Project SONAR, an initiative by the Department of Information and Communications Technology (DICT) , identified 30,682 vulnerabilities in over 2,000 online assets, highlighting significant security risks. The congressional hearing is focused on understanding the extent of cybersecurity gaps and improving security protocols and funding.
Only around one out of ten government offices that were recently notified by the Department of Information and Communications Technology (DICT) of a vulnerability in their cyber systems took action to protect themselves.
Just 55 out of 388 government agencies which were contacted about vulnerabilities in their public assets (data or devices part of a computer system) responded to the DICT, Dy told a House panel probing the series of hacking incidents on government websites.
These agencies include national government agencies and sub-agencies and smaller government offices housed under different agencies.
“This is very low compared to what we expect,” DICT Undersecretary Jeffrey Ian Dy said.
Dy said that the DICT’s network scanning initiative called Project SONAR has detected over 30,000 vulnerabilities after scanning the assets of over 800 agencies since being launched in December 2023.
Vulnerabilities do not refer to actual hacking attempts and instead point to certain parts of a government’s cybersecurity infrastructure that are at risk of being breached.
The DICT official explained that Project SONAR scans the systems of agencies without permission and informs them the next day of the extent of their vulnerabilities.
“So that if they need to procure something to defend themselves, that can happen,” Dy said.
Most agencies notified of having vulnerabilities did not respond to the DICT.
Dy said that there needs to be assigned focal persons who will respond to the DICT when informed about weaknesses in their cybersystems.
The DICT official also said that it has suggested for the Department of Budget and Management to include agencies’ responses as part of their scorecard — a system that measures agencies’ quality of good governance.
