According to a report from the Government Accountability Office released Thursday.
The GAO report analyzed the steps taken by several leading agencies, including the departments of health and human services, energy, homeland security, and transportation, to manage cybersecurity risks related to the use of IoT and OT devices in healthcare and public health, energy and transportation. sectors.
GAO defined IoT as “the technologies and devices that enable network connection and interaction of a wide range of ‘things'” and OT as “programmable systems or devices that interact with the physical environment “. The report notes that IoT and OT devices and systems are widely used in the three selected sectors to provide essential services, but are “inherently at risk” of compromise.
“These systems are highly complex, technologically diverse, and often geographically dispersed,” noted the GAO. “Furthermore, they are often interconnected with other internal and external systems and networks, including the Internet. This complexity increases the difficulty of identifying, managing and protecting the many operating systems, applications and devices that make up systems and networks.
Although the GAO noted that all of the select agencies it reviewed “reported various cybersecurity initiatives to help protect three critical infrastructure sectors with heavy use of IoT or OT devices and systems,” it did added that none of them “had developed measures to assess the effectiveness of their efforts” or “conducted IoT and OT cybersecurity risk assessments”.
“Both of these activities are best practices,” the report says. “Lead agency officials have noted the difficulty of assessing program effectiveness when relying on voluntary information from industry entities. Nevertheless, without attempts to measure the effectiveness and assess the risks of IoT and OT, the success of risk mitigation initiatives is unknown.
The report also pointed out that the IoT Cybersecurity Improvement Act of 2020 — which also included provisions requiring the GAO to review and report on agencies’ IOT and OT cybersecurity efforts — directed that the National Institute of Standards and Technology and the Office of Management and Budget “take specified steps to increase the cybersecurity of Internet of Things devices. Under the law, agencies are prohibited from “procuring or use an IoT device after December 4, 2022, if that device is found to be non-compliant with standards developed by NIST.”
The GAO noted that the law also requires the OMB “to establish a standardized process for federal agencies to lift the ban on the purchase or use of non-compliant IoT devices if the opt-out criteria detailed in the law are met. “. But the GAO found that as of November 22, the OMB “has not yet developed the mandatory process to lift the ban on the purchase or use of non-compliant IoT devices.”
“Given the law’s restrictions on agency use of non-compliant IoT devices beginning in December 2022, the lack of a uniform waiver process could lead to a series of inconsistent actions across agencies,” indicates the report.
The GAO made eight recommendations for the departments of health and human services, energy, homeland security, and transportation, including that agencies “include IoT and OT devices as part of risk assessments” and use the 2013 National Infrastructure Protection Plan as a guide to create “sector plans” until the updated national plan is released in “first quarter 2023”.
The GAO also made a separate recommendation that the OMB “promptly establish a standardized process for each covered agency’s chief information officer to follow in determining whether the IoT cybersecurity waiver can be granted,” as required by the IoT Cybersecurity Improvement Act.
The Department of Transportation and DHS agreed with the GAO’s recommendations, while HHS neither agreed nor disagreed with the reports’ recommendations, but “noted planned actions.” The Department of Energy said it would not respond to GAO’s recommendations “until further coordination with other agencies.”
The OMB told GAO that it is “aiming November 2022 for the release of guidance on the waiver process,” although the agency has yet to release guidance as of the report’s release.
#GAO #Agencies #conduct #cyber #risk #assessments #IoT #devices #critical #infrastructure #sectors