IG: Interior needs to tighten computer security

The Interior Department needs to tighten up the security and user access controls for its computer systems, according to a new report from the department's Office of Inspector General.

The OIG's report states that Interior had implemented a strong user authentication system to reduce to the possibility of unauthorized access to sensitive information. However, Interior's logical access controls -- the protocols that authorize user requests to access information systems -- do not meet the standards set by the National Institute of Standards and Technology.

As of March 31, Interior had 71,290 general and 4,728 privileged users on its computer systems.

The OIG said getting logical access controls in compliance with NIST standards will ensure that general users cannot exceed their authorized clearance levels and gain access to more restricted functions, such as disabling, bypassing or changing security measures. It will also establish audit trails to track privileged users and minimize the risk of insider threats.

Independent firm KPMG found similar deficiencies in user access protocols when it conducted audits in fiscal 2014 and 2015. KPMG said Interior did not document its process for granting and revoking user access credentials.

OIG auditors said Interior also needs to encrypt its mobile computing devices -- namely smartphones and tablets -- to secure sensitive information and prevent it from being accessed if devices are lost or stolen. Thousands of the devices currently lack sufficient security controls, according to the OIG.

Additionally, the report states that Interior cannot analyze encrypted traffic, which constitutes 40 percent of its traffic. Department officials said they plan to develop forensic and monitoring capabilities to address the deficiency.

On a positive note, the OIG said Interior has instituted multifactor authentication and improved its software inventory management to prevent wasteful spending.