FDIC leads agencies in major cyber incidents

The Federal Deposit Insurance Corporation was responsible for 10 of 16 major information security incidents in FY2016, according to the annual report of the Office of Management and Budget.

The FDIC incidents, linked to a flaw in their system that permitted personally identifiable information to be downloaded to removable media, caused big headaches for tech officials at the agency when they were uncovered by Congress in May 2016.

Overall, however, the outlook appears to be improving for agencies' implementation of information security measures, including the use of dual-factor authentication for employee logins, the adoption of the Einstein 3A security screen by agencies (now said to cover 93 percent of federal employees), and the identification and protection of high value assets.

The annual Federal Information Security Modernization Act report sums up the observations and audits of inspectors general across the federal government and other agency data. Overall, agencies reported 30,899 cybersecurity incidents in fiscal 2016. Loss or theft of equipment was the most frequently reported attack vector with more than 5,300 incidents. Web and phishing attacks were also common, as well as attacks linked to improper usage. However, more than 11,000 incidents defied categorization, according to the report, and are listed only as "other."

Grant Schneider, the acting federal chief information security officer, said that despite improvements, more progress is needed, in a blog post accompanying the release of the report.

OMB was also encouraged by its quarterly review of data from the 23 civilian CFO Act agencies as part of the President's Management Council Cybersecurity Assessment.

According to the study, in the first quarter of fiscal 2016, only five CFO Act agencies had information security programs that met or exceeded government-wide performance goals. By the end of FY 2016 that number had more than doubled to 13 agencies meeting the goals, while all others were making significant progress, according to the report.

The report also said agencies stepped up their efforts to enforce the use of multi-factor Personal Identity Verification cards, with 81 percent of government users now using this credential to access federal networks. It said over 70 percent of federal agencies also have strong anti-phishing and malware capabilities and have also "made significant progress" in securing their high value IT.