still unaddressed, the report said. While the GAO noted the administration took steps to address challenges in protecting critical networks like those that undergird water and electricity, the watchdog “has continued to report shortcomings in efforts to ensure the security of key critical infrastructures.”

The report noted that federal agencies in charge of critical infrastructure sectors should take a more active role in ensuring that best practices for defending against ransomware are followed. The GAO issued a report in January calling out federal agencies charged with overseeing critical manufacturing, energy, health care and transportation sectors that have little data on whether owners and operators have adopted best practices against ransomware.

National cyber director lays out White House plans to secure AI without writing new rules

The Trump administration executive order on artificial intelligence tried to strike the balance between responsible use, security and mutual benefit, all with an eye toward not making…

Supply chain challenges loom large in quantum race, White House official says

Most federal cybersecurity reporting rules are duplicative, study finds

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure