GAO report: IT testing lacks consistency

A new General Accounting Office report has found that despite the emphasis placed on IT security in recent years, federal agencies are not testing their security controls with any consistency or timeliness. As a result, the agencies may not be aware of their systems' weaknesses.

"Federal agencies have not adequately designed and effectively implemented policies for periodically testing and evaluating information security controls," the GAO concluded after surveying 24 major agencies and conducting in-depth case studies on 30 IT systems at six of the agencies.

These problems are occurring despite the requirements of the Federal Information Security Management Act, under which agencies have been laboring since its passage in 2002. The study was initiated at the request of Rep. Tom Davis (R-Va.), chairman of the House Government Reform Committee and the originator of FISMA.

"What this shows is that we have a long way to go to ensure Americans the information their government keeps about them is safe," Davis said in a release. "We're going to do this, but it's going to take time."

It is unclear whether the committee will hold a hearing to discuss the findings, the committee added.

According to the GAO, none of the 24 agencies have fully implemented six elements included in guidelines and standards developed by the Office of Management and Budget and the National Institute for Standards and Technology for conducting effective security testing and evaluation. Those six elements are:

• Identifying the frequency of periodic testing;
  
• Defining roles and responsibilities of personnel performing the testing;
  
• Selecting a minimum set of security controls evaluated during periodic tests;
  
• Identifying and testing common security controls;
  
• Determining the depth and breadth of periodic testing; and
  
• Including assessment results in remediation plans.