Securing data is never easy. It often requires the infusion of outside expertise to put together an effective information security strategy. Data stored on government servers is especially valuable to both individual fraudsters and nation-state actors, and government agencies have been under pressure to enhance their infrastructure security capabilities and take additional measures to protect sensitive records.

A recent audit of the U.S. government’s Office of Personnel Management (OPM) suggested that many agencies, including the OPM, still have a long way to go. To get their security programs off the ground, government organizations must build trust with the private sector and tap companies in the security industry to guide their efforts.

Auditing National Infrastructure Security

The OPM audit found that while the agency had improved its overall data protection program, a moratorium implemented during fiscal year 2015 on all security assessment and authorization activities effectively weakened its security posture. The following year, the OPM authorized a sprint that was designed to bring all systems into compliance. The purpose of the most recent audit was to evaluate the status of that effort.

Two-thirds of the wide area network (WAN) and local area network (LAN) security controls the inspection team tested were found to be either not satisfied or only partially satisfied. The auditors opined that in this state, the likelihood of being able to identify vulnerabilities is significantly reduced.

Even more critical is the absence of a standard LAN/WAN system security plan (SSP). In the auditor’s view, the SSP completeness is foundational. Without it, security teams lack inventory controls and knowledge of what is present within the network.

An Executive Order

Along with the audit, the White House issued its “Presidential Executive Order on Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure,” which gave each agency and department head 90 days to produce a risk management report to the secretary of the Department of Homeland Security (DHS) and the director of the Office of Management and Budget (OMB). The report must document “the risk mitigation and acceptance choices made by each agency head,” including strategic, operational and budgetary considerations as well as unmitigated vulnerabilities.

These agencies and departments are expected to use the National Institute of Standards and Technology’s (NIST) “Framework for Improving Critical Infrastructure Cybersecurity.” To that end, the NIST issued an implementation guide to help organizations comply with the executive order.

The Private Sector’s Perspective

As government agencies such as the OPM grapple with infrastructure security issues, cybersecurity experts have called for government organizations to think about these challenges from the private sector’s point of view. According to FCW, government agencies should focus on building trust with the security industry and, in turn, rely on the industry to evolve cybersecurity stratagems.

Additionally, the advisory board to the NIST challenged the House of Representatives’ Science, Space and Technology Committee’s approved legislation, which tasked the NIST with conducting cybersecurity audits of government agencies and departments. While the organization has always been associated with the creation of standards and guidance, the advisory board opined that the responsibility shift would “complicate its current mission as a neutral adviser.”

Meanwhile, the Information Security Oversight Office (ISOO)’s “2016 Report to the President” revealed that the cost to maintain classification management systems in 2016 was approximately $16.89 billion. The report also found that most government organizations had “established uniform procedures to ensure that automated information systems, including networks and telecommunications systems that store classified information, prevent access by unauthorized persons, ensure the integrity of the information and, to the maximum extent practicable, use common information technology standards and protocols.”

Waiting For an Invitation

U.S. government organizations certainly have their work cut out for them. The president’s executive order should make a significant dent in the initiative to bolster security across all agencies, but the government can’t do it alone. Private entities are ready and able to guide the government’s efforts to establish a plan to secure the nation’s infrastructure, but they appear to be waiting for an invitation.

More from Government

Unpacking the NIST cybersecurity framework 2.0

4 min read - The NIST cybersecurity framework (CSF) helps organizations improve risk management using common language that focuses on business drivers to enhance cybersecurity.NIST CSF 1.0 was released in February 2014, and version 1.1 in April 2018. In February 2024, NIST released its newest CSF iteration: 2.0. The journey to CSF 2.0 began with a request for information (RFI) in February 2022. Over the next two years, NIST engaged the cybersecurity community through analysis, workshops, comments and draft revision to refine existing standards…

Updated SBOM guidance: A new era for software transparency?

3 min read - The cost of cyberattacks on software supply chains is a growing problem, with the average data breach costing $4.45 million in 2023. Since President Biden’s 2021 executive order, software bills of materials (SBOMs) have become a cornerstone in protecting supply chains.In December 2023, the National Security Agency (NSA) published new guidance to help organizations incorporate SBOMs and combat the threat of supply chain attacks.Let’s look at how things have developed since Biden’s 2021 order and what these updates mean for…

Roundup: Federal action that shaped cybersecurity in 2023

3 min read - As 2023 draws to a close, it’s time to look back on our top five federal cyber stories of the year: a compilation of pivotal moments and key developments that have significantly shaped the landscape of cybersecurity at the federal level.These stories highlight the challenges federal agencies faced in securing digital infrastructure in the past year and explore the evolving nature of cyber threats, as well as the innovative responses required to address them.New White House cybersecurity strategyThe White House’s…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today