40% of U.S. Government Web Sites Fail Security Test

Two recent studies have shown that around 40% of federal government agencies are out of compliance with a regulation that requires them to deploy an extra layer of authentication on their Web sites to prevent hacker attacks. Two years ago federal agencies were required to support DNS Security Extensions (DNSSEC) on their Web sites.

DNSSEC solves what's called the Kaminsky vulnerability, a fundamental flaw in the DNS that was disclosed in 2008. This flaw makes it possible for hackers to launch cache poisoning attacks, where traffic is redirected from a legitimate Web site to a fake one without the Web site operator or end user knowing.

"I don't know whether it's inattention by the government, or the government generally believes that it has enough other security measures in effect that this is not going to cause a problem," says Ray Bjorklund, Chief Knowledge Officer at Deltek, a federal IT market research firm.Bjorklund. "But federal CIOs need to understand that government sites can be hijacked. If agencies aren't paying attention to this, they should."

Read more -here-

• Dropbox breach exposes customer credentials, authentication data
• Google: Passkey authentications top 1 billion across 400 million accounts
• FTC fines Razer for misrepresenting COVID masks as N95s
• FCC fines Verizon, AT&T other major carriers nearly $200 million for sharing customer data
• Federal regulators accuse Amazon executives of deleting messages
• FCC restores net neutrality rules