Government failing at information, computer security.

A Government Accountability Office (GAO) audit of 24 of the largest U.S. agencies found that only seven are in compliance with a law requiring them to certify and accredit their information systems' security.

Among the 24 agencies reviewed by GAO auditors, six reported that fewer than half of their information systems were accredited and certified. Two agencies, the Agriculture and Housing and Urban Development departments, have no accredited and certified systems. The Social Security Administration and the Nuclear Regulatory Commission, however, reported that 100 percent of their critical information systems are certified and accredited to operate. Officials at 18 of the agencies surveyed said they struggled to find funds to enact the mandatory certifications.

The review looked at agencies' certification and accreditation procedures to determine whether they provided consistent and comparable results. It also considered whether the certification procedures provide sufficient information for senior agency officials to understand the risks of operating those systems. The GAO reviewed yearend data reported to Office of Management and Budget (OMB) officials in fiscal years 2002 and 2003, in addition to quarterly data submitted to the agency in March.

GAO's analysis found inconsistencies in the way agencies report certification and accreditation data, which lessened the data's usefulness. Auditors further questioned the reliability and quality of the data. The audit report recommends that OMB officials amend their reporting guidelines to require agencies to submit additional information on the quality and consistency of their certification and accreditation data.

The U.S. government's computer security also needs improvement An internal report by the Department of Homeland Security's (DHS inspector general found that the DHS' efforts to battle computer network and Internet attacks by cyber criminals and hackers suffer from a lack of coordination. poor communication, and a failure to set priorities. The report said the National Cyber Security Division's shortcomings leave the country vulnerable to critical infrastructure failure due to cyber attacks, resulting in the widespread disruption of essential services, damage to the economy, and even public safety risks. The report recommends the division create a process for overseeing the efforts of federal, state, and local governments to better protect their systems.

According to a former cyber security chief, computer security issues within the agency are not given enough attention. Amit Yoran submitted his resignation in October after only one year as the government's cyber security director and expressed his frustration with this issue. Under Yoran, Homeland Security established an ambitious new cyber-alert system that sends e-mails to subscribers about major virus outbreaks and other Internet attacks as they occur, along with detailed instructions to help users protect themselves. The DHS also began mapping the government's universe of connected electronic devices, the first step toward systematically scanning them for weaknesses that could be exploited by hackers or foreign governments. Yoran was the third cyber security chief in the past two years.