Government auditors told a Congressional committee last week that computer security at the Department of Homeland Security still needs improvement, even after years of work to remedy the problems.

The Government Accountability Office reported (PDF) June 20 that while DHS had taken significant steps to improve its computer security since a 2005 investigation, the department still had “significant weaknesses” raising the risk that individuals could gain unauthorized access to sensitive data or disrupt operations.

During the hearing, House Homeland Security Subcommittee on Emerging Threats, Cybersecurity and Science and Technology members took DHS chief information officer Scott Charbo to task about the dismal state of computer security at the department, saying he had “underinvest[ed] in IT security” and questioning whether he should keep his job.

“[I]nformation provided by DHS suggests that the CIO is failing to engage in defensive best practices that would limit penetrations into DHS networks,” said Rep. Jim Langevin (D-R.I.), subcommittee chairman. “The department’s failure to implement the Einstein program, contracts with Sprint and MCI where the carrier has misconfigured the firewall, and other problems are quite disturbing.”

“It was a shock and a disappointment to learn that the Department of Homeland Security . . . has suffered so many significant security incidents on its networks,” the congressman said. “DHS reported to the committee that it experienced 844 cybersecurity incidents in fiscal 2005 and 2006.”

Langevin pointed out these included workstations infected with Trojans and viruses, a workstation infected with a Trojan scanning for port 137, which demonstrates that “individuals attempting to scan DHS systems through the Internet,” and PCs containing suspicious beaconing activity and a botnet that lets a hacker control the compromised computer. — Government Computer News

Keith Rhodes, chief technologist at the Government Accountability Office, also performed penetration testing of DHS networks. The results were surprising, not because there were problems found, but because of how many problems he found.

“I would label them [DHS] as being at high risk,” Rhodes toldInformationWeek the day after a congressional hearing into the security of the government agency tasked with being the leader of the nation’s cybersecurity. “There was no system we tested that didn’t have problems. There was nothing we touched that didn’t have weaknesses, ranging from WAN to desktops. . . . If we had continued the audit we would have found more. We curtailed the audit because we just kept finding problems. At a certain point, we just ran out of room in our basket.” — InformationWeek

And why, exactly, is computer security so important? You may not have very much of importance on your computer, but DHS certainly does.

“Terrorists or nation states could be hacking Department of Homeland Security databases, changing or altering their names to allow them access to this country, and we wouldn’t even know they were doing it,” Langevin said.

And more bad news is coming down the pike. GAO is preparing to release a report on the US-VISIT program, which maintains a biometric database of foreign visitors to the U.S., which will say that computer security problems are so severe they prevent the government from even knowing whether the system has been penetrated, and that the problems could have been easily fixed.

“I did not see controls in place that would prevent (hacking), I did not see defensive perimeters, and I did not see detections systems in place that would let you know whether it had or had not” been hacked, Rhodes told the committee. — CNET News.com

Do you feel safer now?