Agency infosec weaknesses threaten federal data

Released Friday, the report lists a variety of infosec problems at federal agencies, including: access controls not effectively implemented, software change controls not always in place, and segregation of duties not consistently implemented.

"These weaknesses exist primarily because agencies have not fully implemented strong information security management programs. These weaknesses put federal operations and assets at risk of fraud, misuse, and destruction," GAO analysts said.

Overall, the report concluded that the government is making progress in implementing the Federal Information Security Management Act (FISMA), but recommended that the Office of Management and Budget (OMB) improve its annual FISMA reporting guidelines.

While OMB agreed that agencies need to make infosec improvements, the agency objected to the report's criticism of its FISMA reporting guidelines.

www.gao.gov