GovernmentExecutive.com

By Judi Hasson

What Is It?

During the 1990s, the government transitioned from mainframe computers to networked computing, connecting federal employees to one another as well as to the public. Agencies also began to create Web sites to present information to the public and offer new ways to access services.

But the new networked government also opened up databases to hackers as well as federal employees who were inclined to snoop through private data or wanted to cause problems. Agencies rarely included plans to secure data or deploy applications that could monitor intrusions or detect whether employees were accessing forbidden files when they began to develop a system or network. That left federal systems wide open to cyberattacks, which increased intensity for years.

Congress became more concerned about the growing number of reports that warned how vulnerable computer networks were to hacking and federal managers' lack of attention to, or concern about, securing their networks. That fear culminated in the passage of the 2002 Federal Information Security Management Act, known as FISMA.

FISMA mandates basic security standards for government information technology systems. It requires agencies to detect and report security vulnerabilities in computer systems. It also calls forthem to improve the information security framework -- the blueprint for how they will secure their networks. It includes a set of directives governing agencies' security responsibilities and how to comply with the law.

FISMA requires a federal agency to notify the United States Computer Emergency Readiness Team, a partnership between the Homeland Security Department and public and private organizations, if it detects an attempt to break into a computer system, if a security breach occurs or other security incidents such as an employee losing a government laptop. The law requires agency program officers, chief information officers and inspectors general to conduct an annual review of the agency's information security program and report the results to the Office of Management and Budget. OMB uses this information for an annual report it submits to Congress on how well agencies have complied with the law.

FISMA standards apply to 24 federal agencies. Each of these agencies receives a grade on how well its met 17 security functions. FISMA requires agencies to develop information security programs that, according to the Government Accountability Office, include:

* Periodic assessments of risk;
* Risk-based policies and procedures;
* Subordinate plans for providing adequate information security for networks, facilities and systems or groups of information systems, as appropriate;
* Security awareness training for agency personnel, including contractors and other users of information systems;
* Periodic testing and evaluation of information security procedures and practices, performed with a frequency depending on risk, but no less than annually;
* A process for planning, completing, evaluating and documenting remedial action to address deficiencies;
* Procedures to detect, report and respond to security incidents; and
* Plans and procedures to ensure continuity of operations.

Every year, agencies are graded on how well they comply with FISMA. Since the grades were first issued in 2002, most agencies have received a failing grade. FISMA is intended to advance information systems to a higher level of security, and agencies are getting better grades every year. But agency systems still have plenty of flaws and the grades reflect that.

Why Should I Care?

With the increase in electronic information, federal agencies are relying extensively on information systems to carry out their missions. But this reliance also has increased the risk of hackers breaking into federal networks to steal sensitive government data and people's identities and break into bank accounts and apply for fraudulent credit cards. More computer activity also opens up agencies to more computer viruses that can disrupt systems.

Agencies routinely integrate new technologies into existing computer systems, and each time an application or upgrade is added, it creates the possibility that a another security vulnerability has been introduced. Research shows that federal IT managers, as well as those the private sector, do not recertify and accredit the system soon after the addition.

Many agencies have not implemented controls to prevent, limit or detect access to computer networks, systems or information, according to GAO. And agencies do not consistently identify and authenticate users to prevent unauthorized access or establish sufficient protection mechanisms.

A lax approach to security may partly be the reason why the number of security incidents -- such as accessing files by persons not authorized to do so, scans and probes of networks, and malicious code finding its way into a system -- have been increasing at a rapid rate over the past few years. The number of incidents agencies reported to US-CERT rose from 3,634 in fiscal 2005 to 13,029 in fiscal 2007, a 259 percent increase, according to the organization.

"The security of these systems and data is essential to prevent data tampering, disruptions in critical operations, fraud and the inappropriate disclosure of sensitive information," GAO wrote in a letter to Congress on July 27, 2007.

The Latest Thinking

FISMA's history has been marked by controversy. Many government security experts say the law does not make agencies' systems more secure because FISMA requires agencies to report whether they've followed processes to check for system vulnerabilities, not whether they've implemented practices that directly affect information security. As such, critics call FISMA an exercise in paper pushing, requiring agencies to submit frequent reports that outline their compliance with processes. In a June 2007 report, GAO wrote: "Opportunities exist for enhanced FISMA reporting and independent evaluations. Although OMB increased its reporting guidance to agencies, the metrics used do not measure how effectively agencies are performing various activities. For example, agencies report on the number of systems undergoing test and evaluation in the past year, but there is no measure of the quality of agencies' test and evaluation processes. Additionally, there are no requirements to report on certain key activities such as patch management."

While agencies make progress to implement certain information security requirements, critics say the law still has left federal systems vulnerable. "FISMA has overbureacratized [security] to the point you don't know what it means," says Bruce Brody, vice president for information assurance at CACI International Inc. and associate deputy assistant secretary for cyber and information security at the Veterans Affairs Department from 2001 to 2004. "It does not mean that an 'A' makes you secure and an 'F' makes you not secure."

How Do I Get Started?

Most agencies are far along since they've had five years of FISMA reporting. They should have compliance procedures in place and be evaluating their grades every year with an eye toward improving them.

OMB has specific guidance about individual FISMA requirements, which include:

* Make an inventory of systems for monitoring, testing and evaluating information security controls
* Provide information security for systems that support the agency's operation and assets, including those managed by another agency or contractor.
* Develop planning, implementation, evaluating and documenting remedial action to deal with deficiencies.

How Do I Get Better Grades?

The goal of any security program is to have nothing happen. But you can never be sure that you will have a quiet year or your security systems will not be attacked.

One of the most significant problems information security executives face today is where to invest in security. Should money be devoted to fight specific new types of security attacks, or would it be better to direct funds elsewhere if there is no evidence of routine attacks?

One way to attack the problem, security experts say, is to think about complying with FISMA. Make sure you know what part of your security system got bad grades so you'll know what need to improve. Also, be sure you stay in compliance with your highest grades so they don't drop.

Judi Hasson is a Washington-based freelance journalist who covers government information technology.

FISMA Reports:

Fiscal Year 2007 Report to Congress on Implementation of the Federal Information Security Management Act of 2002

The Security Content Automation Protocol Checklists

Information Security: Sustained Management Commitment and Oversight Are Vital to Resolving Long-Standing Weaknesses at the Department of Veterans Affairs