Fed CIO outlines security holes

Vivek Kundra, the nation's first federal Chief Information Officer, testified before Congress on Tuesday that the seven-year-old Federal Information Security Management Act (FISMA) was old and rusty.

Kundra said recent breaches, including at the Federal Aviation Administration and USAjobs.gov, demonstrate that much better work needs to be done to tighten security around government computers.

"The performance information currently collected under FISMA does not fully reflect the security posture of federal agencies," he said in prepared remarks. "The processes used to collect the information are cumbersome, labor-intensive, and take time away from meaningful analysis. The federal community is focused on compliance, not outcomes."

Kundra called for a rewrite of the law to make it deal more effectively with today's cyberthreats.

"We need metrics that give insight into agencies' security postures and possible vulnerabilities on an ongoing basis," Kundra said. "We will never achieve our security goals through compliance alone because security threats are fluid and constantly changing."

For more on the nation's first CIO:
- check out this govinfosecurity.com article