ALEXANDRIA, Va.–A cybersecurity audit of NCUA has concluded the agency needs to enhance its account recertification process for privileged users and to strengthen its Security Information and Event Management (SIEM) tool processes.
According to Regulatory Report, which first reported the audit results, the cybersecurity audit for NCUA was performed by CliftonLarsonAllen LLP (CLA).
The aim of the performance audit, the firm wrote, was to assess the effectiveness of the NCUA’s firewalls and SEIM solution “to determine if they are designed and implemented to prevent and detect security threats to the NCUA network,” Regulatory Report stated.
The audit field work, it said, was conducted at the agency’s headquarters in Alexandria, Va., from Oct. 19, 2022, to March 16, 2023.
The Suggestions
Regulatory Report said the May 2 audit report specifically suggests NCUA:
- Needs to enhance the account recertification process for privileged users. “Accounts that have access to cybersecurity devices such as firewalls and the SIEM tool were not periodically recertified to determine whether accounts are still needed. The NCUA Information Security Procedural Manual requires the review of accounts for compliance with account management requirements at least quarterly.”
- Needs to strengthen its SIEM tool audit logging and collection, visibility, and retention processes. “Specifically, the NCUA needs to implement the following logging requirements specified in the Office of Management and Budget (OMB) Memorandum 21-31, Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents. That includes ingesting all required basic logging categories into its SIEM. The capacity for data storage for required minimum logging data retention periods.
Recommendations Implemented
According to Regulatory Report, the report further states these weaknesses are inconsistent with the Government Accountability Office (GAO) Standards for Internal Control in the Federal Government.
Four recommendations in all were provided; one has been implemented, and the other three are slated for completion by the end of 2024, the report states.
Feeling the FOMO Fever? CUToday.info Has a Prescription
Are you missing out on the latest news in credit unions? Missing the trends and developments you need to be aware of? We can help. Each morning CUToday.info delivers its daily Fresh Today news update offering the latest headlines and breaking news right to your email, with the easy-to-read headlines format allowing you to click on the stories that interest you most in order to learn more.
And it’s free!
If you haven’t yet signed up for the new email solution on which CUToday.info has partnered with ResponseGenius, you can do so here. Signing up requires less than one minute of your time—and it’s free!
Please note that after signing up you may need to go to your Spam/Junk folder and mark the morning headlines email as safe. CUToday.info does not provide its list of readers and emails to outside parties, and we will not be contacting you to sell you an extended warranty or sending you any links so you may cash in on an inheritance you didn’t know was coming.
And did we mention it’s free?
Please note and/or make your IT department or email administrator aware the emails will be coming from the domains CUTodayinfo.com and CUTodayinfoReply.com