Audit Report: DHS Should Improve Information Security Monitoring Implementation

The Cybersecurity and Infrastructure Security Agency’s Continuous Diagnostics and Mitigation program has not improved the cybersecurity posture of its parent organization, according to a report from the Department of Homeland Security’s Office of the Inspector General.

CDM is an information security continuous monitoring program designed to help organizations maintain awareness of information security risks, vulnerabilities and threats.

While CDM has enhanced the cybersecurity of some federal government agencies, DHS can do more to take full advantage of the continuous monitoring solution, OIG said in its June 1 report.

The auditor reported that DHS does not have the processing capacity needed to handle the asset management data on its CDM dashboard.

Until the requirement is met, the dashboard cannot fulfill its role of managing and prioritizing cybersecurity threats across the department’s components.

OIG said it also found vulnerabilities on the department’s CDM servers and databases that endanger the integrity, confidentiality and availability of data.

The inspector general recommended that DHS address the weaknesses by clearly defining patch management responsibilities and implementing the required configuration settings. DHS has agreed with all recommendations.

CISA began building the CDM program in 2013 based on guidance from the Office of Management and Budget, which identified cybersecurity as a top cross-agency priority.

According to CISA, the program’s goal is to reduce an organization’s attack surface, increase cyber visibility, improve cyber threat response capabilities and streamline reporting under the Federal Information Security Modernization Act of 2014.

DHS is currently using a capability-driven approach to implementing the CDM program to allow its components to use existing data collection tools.

OIG said the department has dropped its previous “One DHS” approach, which restricted component agencies to a standard set of common tools.