OMB targets desktop hole in cybersecurity

Agencies are failing at the first line of defense against cyberattacks for lack of minimum desktop configuration security standards. And the Office of Management and Budget is trying to patch the gap, said Karen Evans, administrator for e-government and IT.Agencies must identify their standard configuration for major operating systems in their fiscal 2004 Federal Information Security Management Act report to OMB in September, Evans said. She addressed lawmakers during a recent hearing on network security before the House Government Reform Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census.“Both the CIO and inspector general must report on the status of agencywide policies regarding security standard configurations,” Evans said. “Agencies will be asked to list the specific benchmarks in use.”She said agencies must develop a configuration management process that sets an initial baseline for their hardware and software.“Government laptops should be configured to download the latest antivirus definitions before they are attached to the network,” Evans said. “Configurations of mobile devices and perimeter security devices such as firewalls and intrusion detection systems are especially important to mitigate risk.”The Transportation Department is one of a handful of agencies that already have standard configurations.Lisa Schlosser, Transportation’s associate CIO for IT program management, said her department “has established technical standards and minimum configuration guidelines for desktops. We are just starting to enforce these minimum standards through the acquisition process.”Transportation initially standardized desktop systems in the Office of the Secretary, which includes all the administrative offices for procurement, finance and technology. Schlosser said security updates are automatically pushed to client and notebook PCs by Microsoft Systems Management Server.“We configure each new employee the same way with the same software and the same controls,” she said. “We lock down their systems so they cannot download any new software without permission.”Schlosser said Transportation monitors the network at an undisclosed location and can tell if an employee violates IT policies.“The whole network is open if the desktop is not using minimum desktop configuration standards,” Schlosser said. “The boundary of anyone’s network goes as far as anyone’s handheld device or laptop. One handheld gets lost and your data becomes vulnerable.”Evans said the FISMA guidance will ask agencies whether they have patch management standards and use vulnerability scans and penetration tests.IT security experts and lawmakers had been pressing OMB to require agencies to meet the FISMA provision that calls for standards.Bob Dix, the subcommittee staff director, said chairman Adam Putnam (R-Fla.) wrote to Evans last week asking her to put more emphasis on configuration standards.“We are not sure OMB has adequately identified that requirement in their guidance,” Dix said at a recent FISMA conference sponsored by the Center for Democracy and Technology in Washington. “Agency leaders can say the law says they have to do this when making investment decisions.” He said Putnam is pleased to see OMB paying more attention to the FISMA provision.Alan Paller, director of research for the SANS Institute of Bethesda, Md., said FISMA’s provision for configuration standards is crucial.He said the Homeland Security Department should set up a testing laboratory to show agencies how to establish and maintain standards. Private firms such as Merrill Lynch & Co. Inc. of New York automatically scan employees’ notebooks and PCs to see if they meet standards, he said. If not, they are not allowed on the network.