Out of 24 reporting agencies, 13 either scored an F or a D in the annual report card scores required under FISMA.
Overall, the government scored a D+ on network security.
"This year, the federal government as a whole hardly improved," Rep. Tom Davis (R-Va.), chairman of the House Government Reform Committee, said at a Thursday hearing.
"When it comes to federal IT policy and information security, it is still difficult to get people -- even members of Congress -- engaged."
Davis said that "some" agencies still view FISMA as a "paperwork exercise."
"These are short-sighted observations," he said. "As a result of the government's aggressive push to advance e-government, many government information systems hold personal information about citizens and employees, in addition to other types of data."
A new report issued Thursday by the government information and data analysis firm INPUT also underscored Davis' remarks.
"FISMA has become a largely paperwork drill among the departments and agencies, consuming an inordinate amount of resources for reporting progress while putting in place very little in the way of actual security improvements," Bruce Brody, the vice president for information security at INPUT, said in a statement.
Davis said he wanted agencies to actively protect their systems instead of "just reacting to the latest threat with patches and other responses."
The annual report cards indicate that the government made some improvements in developing configuration plans, employee security training and certifying and accrediting systems.
However, most agencies were found still lacking in implementing configuration, inconsistent incident reporting and annual testing of security controls.
"For many years, we have reported that poor information security is a widespread problem that has potentially devastating consequences," Gregory C. Wilshusen, director of Information Security Issues at the General Accountability Office, told Davis' committee.
Wilshusen added: "Nevertheless, progress was uneven [in 2005]. For example, the percentage of agency systems reviewed declined from 96 percent in 2004 to 84 percent in 2005, and the percentage of employees and contractors receiving security awareness training also declined, from 88 percent in 2004 to 81 percent in 2005."
In concluding his remarks on the annual report cards, Davis said: "If FISMA was the No Child Left Behind Act, a lot of critical agencies would be on the list of 'low performers.' None of would accept D+ grades on our children's report cards. We can't accept these either."
Autor: Roy Mark
Quelle: InternetNews, 16.03.2006
