Government IT security weak, needs updating: Auditor General’s report

The federal government’s IT security standards are out of date, with no firm plans to update them, according to the Auditor General of Canada. The federal government watchdog also believes the government does not have the proper information to assess the true status of its IT protection. In her most recent report to Parliament, auditor general Sheila Fraser lists several concerns about the approach taken by the government as a whole and specifically by four departments that she audited. One of the main problems was cyber incidents such as viruses and malicious codes. The federal government began examining a point of presence in six different departments for up to three months in 1999, with the goal of assessing the level of cyber threat to the Canadian Internet sites. "The test generated over 80,000 alarms," the report notes. "Further analysis of those alarms showed more than 500 attempts to penetrate departmental systems. Most of those attempts involved probes by potential attackers, many of them using automated tools." The current standards for IT security were established in 1994 and updated the following year. The RCMP set the technical security standard for IT in 1997, which serves as third-level requirements for government security policy. The auditor general remarks that those standards were developed before the Government On-Line initiative was created. "We asked to see the Secretariat’s plans and timetable for updating the 1995 and 1997 standards," the paper states. "At the end of our audit, the plans and timetable have yet to be completed. The plans for communicating and implementing the 2002 government security policy were still being developed as well." Fraser recommends that Treasury Board speed up the creation of basic requirements for IT security. The government agrees with that assessment and is vowing to follow up "within available resources." Reporting standards have been lax, the auditor general discovered. She wanted to look at the internal IT audit reports sent to Treasury Board in the last five years. Of the 90 departments and agencies that fall under the jurisdiction of the government security policy, only 10 had submitted documents. Only 14 departments and agencies have had the Mounties review their IT security practices in the last six years. A 1994 policy stated that the RCMP must submit a security report when asked by Treasury Board. The force did so in 1995; the secretariat has not requested another report since then. "The significance of these gaps goes beyond non-compliance with government policy," the auditor general avers. "In the absence of departmental internal audit reports and RCMP annual reports, the government did not have the information it needed to assess the overall state of IT security. Without that information, it was not positioned for effective monitoring and oversight of IT security across departments." The auditor general examined the IT security practices at Industry Canada, Human Resources Development Canada, Fisheries and Oceans, and the National Parole Board. Fraser discovered that HRDC has its own policies and standards for IT security, using the government security policy as its base. The other three agencies relied mostly on the government standard. Industry and Fisheries issue bulletins on specific IT issues, but only do so on an ad-hoc basis. "At Industry Canada we noted a new policy that came into effect in June 2001, making threat and risk assessments mandatory in all new systems development. However, few have been conducted so far," the report says. "As a large entity, HRDC has done many TRAs of changes to its systems." The auditor general also raised red flags over password protection. Passwords are not changed on a regular basis, or cancelled promptly when employees leave.

Government IT security weak, needs updating: Auditor General’s report

News | April 23, 2002

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us