Report: DHS has 'significant deficiency' in info security