Feds Challenged on Key Infosec Initiatives

Gregory Wilshusen, GAO information security issues director, wouldn't reveal details of the audits, but said in an interview with GovInfoSecurity.com: "Agencies are trying, and they are making progress, but because of just the highly dynamic nature of the federal computing environment, it remains a big challenge."

The reports will disclose the extent in which each initiative has been implemented by the departments and agencies and any challenges and lessons learned executing both programs, Wilshusen said.

Senate Homeland Security and Governmental Affairs Chairman Joseph Lieberman, I.-Conn.; its ranking minority member, Susan Collins, R.-Maine; and Thomas Carper, D.-Del., who chairs a panel subcommittee and is sponsor of a bill to update the Federal Information Security Management Act, requested the GAO audits.

The Federal Desktop Core Configuration program, also known as FDCC, aims to assure that all federal computers running the Microsoft Windows operating systems are configured to meet minimal security standards. The goal of the Trusted Internet Connection initiative, commonly called TIC, is to reduce significantly the number of government connections to the Internet that should simplify the monitoring of malicious traffic.

At least one agency has had major problems implementing one of these initiative. An Interior Department inspector general's audit released last fall revealed that nearly one-third of the department's tested computers failed to comply with minimum FDCC standards as developed by the National Institute of Standards and Technology.

For more on TIC, check out our interview What's Happening with the Trusted Internet Connection with Matt Coose, director of federal network security at the Department of Homeland Security's National Cybersecurity Division.