Despite repeated high-profile breaches, federal government continues to struggle with its job of keeping personal data and public infrastructure safe.

According to The State of Cybersecurity from the Federal Cyber Executive Perspective report by KPMG and the International Information Systems Security Certification Consortium, 59 percent of federal workers say their agencies struggle to understand how cyber attackers could potentially breach their systems, while 40 percent said they were unaware where their key assets were located. About 65 percent said the federal government as a whole cannot detect ongoing cyber attacks.

Last year’s Office of Personnel Management (OPM) data breach that aired the personal information of at least 22.1 million people led to an effort OPM called a “Cybersecurity Sprint,” a 30-day effort to rectify the shortcomings that allowed the breach to happen in the first place. Despite that effort and the fallout from the breach itself, more than half of survey respondents disagreed that the “sprint” initiative improved security overall. A quarter of respondents said their agencies did nothing to respond to the OPM breach.

This is a frustrating time for chief information security officers, Hubbard said, because it’s often not made clear who is accountable when something goes wrong. And if someone will be held accountable, he said they may not be given the resources needed to do their job properly. What’s worse, government organizations as a whole do not fulfill their responsibilities to prevent security incidents. 

Many within government do not even acknowledge the importance of cybersecurity.

Of the IT personnel surveyed, only 8 percent said cybersecurity was unimportant or very unimportant. But in human resources, that number was 39 percent; in purchasing and procurement that number was 41 percent; and in communications and public relations it was 48 percent. When a half to one-third of an organization will not even acknowledge a problem that everyone is responsible for, how will government ever be able to solve this problem?, Hubbard asked.

Possible solutions, the report said, include increased training within government, increased cybersecurity training at the university level to catch people before they enter the workforce, and a new incoming federal CISO who can empower and hold the right people accountable. The report concludes by saying that the fight against cyberthreats is not a sprint, but an everlasting marathon.