DHS hacker and cyber-attack database is vulnerable to hackers and cyber-attacks, IG reports.

• Author: Ake, David
• Position: Homeland Security News

A Department of Homeland Security administered database where reports on cyber-intrusions, and potential network security vulnerabilities are collected, analyzed and pushed out to local and state governments is itself vulnerable to internal and external attack, the department's inspector general said in a report released in July.

The automated critical asset management system is a web-enabled database where information is "gathered, analyzed and used to prevent, deter, respond to, and mitigate cyber-risks, threats and incidents," the IG report stated.

During an investigation, the department watchdog found that security protocols were not being followed.

The information found in the reports collected in the database could be used to the advantage of hackers and cyberspies if they were able to gain access, the report suggested.

Local administrators who have access to the databases did not have up-to-date training simply because they were not aware that they needed it, the report said. Accounts that were not active, sometimes for periods of up to five years, were not deactivated. Requirements call for user accounts to be shut down if there is no activity after 45 days.

Eighty-three percent of users had at logged on to their accounts for more than 45 days, and three of...