IG report: Secret Service suffers network security lapses

The Secret Service is falling short in its efforts to protect sensitive online data about its operations and in securing its IT networks, according to two new reports from Homeland Security Department Inspector General Richard L. Skinner.

The inspector general's audit found inadequacies in the security controls for sensitive data about protective operations contained in the Secret Service Web System (SSWeb).

A redacted copy of the audit is available on the inspector general's Web site.

Vulnerabilities were discovered in access controls, configuration management procedures and continuity of operations safeguards, the report said. In some cases, default passwords were not changed at the time new software was installed.

"Due to these database security exposures, there is an increased risk that unauthorized individuals could gain access to critical Secret Service database resources and compromise the confidentiality, integrity and availability of sensitive SSWeb data," the report said. "Further[more], the Secret Service may not be able to recover SSWeb following a disaster."

Skinner recommended that the Secret Service ensure adequate controls for user access, review systems to facilitate the detection of inappropriate access, complete a configuration management plan and develop an IT contingency plan.

The Secret Service generally agreed with the findings.

In a second report, the inspector general examined the Secret Service's security controls for selected wired-based, sensitive but unclassified networks and judged them to be ineffective.

"The Secret Service has not developed adequate policies and procedures or fully implemented processes that address security testing, monitoring network activities with audit trails and configuration and patch management," according to this second report.

As a result, there is increased risk for unauthorized access to the service's sensitive resources and data, the inspector general wrote.

In a third report released today, the inspector general reviewed Customs and Border Protection agency policies and procedures to secure its networks and concluded that they were inadequate with respect to security testing, monitoring network activities with audit trails and patch management. In addition, controls are lacking "to ensure that data residing on and traveling through its network resources is properly protected," the report said.

About the Author

Alice Lipowicz is a staff writer covering government 2.0, homeland security and other IT policies for Federal Computer Week.

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above.

What is your e-mail address?

My e-mail address is:

Do you have a password?

Forgot your password? Click here

Washington Technology Daily

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.


contracts DB