US cyber security professionals lack confidence in FISMA

Only two-fifths of Federal cyber security professionals in the US are confident in their agency’s security policy.

MeriTalk, a public-private partnership that is focused on improving the outcomes of government IT, announced the results of its new report examining the state of cyber security at Federal agencies.

Entitled FISMA Fallout: The State of the Union, it looks at whether the Federal Information Security Management Act (FISMA) is helping or hindering agencies improve cyber security and protect data.

Interestingly it found Federal cyber security professionals lack confidence in it and do not believe their organisation’s current solutions are good enough.

The report, which NetApp also contributed towards, highlights how agencies face cyber threats from every angle. In the past 12 months alone, they defended against insider threats or leaks (64 per cent), non-state actors (60 per cent) and state-sponsored threats (48 per cent).

Attacks are now becoming more sophisticated and just one in five (22 per cent) professionals rate their agency’s cyber security solutions as sufficient and sustainable enough to cope.

FISMA is designed to help organisations in addressing these complex threats, but the study revealed it may in fact be doing more harm than good. Just 53 per cent of Federal cyber security professionals said FISMA has improved the security at their agency, while 86 per cent report its compliance increases costs.

On top of this, 28 per cent see FISMA as an encourager of compliance rather than risk identification and assessment, while a further 21 per cent believe it is insufficient in dealing with the modern cyber threat landscape.

Mark Weber, president of NetApp US public sector, said FISMA’s compliance model is not keeping up with the evolving security threats or demands.

“There is a shift in the industry from compliance to continuous monitoring, and a vast number of new technologies exist to support this change. Our Federal cyber professionals should be given the resources, regulation, and management support to take advantage of these technologies to help thwart cyber security attacks,” he added.

To improve security, Federal cyber security professionals are now looking beyond FISMA and recommend more focus on evaluating risk, additional budget and technology, and better accountability regarding end-user unauthorised disclosure.