White House agency getting worse at cyber-defense

The White House Office of Personnel Management, two years ago the focus of the worst cybersecurity intelligence breach in U.S. history, is actually regressing in its efforts to provide adequate defenses against further cyber-intrusions, according to a new report by the agency’s own Inspector General.

The report is depressing news for an agency that has been in more-or-less continuous turmoil since a devastating cyber-attack in March 2014 stole the sensitive personal information of some 25 million U.S. government employees, including millions of security clearance files, from the agency files and those of two of its important contractors. The fingerprint data of some 5.6 million of those employees was also stolen. 

According to a scathing report on the break-in published two months ago by the Republican majority on the House Committee on Oversight and Government Reform, the intelligence value of the theft, carried out from China, “cannot be overstated, nor will it ever be fully known.”  

What is clear, however, is that despite improvements that the Inspector General acknowledges, the agency known as OPM is still stumbling toward an adequate response to the disaster, along with other high-profile and expensive efforts to modernize its information technology and security, and has had a “significant regression” in complying with information security requirements along the way. 

The latest IG report notes that the agency is still suffering from high staff turnover in sensitive info-security jobs and top management—including five Chief Information Officers in three years—as well as  longstanding failures to check security controls on computer systems to make sure they are adequate.

It is also lethargic in dealing with a variety of longstanding security weaknesses and has still not taken action on scores of security recommendations laid out in previous Inspector General reports—some made years before the catastrophic hack. 

Among other things, the report notes that only two of the agency’s major computer applications comply with the government’s own standards for verifying user identities, which date back to 2012.

Among the 18 “major” computer systems that have not been given a renewed OK on their security controls, the report notes, are five that are owned by the Chief Information Officer, two that belong to the chief financial officer, and four systems that were inherited  by a newly amalgamated National Background Investigation Bureau, a reformed chunk of the bureaucracy that now operates under the Department of Defense.

One of the systems is also owned by the Office of the Inspector General. 

Indeed, according to the report, OPM, despite “several initiatives underway,” still lacks a full inventory of its many servers, databases and software, let along the important issue of how they are linked with each other—fundamentals of a robust cyber-defense.

The report drily notes that lack of what it calls a “mature inventory system significantly hinders OPM’s efforts related to oversight, risk management, and securing the agency’s information systems.”

In another section, the document observes that even when OPM scanning turns up less-than-critical weaknesses, the agency does not track the efforts made to correct them,  “there is a significantly increased risk that these weaknesses will not be addressed in a timely manner, and that the systems will indefinitely remain susceptible to attack.” 

To fix the problems—or at least address them—the audit report offers up a barrage of 26 recommendations, with notes alongside many of them to show they are repeats of recommendations made years before. 

For its part, the agency management concurs with almost all of them, including new staffing hires and appropriate inventories. 

It balked slightly, however, at a diffident suggestion that the Director of OPM—currently, Acting Director Beth Colbert—“consider shutting down information systems that do not have a current and valid [security] Authorization.”

The agency said it would prefer to make its own “risk-based decision” on whether to keep operating a system without that clearance, then forward it’s evaluation to the OPM head for “ultimate decision.” 

Perhaps that is progress: the Inspector General first made the shut-down suggestion in 2014—the year of the great cyber-theft—without any apparent effect. 

A spokesman for OPM declined to comment on a number of questions from Fox News about the audit and the time-table for following through on various recommendations.