The Register reports on a recent and pretty embarrassing Department of Homeland Security IT security audit:
The report also scolds DHS for continuing to use unsupported operating systems. DHS, the Coast Guard, and the Secret Service were all found to be using Windows Server 2003 after Microsoft’s July 2015 discontinuation of support.
The OIG also noted that Windows workstations at DHS, the Federal Emergency Management Agency (FEMA), and the Coast Guard were missing a variety of patches.
“Windows 2008 and 2012 operating systems were missing security patches for Oracle Java, an unsupported version of Internet Explorer, and a vulnerable version of Microsoft’s Sidebar and Gadgets applications,” the report says. “Some of the missing security patches dated back to July 2013.”
A number of Windows 8.1 and Windows 7 workstations were missing key security patches, including the WannaCry fix, various browser updates, and patches for Adobe Flash, Shockwave, and Acrobat flaws.
The report concludes that the observed deficiencies run contrary to the President’s Cybersecurity Executive Order and demonstrate the need for stronger security oversight.
Unfortunate yet likely these agencies rely on some legacy code requiring these extremely dated operating systems. Welcome to the wonderful world of government contracting, where there are a lot of custom built applications running in extremely insecure environments. The question: are these vulnerabilities an acceptable risk required to complete the mission?