Government Risk Management

Government departments and agencies face an ever-increasing amount of pressure to improve transparency in their processes. As part of this, risk management becomes a key point of focus for the public eye. In the face of an emerging threat or crisis, the public will seek verification that government departments took the necessary steps to reduce risk and promote business continuity. Despite the complexity of the risk management required, many must struggle to mitigate risk at a price their frugal employers are willing to pay for.

With privacy and security at the forefront of government challenges, what steps are being taken to mitigate risks? Today we’re looking at the top 5 risks in government and highlighting the importance of communicating risk appetite and tolerance across an organization.

Outdated Technology

First, aging IT systems are a major security risk the plagues the federal government. It’s simply understanding that old systems don’t have the capabilities to protect against threats that weren’t around when they were created. Technology is constantly advancing, and yet government technology is at a crawl, requiring a lot of resources to keep systems running. A 2016 report from the Government Accountability Office shows that 75% of the total IT budget was spent on operations and maintenance.

Not only is their use of outdated technology using up the majority of their resources, but it is also leaving them vulnerable to modern threats and attacks. Several servers used at homeland security, for example, reportedly used Windows Server 2003 for nearly 3 years after it was no longer supported.

In 2018, Hawaii residents received a false missile alert that gained a lot of media attention. While the missile crisis sparked some debate on whether it was truly an accident or not, the incident offered insight into the software. Initial reports claim the alert was sent on accident due to the aging technology not making a clear distinction between the real and practice alert. Reports also say the command’s operations center didn’t have access to the alert system during the event, resulting in a 38-minute period before another alert was released.

Cyber Security

Cyber security deserves its own category in every industry, let’s be honest. When discussing government risk in cyber security though, we have well-warranted cause of concern. Government agencies store a lot of valuable data, and a lot of it is about the public: driver’s license information, social security numbers, health care information, financial data, etc. It makes sense they would be a large target for today’s more sophisticated cyber attacks. Is the government prepared though?

In 2015, the Office of Personal Management announced two separate cybersecurity incidents, resulting in the loss of over 25 million individuals’ information such as social security numbers. Again in 2016, hackers breached a data retrieval tool at the IRS, allowing them to steal 30 million dollars and access the personal information of 100,000 students. Another incident occurs in 2018 when the Chinese government hacked Navy computers, stealing 614 gigabytes of sensitive information related to undersea warfare. These incidents are largely worrying, and a report by Netwrix shows that only 14% of government organizations consider themselves properly protected against cyber attacks.