US flag signifying that this is a United States Federal Government website Official website of the Department of Homeland Security

Cybersecurity

  • Evaluation of DHS' Information Security Program for Fiscal Year 2018

    Executive Summary

    DHS’ information security program was effective for fiscal year 2018 because the Department earned the targeted maturity rating, “Managed and Measurable” (Level 4) in four of five functions, as compared to last year’s lower overall rating, “Consistently Implemented” (Level 3). We attributed DHS’ progress to improvements in information security risk, configuration management practices, continuous monitoring, and more effective security training. By addressing the remaining deficiencies, DHS can further improve its security program ensuring its systems adequately protect the critical and sensitive data they store and process.

    Report Number
    OIG-19-60
    Issue Date
    Document File
    DHS Agency
    Oversight Area
    Fiscal Year
    2019
  • (U) Evaluation of DHS' Compliance with Federal Information Security Modernization Act Requirements for Intelligence Systems for Fiscal Year 2018

    Executive Summary

    We determined that DHS' information security program for Top Secret/Sensitive Compartmented Information intelligence systems is effective this year as the Department achieved “Level 4 – Managed and Measurable” in three of five cybersecurity functions, based on current reporting instructions for intelligence systems. However, we identified deficiencies in DHS’ overall patch management process and the Cybersecurity and Infrastructure Security Agency’s weakness remediation and security awareness training activities.
     

    We made one recommendation to the Office of Intelligence and Analysis and two recommendations to the Cybersecurity and Infrastructure Security Agency to address the deficiencies identified. DHS concurred with all three recommendations.

    Report Number
    OIG-19-34-UNSUM
    Issue Date
    DHS Agency
    Oversight Area
    Fiscal Year
    2019
  • Progress Made, But Additional Efforts are Needed to Secure the Election Infrastructure

    Executive Summary

    Prompted by the suspicious cyber activities on election systems in 2016, Secretary Jeh Johnson designated the election infrastructure as a subsector to one of the Nation’s existing critical sectors. Our audit objective was to evaluate the effectiveness of the Department’s efforts to coordinate with states on securing the Nation’s election infrastructure. DHS has taken some steps to mitigate risks to the Nation’s election infrastructure; however, improved planning, more staff, and clearer guidance could better facilitate the Department’s coordination with state and local officials. Specifically, despite Federal requirements, DHS has not completed the plans and strategies critical to identifying emerging threats and mitigation activities, or established metrics to measure progress in securing the election infrastructure. Senior leadership turnover and insufficient guidance and administrative staff have hindered DHS’ ability to accomplish such planning.

    Report Number
    OIG-19-24
    Issue Date
    Document File
    DHS Agency
    Oversight Area
    Fiscal Year
    2019
  • (U) S&T Has Taken Steps to Address Insider Threats, But Management Challenges Remain

    Executive Summary

    We conducted our review of the Science and Technology’s (S&T) insider threat program between January 2017 and June 2017.  S&T is the primary research arm of the Department of Homeland Security (DHS).  Its mission is to strengthen the Nation’s security and resiliency by providing knowledge products and innovative solutions to support DHS mission operations.  Specifically, Congress created S&T in 2003 to conduct basic and applied research, development, demonstration, testing, and evaluation activities relevant to any or all elements of the Department.  S&T oversees laboratories where scientists perform mission-critical research on chemical and biological threats, radiological and nuclear detection, animal diseases, transportation security, and explosives trace identification.  S&T employees, contractors, and business partners—especially those with special or elevated privileges—can potentially use their inside knowledge and access to exploit vulnerabilities and cause harm to mission-critical systems and operations.  We made nine recommendations that, if implemented, should strengthen S&T’s management of insider threat risks.  The Department concurred with all of the recommendations.

    Report Number
    OIG-18-89-UNSUM
    Issue Date
    DHS Agency
    Oversight Area
    Fiscal Year
    2018
  • CBP Has Not Ensured Safeguards for Data Collected Using Unmanned Aircraft Systems

    Executive Summary

    In December 2014, OIG previously reported on the effectiveness and cost of the UAS program.2 Our report disclosed CBP had not developed performance measures needed to accurately assess program effectiveness and make informed decisions. CBP also did not recognize all UAS operating costs and, as such, the Congress and public may be unaware of the amount of resources invested in the program. This audit determined that CBP has not ensured effective safeguards for surveillance information, such as images and video, collected on and transmitted from its UAS. Without a privacy assessment, CBP could not determine whether ISR Systems contained data requiring safeguards per privacy laws, regulations, and DHS policy. CBP’s failure to implement adequate security controls according to Federal and DHS policy could result in potential loss of confidentiality, integrity, and availability of ISR Systems and its operations.

    Report Number
    OIG-18-79
    Issue Date
    Document File
    DHS Agency
    Oversight Area
    Fiscal Year
    2018
  • Fiscal Year 2017 Evaluation of DHS' Compliance with Federal Information Security Modernization Act Requirements for Intelligence Systems

    Executive Summary

    Pursuant to the Federal Information Security Modernization Act of 2014, we reviewed the Department’s security program, including its policies, procedures, and system security controls for the enterprise-wide intelligence system. Since our FY 2016 evaluation, the Office of Intelligence and Analysis (I&A) has continued to provide effective oversight of the department-wide intelligence system and has implemented programs to monitor ongoing security practices. In addition, the United States Coast Guard is in the process of migrating its intelligence users to a system that is jointly managed by the Defense Intelligence Agency and the National Geospatial Agency.

    Report Number
    OIG-18-59
    Issue Date
    Document File
    DHS Agency
    Oversight Area
    Fiscal Year
    2018
  • Evaluation of DHS' Information Security Program for Fiscal Year 2017

    Executive Summary

    We reviewed DHS’ information security program in accordance with the Federal Information Security Modernization Act of 2014 (FISMA). Our objective was to determine whether DHS’ information security program and practices were adequate and effective in protecting the information and information systems that supported DHS’ operations and assets in fiscal year 2017.

    Report Number
    OIG-18-56
    Issue Date
    Document File
    DHS Agency
    Oversight Area
    Fiscal Year
    2018
  • DHS Can Improve Cyber Threat Information Sharing

    For More Information, Contact

    Public Affairs (202) 254-4100

    For Immediate Release

    Download PDF (86.52 KB)

    In a newly released report, the Department of Homeland Security (DHS) Office of Inspector General (OIG) found that while DHS has established a process for sharing cyber threat information between the Federal government and the private sector, improvements are still needed. 

    DHS has developed the capability to share cyber threat information and defensive measures among Federal, state, local, tribal, and territorial governments; the private sector; information sharing analysis centers and organizations; and foreign government companies. DHS has also properly classified cyber threat indicators and defensive measures and accounted for the security clearances of private sector recipients who receive such information. 

    Despite this progress, DHS still faces challenges to effectively share cyber threat information across Federal and private sector entities. DHS’ system is focused on volume, velocity, and timeliness of information but does not provide the quality, contextual data needed to effectively defend against ever-evolving threats. Because the system is automated with pre-determined data fields, it may not always provide adequate information regarding specific incidents, tactics, techniques, and procedures that unauthorized users used to exploit software vulnerabilities. Given these limitations, Federal and private sector partners sometimes rely on other systems or participate in other DHS information sharing programs to obtain quality cyber threat data. Moreover, the unclassified and classified databases and repositories are not integrated, restricting analysts’ ability to compile complete situational awareness of potential threats. Finally, DHS should also enhance its outreach to increase participation and improve information sharing.

    We made five recommendations for the National Protection Programs Directorate to improve its information sharing capability. “DHS needs to ensure that cyber threat information sharing between federal and private partners is effective,” said Inspector General John Roth. “The improvements we are recommending today should increase participation and enhance DHS’ ability to analyze, coordinate, and share cyber threat information.”

    Topic
    DHS Agency
    Oversight Area
Subscribe to Cybersecurity

Would you like to take a brief survey regarding our site?