Cyber sprint increases use of two-factor authentication

As part of that realization, the Office of Management and Budget called for a 30-day cybersecurity sprint, mandating each agency meet a set of baseline requirements. That sprint wrapped up Sunday and preliminary results look positive, according to Federal CIO Tony Scott.

More: Feds on '30-day sprint' to better cybersecurity

"It focused on a number of different activities but primarily on a couple of areas: increasing the level of two-factor authentication for privileged system users, patching critical vulnerabilities and widely disseminating the indicators of compromise," Scott said.

That first area — a lack of two-factor authentication — is one of the main reasons perpetrators were able to get usable information out of OPM's systems using basic credentials stolen from third party contractors at KeyPoint Government Solutions.

Days before the sprint wrapped up, Scott said agencies were already reporting progress on these priority initiatives.

OPM Data Breach: What You Need to Know

"We've dramatically increased the amount of two-factor authentication," he said during a call with reporters July 9. "A number of agencies have hit 100 percent and broadly across the government we've hit 20 percent."

The 2014 FISMA audit — issued in February 2015 — which analyzed the security posture of the entire federal government, showed that more than 5 million government users could access unprivileged accounts using just a username and password.

"While the substantial number of unprivileged user accounts … that are able to log on to federal networks with only a user ID and password is concerning, a potentially more serious issue is the number of privileged network accounts that are able to log on with only a user ID and password," the report reads. "Privileged user accounts … possess elevated levels of access to or control of federal systems and information, significantly increasing the risk to government resources if their credentials are compromised."

More: FISMA report shows feds weak on user authentication

More than 134,000 users could access privileged accounts with the same low-level authentication, with 18 major agencies allowing privileged user access without two-factor authentication prior to the sprint.

Scott said agencies and area-specific working groups will be reporting the full results of the sprint to OMB over the next few weeks.

"This is important work across all the agencies of the federal government to make sure that we greatly enhance the cybersecurity profile of the government as a whole," he said.

In Other News

Impact of massive health care cyberattack on vets remains unclear

A massive cyberattack against a private health care firm in February may have exposed millions of veterans' personal medical records.

Danti search engine answers Space Force location questions with images

The tool draws from public government databases and is versed in geospatial, signals and open-source intelligence, and is already in operation.

Former election official fined for obtaining fake military ballots

A former Milwaukee election official convicted of misconduct in office and fraud for obtaining fake absentee ballots was sentenced this week.

Ask Reg: Is military or federal pension more beneficial in retirement?

Reg breaks down how to weigh your military and federal pension in retirement.

Ask Reg: Once I sign up for Medicare, does that supersede my FEHB plan?

Reg answers questions about Medicare integration with FEHB plans.

Load More