Two reports released by the Department of Homeland Security Office of the Inspector General shows that the Secret Service has numerous vulnerabilities in its main database system which leave it open to potential misuse or attack, and a third report shows that Customs and Border Protection systems also are vulnerable.

The IG’s audit found inadequacies in the security controls for sensitive data about protective operations contained in the Secret Service Web System (SSWeb).

A redacted copy of the audit is available on the IG’s Web site.

Vulnerabilities were discovered in access controls, configuration management procedures and continuity-of-operations safeguards, the report said. In some cases, default passwords were not changed at the time new software was installed.

“Due to these database security exposures, there is an increased risk that unauthorized individuals could gain access to critical Secret Service database resources and compromise the confidentiality, integrity and availability of sensitive SSWeb data,” the report said. “Further[more], the Secret Service may not be able to recover SSWeb following a disaster.” Skinner recommended that the Secret Service ensure adequate controls for user access, review systems to facilitate the detection of inappropriate access, complete a configuration management plan and develop an IT contingency plan.

The Secret Service generally agreed with the findings.

In a second report, the IG examined the Secret Service’s security controls for selected wire-based, sensitive but unclassified networks and judged them to be ineffective.

“The Secret Service has not developed adequate policies and procedures or fully implemented processes that address security testing, monitoring network activities with audit trails and configuration and patch management,” according to this second report.

As a result, there is increased risk for unauthorized access to the service’s sensitive resources and data, the IG wrote.

In a third report released today, the IG reviewed Customs and Border Protection agency policies and procedures to secure its networks and concluded that they were inadequate with respect to security testing, monitoring network activities with audit trails and patch management. In addition, controls are lacking “to ensure that data residing on and traveling through its network resources is properly protected,” the report said. — Government Computer News

Some things deserving of attention, but not highlighted in the GCN report: The Secret Service doesn’t have sufficient manpower to review audit trails, which could help identify malicious or unauthorized accesses. It intends to implement automated reviews of the audit trails. One of the IG’s recommendations was redacted in its entirety, but appears to has something to do with controlling access based on classification (e.g. secret, top secret, sensitive compartmented). The Secret Service response said it did not have the resources to implement this recommendation.

Government computer security, and government IT usage in general, has sucked for as long as the government has had computers. In the last few months, I let you know about problems with FEMA’s computer systems, a Customs and Border Protection computer snafu, the unsearchable Transportation Security Administration database, the occasionally missing in action Homeland Security web site, breaches of security at the Internal Revenue Service, and government computer security overall sucking. And I’ve barely been able to scratch the surface.