Survey results released May 19 revealed a federal landscape struggling to keep up with cyberthreats or even to understand its own assets and infrastructure. According to The State of Cybersecurity from the Federal Cyber Executive Perspective report (PDF) released by KPMG and the International Information Systems Security Certification Consortium, 59 percent of federal workers say their agencies struggle to understand how cyber attackers could potentially breach their systems, while 40 percent said they were unaware where their key assets were located. About 65 percent said the federal government as a whole cannot detect ongoing cyber attacks.
The survey results contain many different metrics outlining many different issues, said Tony Hubbard, principal at KPMG. The one fundamental issue that underlies all the findings, however, is that of accountability.
“If you don’t have appropriate accountability for cyber, then a lot of these issues are going to manifest themselves,” Hubbard said. “It seems like any federal meeting you walk into that’s a cyber-related meeting, you get 50 people in the room who all have some aspect of responsibility, but it seems like a minority who actually feel like they’re accountable and empowered to do anything.”
Last year’s Office of Personnel Management (OPM) data breach that aired the personal information of at least 22.1 million people led to an effort OPM called a “Cybersecurity Sprint,” a 30-day effort to rectify the shortcomings that allowed the breach to happen in the first place. Despite that effort and the fallout from the breach itself, more than half of survey respondents disagreed that the “sprint” initiative improved security overall. A quarter of respondents said their agencies did nothing to respond to the OPM breach.
This is a frustrating time for chief information security officers, Hubbard said, because it’s often not made clear who is accountable when something goes wrong. And if someone will be held accountable, he said they may not be given the resources needed to do their job properly. What’s worse, government organizations as a whole do not fulfill their responsibilities to prevent security incidents.
In fact, many within government do not even acknowledge the importance of cybersecurity.
Of the IT personnel surveyed, only 8 percent said cybersecurity was unimportant or very unimportant. But in human resources, that number was 39 percent; in purchasing and procurement that number was 41 percent; and in communications and public relations it was 48 percent. When a half to one-third of an organization will not even acknowledge a problem that everyone is responsible for, how will government ever be able to solve this problem?, Hubbard asked.
“That’s really the $100,000 question, and we’re hoping this survey and other surveys like it will provide more light on the issue,” he said. “There’s a strong belief that these types of issues can be solved through a variety of technologies … but it’s not really a technology problem. It’s a people issue. That was one of the overwhelming themes of the survey — that the biggest risk around cyber is people, but the counter to that is that the biggest asset is people.”
Possible solutions, Hubbard said, include increased training within government, increased cybersecurity training at the university level to catch people before they enter the workforce, and a new incoming federal CISO who can empower and hold the right people accountable. The report concludes by saying that the fight against cyberthreats is not a sprint, but an everlasting marathon.
