The departments of Agriculture, Health and Human Services, Homeland Security and Transportation all failed to tackle vulnerabilities identified over a decade earlier, for instance. The Social Security Administration's weak spots risked exposing the data of 60 million Americans. Several agencies didn't install patches properly for most or all of the past ten years. And the Education Department hasn't had a way to keep unauthorized devices off its network since 2011 -- it can limit access to 90 seconds, but that's more than enough time to insert malware or grab sensitive documents. Just what happens next isn't certain. A source speaking to The Hill said the subcommittee didn't plan to hold hearings, but that Chairman Rob Portman would consider the findings when drafting any "legislative solutions." It might get fixed some day. Recommendations in the report would give chief information officers more power over security decisions, improve communication with agency leaders and require progress reports on fixing security flaws when defending a given department's budget. These aren't binding, though, and there's no concrete mechanism in place to implement those changes. If there's any consolation, it's that the current administration wants to invest more in cybersecurity. There's a chance some of that money will go toward shoring up defenses. It's not likely to be a comprehensive fix, mind you. That suggests at least some of the shortcomings are likely to persist for a while.
Several US federal departments, including State, Homeland Security and the Social Security Administration, have failed to protect personal data or install security patches quickly enough to close vulnerabilities, according to a Senate subcommittee report. Some departments have failed to deal with security flaws discovered a decade earlier. The report by the Senate Permanent Subcommittee on Investigations found that in some cases, agencies were not even aware of vulnerabilities until they had been publicly disclosed. CIOs would also have to report on progress in fixing security vulnerabilities once they have been discovered.