Skip Links

Network World

  • Social Web 
  • Email 
  • Close

Report slams FBI network security

FBI network vulnerable to insider attacks, government watchdog group says
By Ellen Messmer , Network World , 05/24/2007

The Government Accountability Office, the federal government’s watchdog agency, Thursday released a report critical of the FBI’s internal network, asserting it lacks security controls adequate to thwart an insider attack.

In the report, titled “Information Security: FBI Needs to Address Weaknesses in Critical Network,” the authors -- Gregory Wilshusen, GAO’s director of information security issues, and Chief Technologist Keith Rhodes -- said the FBI lacks adequate network security controls.

The FBI “has an incomplete security plan,” the report concluded.

The bureau, which had the opportunity to review the GAO’s findings before publication, responded that it wasn’t arguing with some of the technical observations expressed in the GAO report, but disagreed that the FBI is open to unacceptable risk of an insider attack.

In a letter of response to the GAO, Dean Hall, the FBI’s deputy CIO, and Zalmal Azni, the FBI’s CIO, noted, “The FBI concurs with many of the GAO’s technical recommendations and the programmatic recommendation to continue the implementation of information security activities in order to fully establish a comprehensive Information Assurance Program.”

Hall and Azni defended the FBI’s risk-management posture, however, emphasizing, “The FBI does not agree that it’s placed sensitive information at an unacceptable risk for unauthorized disclosure, modification or insider threat.”

The GAO, however, stated in the report that an evaluation of the effectiveness of the FBI’s security controls over routers, switches, servers, network management, firewalls and other IT infrastructure at FBI headquarters, revealed the FBI “did not consistently configure network devices and services to prevent unauthorized insider access.”

Among its other findings, the GAO said the FBI did not adequately “identify and authenticate users to prevent unauthorized access.” The GAO report also criticized FBI network security in other regards, saying that there was a lack of encryption to protect sensitive data and patch management wasn’t being done in a timely manner.

The GAO’s analysis of the FBI internal network had been requested by Rep. James Sensenbrenner, chair of the Judiciary Committee in the U.S. House of Representatives.

Partner Content

Brilliantly simple security and control solutions for email, web and endpoint

www.sophos.com

Stopping data leakage

Learn how to exploit your current security investment to control the information that flows into, through and out of your network.

Download the white paper.

Why detection rates aren't enough

Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.

Download the white paper.

Applications: taking back control

Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.

Learn more today.

Comments (4)
Login
Forgot your account info?

Laughable LaughableBy Dan Philpott on May 25, 2007, 10:18 amOne can protect against the insider threat with network security. The greater proportion of all network security threats are due to internal threats, not external....

Reply | Read entire comment

Does it not say "network" security?By Rob Lewis on May 25, 2007, 8:53 amLaughable. One can not protect against the insider threat with network security. It is edge security with the goal of keeping unauthorized users out. There is...

Reply | Read entire comment

Didn't they just cut IABy Anonymous on May 25, 2007, 8:24 amDidn't they just cut IA funding too? yikes!

Reply | Read entire comment

Something's wrong when the FBI can't secure its own networkBy Anonymous on May 25, 2007, 7:51 amMy first thought on the story is, who is administrator of their network? Re: Report slams FBI network security. Nevermind that they're the FBI, any company...

Reply | Read entire comment

View all comments

Add comment
Anonymous comments subject to approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.

Videos

rssRss Feed

Whitepapers

Magic Quadrant for Application Delivery Controllers

Gartner summarizes its view on Application Delivery Controllers, evaluates strengths and weaknesses...

Vulnerability Management For Dummies

Download this concise book "Vulnerability Management for Dummies," to learn about the simple steps...

The ROI and TCO Benefits of Data Deduplication for Data Protection in the Enterprise

This paper examines and quantifies the costs and benefits of backup with deduplication storage as...

Webcasts

Transforming the Enterprise WAN Edge: Video from Cisco

Life on the edge of your WAN has changed dramatically. With the need to deliver advanced services,...

PoE Plus: Impact on the PoE Market

The standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...

Harnessing the power of communications to increase workplace performance

Due to the convergence of IT and telecommunications technologies, the business workplace has been...

Special Reports

The Evolution of Network Security

We have so many holes punched in our firewalls today that many industry insiders question the value...

The self-managed network

We aren't there yet, but advances in network and systems management tools are making it possible to...

Get instant email notification when white papers, webcasts, executive guides are added to our library. Stay informed and up-to-date with the latest on IT Technologies with Network World's Resource Alerts.