Cyberattacks on agency networks on the rise

Government agencies saw a sharp rise over the past fiscal year in cyber incidents, which increased by 39 percent over 2009, according to an annual report by the Office of Management and Budget. Thirty-one percent of those incidents were malicious code attacks.

OMB’s annual report on implementation of the Federal Information Security Management Act of 2002 reported 41,776 federal incidents across 24 agencies in 2010, compared to 30,000 incidents in 2009.

“Malicious code through multiple means (e.g., phishing, virus, logic bomb) continues to be the most widely used attack approach,” the report states.

Related coverage:

U.S. not prepared for 'potentially devastating' cyberattacks, House panel told

White House cybersecurity report card falls a bit short

In addition to malicious code, nearly 14 percent involved unauthorized access, 18 percent improper usage and 27 percent are listed as under investigation/other. Eleven percent involved scans, probes and attempted access and 0.1 percent were denial-of-service attacks.

The U.S. Computer Emergency Readiness Team (US-CERT) compiled incidents from federal, state and local governments, commercial enterprises, U.S. citizens and foreign CERT teams. In 2010, the agency received a total 107,439 reports and 108,710 in 2009.  Approximately 53 percent of reported incidents in 2010 were phishing attacks. The breakdown on reports to US-CERT:

• Phishing:  56,579 incidents, 52.7 percent of incidents.
• Virus/Trojan/worm/logic bomb: 11,001, 10.2 percent.
• Malicious website: 7,971, 7.4 percent.
• Non-cyber: 7,741, 7.2 percent .
• Policy violation: 6,888, 6.4 percent.
• Equipment theft/loss: 5,395, 5 percent.
• Suspicious network activity: 3,121, 2.9 percent.
• Attempted access:  2,712, 2.5 percent.
• Social engineering: 1,571, 1.5 percent.

Although only 1.5 percent of total reported attacks involved social engineering, OMB’s report notes that these attacks were of particular concern, as exploit codes often become publicly available.

“There were repeated attacks on zero-day vulnerabilities (unknown vulnerabilities) through social engineering… These attacks typically require social engineering to trick users into visiting compromised websites hosting malware or opening a malicious attachment to execute the malware on a user’s system,” the report states.

Additionally, the report found federal compliance with information security guidelines to be poor.

“Only one agency received a compliance score of 100 percent for its information security program which, based on its IG's review, met all 62 attributes,” the report states. “The remaining agencies had at least one area that needed improvement. Three agencies did not have a cybersecurity program in place for one security area, and one agency did not have a program in place for two security areas.”

OMB used the areas of deficiency to calculate agencies’ scores. Six agencies scored above 90 percent compliance, eight scored between 65 and 90 percent, and the other nine scored less than 65 percent, according to the report.

The report also found that many agencies did not fully train their staffs in cybersecurity. Specialized cybersecurity training for agency users with significant security responsibilities averaged 88 percent; one agency provided only 2 percent of its users such training. For new employees, an average of 73 percent was given security awareness training prior to being granted network access. Two agencies trained none of their new employees, two trained between five and six percent of their employees and one trained about half of its incoming staff at 55 percent.

OMB’s report echoes earlier statements and reports about the state of cybersecurity in government. Gregory Wilshusen, GAO’s director of information security issues, recently told a House Homeland Security subcommittee that the United States is not prepared for “potentially devastating” cyber attacks.

Last month, Veterans Affairs Department’s CIO Roger Baker suggested improving security by centralizing IT management, stating that the government lags behind the private sector in this issue because of its IT organization. Baker spoke at a cybersecurity summit in Washington hosted by FedScoop. And in January the National Security Cyberspace Institute gave the Obama administration grades ranging from B to D for its cybersecurity policies.

Departments covered in the report included Agriculture, Commerce, Defense, Education, Health and Human Services, Homeland Security, Housing and Urban Development, Interior, Justice, Labor, State, Treasury, Transportation, Veterans Affairs, Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, National Science Foundation, Nuclear Regulatory Commission, Office of Personnel Management, Small Business Administration, Social Security Administration and the United States Agency for International Development.