Security's part of big picture

For agencies, the enterprise defines most IT objectives--including systems security."You need to have an agencywide perspective on a lot of things associated with overall enterprise architecture," said French Caldwell, vice president and research director for Gartner Inc. of Stamford, Conn., and a former program analyst in the Office of the Secretary of the Navy.The Government Information Security Reform Act of 2001 requires agencies to incorporate security into the lifecycle of systems. Agencies also must include security strategies for implementing agencywide programs in their annual performance plans.A lot of the government's focus lately has been on the proposed Homeland Security Department and the agencies, divisions and bureaus that would come under its umbrella. But every agency has to address systems security, and most are taking an enterprisewide approach to it.Take the Health and Human Services Department, one of the government's largest agencies with 12 separate bureaus and divisions.After putting the finishing touches on its enterprise IT strategic plan a year ago, HHS created a departmentwide program management position for security and named Jim Seligman, CIO at the Centers for Disease Control and Prevention in Atlanta, to the post.Seligman said his job as security program manager is to execute the department's strategic plan, defining what initiatives should be undertaken, evaluating them and developing business cases, obtaining funding and coordinating deployment.That's not so simple in a large agency where divisions and bureaus have their own security priorities, programs and funding streams.But "there are things that are commonly shared across the entire department," Seligman said.One common denominator is risk. With that in mind, HHS has commissioned a departmentwide risk assessment."We want to know what common risks we all face, what is the likelihood of those risks being realized and how serious would the impact be," Seligman said. "That helps to establish a framework for what we do next.""An obvious risk we all face is the introduction of malicious code," he noted.Thus, another initiative launched this year was to make sure that all HHS agencies have multitier virus prevention programs in place."That means having virus prevention software at the Simple Mail Transfer Protocol gateway, on e-mail server platforms and on individual desktops so that we have three layers of protection," Seligman said.HHS also has issued a request for proposals for a managed security services contract. Seligman hopes to award a contract in several weeks and have a system in place in about three months."We want a managed security service provider to be watching our perimeter and in some cases our interior with intrusion detection sensors on a real-time basis around the clock, and to be alerting us to abnormal incidences that they may see," he said.Another recent enterprise initiative was to go departmentwide with a cyberthreat intelligence service from iDefense Inc. of Chantilly, Va.Seligman piloted the service at CDC about two years ago before awarding iDefense a contract for all of CDC.The service, called iAlert, gives subscribers daily, in-depth intelligence reports on threats such as viruses, worms and hackers so organizations have the data they need to combat them. Citing a recent experience, Seligman said CDC received an iAlert warning about malicious software in the wild with a .CPL file extension."We put an absolute blanket prohibition on having an attachment come in through e-mail with that file extension on it in advance of noticing any of it at the agency," he said. "That's an example of where [iDefense's] intelligence alerts helped us out before we ever experienced any negative outcomes."HHS's one-year contract with iDefense is worth about $140,000, said Brian Kelly, chief executive officer of company.Analysts at iDefense generate 15 to 20 intelligence reports a day, said Kelly, a former Defense Department intelligence specialist.Users can customize their intelligence feed, which is delivered by e-mail."Some people are very technical and want technical vulnerability information on particular operating systems or applications," Kelly said, adding, "So it's conceivable that we could have 100 users in any one organization and no two receiving the same daily intelligence report."At CDC, it's especially critical that systems be up and running and protected from threats in the aftermath of the Sept. 11 terrorist attacks."We're the lead agency as it relates to bioterrorism preparedness and response," Seligman said. "Our ability to detect, prevent and respond is very IT-dependent--not solely, but IT enables virtually everything we do."Seligman is of one of about 10 CDC officials, mostly key IT security specialists, who receive daily reports from iDefense.Combining the service with advisories from other sources, such as the Federal Computer Incident Response Center and antivirus vendors, "has greatly enhanced our capacity to react more quickly to some adverse event," he said.The utility of taking the iDefense service to all HHS agencies demonstrates that enterprisewide security efforts might involve much more than purely technical responses.It's strategic."Cybersecurity is more of a strategic problem than it is a technical one," Gartner's Caldwell said. "One of the challenges is to get beyond the technical aspects of security and look at it from the standpoint of the agency as a whole."Security may require improved knowledge sharing between various parts of an agency." At HHS, it's part of the plan."Everybody's getting the message that we need to stand up a more comprehensive, viable, real-time and robust information security posture in the federal government," Seligman said.