"The FCC recently obtained $10 million to upgrade what was fairly awful network security. The result? As Ars Technica notes, an audit of the FCC's effort by the GAO (pdf) found that the $10 million set aside for an "Enhanced Secured Network" was essentially just thrown into a giant black hole. Systems were misconfigured and glaring holes weren't fixed, and the agency's CIO left in January for other work. The news is probably very comforting to those consumers who allow the FCC to collect network data activity from customized third-party routers (though that data is supposed to be anonymous)."
quote:... Contracts to do the work on ESN were awarded in April of 2012, just two months after plans for the project were submitted to Congress. By June, all of the security hardware and software licenses had been purchased. Implementation was in full swing.
But apparently the work was done so quickly that no one bothered to check it. While new security hardware and software was deployed, the GAO found that "FCC did not effectively implement or securely configure key security tools and devices to protect these users and its information against cyber attacks… Certain boundary protection controls were configured in a manner that limited the effectiveness of network monitoring controls."
The rush to get things in place also led to some other sloppy work. The GAO's auditors found that passwords to gain access to some of the network monitoring systems "were not always strongly encrypted." And while tools had been put in place to detect malware and block malicious network traffic, the tools had been left only partially configured. ...
Contractor-provided checking and configuring were probably a part of the next-higher bidder's quote.
You mean a quote or 2 was sourced, 1 got lucky, but the choice to pick that contract on standards had nothing to do with it. Part of the money also became redirected. Hence a job was done, someone was paid, but logistically not 1 decision was made. It never is about the needs, it's about power and authority - it always takes precedence, so a choice is made and no one says a thing till it's too late.
