The top US agency for consumer financial protection is not adequately protecting databases holding large volumes of sensitive consumer and business information, potentially exposing them to hackers or theft, a federal watchdog audit concluded on October 28. The Consumer Financial Protection Bureau’s information security program was rated “not effective,” according to the Federal Reserve-CFPB Inspector General’s office.
CFPB (Credits: Insurance Journal)
CFPB Information Security Audit: What the Watchdog Found
The audit found the CFPB failed to inventory several actively used datasets, potentially leaving them vulnerable. It also failed to remedy “critical and high-severity” vulnerabilities within the required 30-day window, and operated with outdated or insufficient policies on cybersecurity risk and impact analyses.
The findings follow a separate IG report last month saying the agency could not vouch for the security of computer hardware in its former regional offices, which the Trump administration shuttered last year. The audit caps nearly two years of upheaval at the agency, which the administration initially moved to abolish — closing offices, halting work, canceling contracts and seeking mass staff cuts.
CFPB Response: No Major Breach, Fixes Underway
In a written response, CFPB chief information officer Christopher Chilbert said the agency accepted the recommendations and had made “substantial progress” after the audit period. He noted the CFPB had no major security incidents or breaches involving individuals’ personal information in the government’s last fiscal year, and said the bureau “has already done the work of addressing most of the recommendations.” CFPB representatives did not respond to a request for comment on Wednesday.
Also Read: Ethereum Clients Patch Flaw That Could Have Let Attackers Redirect ETH Rewards
Source: Insurance Journal — read the full story there.
