Recent survey results reveal that federal IT professionals grappled with more cyber-attacks in 2009 than they did in 2008, and that more than half of their agencies experienced a cyber-security incident at least weekly, but when one city chief information security officer (CISO) read that, he wasn't sure if the respondents were in agreement over what an "incident" actually is.

CDW-G surveyed 150 federal civilian and 150 federal defense IT respondents to gauge their experiences in the ever-changing cyber-security landscape and published the results on Nov. 10, 2009, in the 2009 CDW-G Federal Cybersecurity Report: Danger on the Front Lines. Twenty-three percent said their network faced cyber-security incidents at least weekly, and 31 percent said daily.

"When you tell me that the federal government says, ‘Hey, we have at least one incident per day,' these are guys that kind of moved up the ladder and probably don't have the kind of experience it takes to even understand what the word ‘incident' means," said Michael Hamilton, CISO for the Department of Information Technology in Seattle.

The incidents include external attacks, viruses, lost PDAs and inappropriate employee activity, but Hamilton was still left wondering.

"When I look at US-CERT [United States Computer Emergency Readiness Team] stuff, for example, I know exactly how that is measured, and an incident is somebody who visits a Web site that is booby-trapped and attacks the visitor and there's no anti-virus signature in place and the desktop becomes compromised. Does that happen at least once a day? That happens hundreds of times a day, in an organization of any reasonable size."

Numerous federal IT concerns were expressed in the report, including managing growing numbers of remote endpoints as mobile computing increases in the workplace and the need for more education for end-users on proper technology use. When criminals target governments, they look for the holes.

"What we found in this study is that, oftentimes, the internal vulnerabilities are one of the things that are opening the door to the external sources of cyber-attacks," said Andy Lausch, vice president of federal sales for CDW-G. "This isn't a new topic. I think what our study does is help to raise the consciousness of the discussion and highlight some things that maybe people weren't aware of, one being just the overall prevalence of attacks that are happening."

The data elucidates some interesting findings:

• When asked what top challenges they faced every each day, 33 percent said malware, 25 percent said inappropriate employee activity or network use, 25 percent said managing remote access, 23 percent said data encryption and 22 percent said end-user education
• 44 percent said they'd seen an employee post a password in a public place, like a sticky note
• 66 percent said that inappropriate downloading and Web surfing is the biggest internal threat, 50 percent said lost devices like laptops and PDAs and 40 percent said lost, shared or stolen passwords, and 
• 60 percent said their mobile computing security challenges had increased over the past 12 months.

"The whole passwords-on-sticky-notes, I haven't seen that since 1980. I don't know what kind of problem they're having with that, but generally that's not a problem we see ever," Hamilton said of his own IT department.

Even Lausch himself was surprised about the password findings.

"I think it's surprising to hear a federal government admit to doing that," he said. But he added that they, like employees anywhere, could slip up do to pressure over meeting work goals. "They're human like the rest of us. Those folks who do that are probably doing that in the name of productivity. They're trying to be quicker in performing their mission."