For the second year in a row, the U.S. Department of Energy continues to have serious network security issues and is a regular victim of cyber attackers, according to an inspector general report.
The Department of Energy suffered from multiple cyber-attacks in the past year, costing the federal government over $2 million to recover, according to a recent audit report.
An annual review of the Department of Energy’s unclassified networks revealed security issues, including weak access controls, improper patching strategy and poor employee training, according to a report from the department’s inspector general Gregory Friedman.
Tests at 25 DOE facilities, including its headquarters, revealed 32 previously unidentified vulnerabilities, according to the report.
The audit also found security problems had increased by 60 percent in 2011 on DOE computer networks, compared with the number found during the 2010 audit. DOE addressed only 11 out of the 35 issues identified in the 2010 report, the report found.
Department computer networks are “routinely threatened with sophisticated cyber attacks,” the report said. In fact, cyber attacks on federal agencies increased by 40 percent since last year, the report found. The report covered the 2011 fiscal year, which ended Sept. 30.
The exploitation of vulnerabilities causes “significant disruption” to operations and increases the risk of data modification or destruction, Friedman wrote in the report.
The report also looked at “recent successful attacks at four department locations” and estimated recovery efforts cost the department over $2 million at three of the sites. Due to security concerns, Friedman did not identify the four locations or the kind of vulnerabilities exploited in those attacks. He also did not identify the attackers.
Some of the problems were the result of management failing to continuously monitor the security protections in place, the report found. For example, the agency neglected to block unauthorized users from accessing data or to perform validation procedures on at least 32 Web applications used in procurement programs and other support functions.
“Additional action” will help address threats, he said. The department needs to develop a series of procedures to secure and monitor various networks and systems, Friedman said.
“Continued vigilance is necessary due to the recent department incidents and increased cyber-attacks by both domestic and international sources,” Friedman wrote in the report.