Security incidents at US federal agencies declined last year
The White House has revealed that that the number of cybersecurity incidents recorded at US federal agencies went down by eight percent last year in a new report filed with Congress.
The White House’s Office of Management and Budget (OMB) compiled the report which contained data regarding the types of security incidents that took place at government agencies in 2019. The Federal Information Security Modernization Act (FISMA) of 2002 requires that all federal agencies report cybersecurity incidents to the OMB.
This year’s FISMA report shows that US federal agencies suffered 28,581 security incidents last year, though that number decreased by 8 percent when compared to the 31,107 incidents that were reported in 2018.
Last year US federal agencies experienced fewer incidents as a result of successful phishing attacks, website and web app compromises and loss of devices. These three categories accounted for a large amount of all of the incidents reported during the previous year.
Security incidents
While the number of certain types of security incidents at US federal agencies decreased, the latest FISMA report revealed that brute-force attacks, attacks executed with USB drives, external hard drives and other removable media and incidents caused by the improper use of a federal agency services or device are on the rise.
According to the White House, the vast majority of incidents did not involve user data and as a result, did not need to be publicly disclosed. At the same time though, three major incidents did occur last year.
In January the Federal Emergency Management Agency (FEMA) accidentally shared the personal data of almost 895,000 disaster survivors with a third party Texas volunteer organization, in June a ransomware attack impacted a license plate reader contractor working with the US customs and Border Protection (CBP) agency and in December FEMA’s National Emergency Management Information System Information Assurance (NEMIS-IA) system shared data about disaster victims looking for temporary shelter with a third-party contractor.
The FISMA 2019 report also revealed that the US Federal Government “continues to face challenges mitigating basic security vulnerabilities”. These vulnerabilities include agencies being vulnerable to basic spear-phishing attacks, poor patch management, reuse of admin passwords, insecure defaults and polices that allowed for weak passwords to be used.
Overall though, US federal agencies improved their cybersecurity posture and practices last year but there is still room for further improvement in 2020.
Via ZDNet