Rent a cybercop

The information assurance group in the Education Department CIO's office had only a handful of employees two years ago, when it became clear that new federal IT security requirements would create a mountain of work.Education realized it would need help to meet the mandates of the Federal Information Security Management Act, CIO Bill Leidinger said. So the department hired ICS Corp. of Frederick, Md., to review its systems for security vulnerabilities.Several other agencies have taken similar steps, contracting out security functions to clear the bar raised by new requirements. Managed services contracts have become increasingly common for a variety of systems services, but only recently has the concept of managed security services begun to take hold, federal officials and industry analysts say.The FISMA mandate that requires agencies to inventory and certify the security of all systems created an immediate demand for IT security services.Agencies now regularly include information assurance as a service performed under larger IT services contracts, said Chris Campbell, a senior researcher with Input of Reston, Va.FISMA laid out specific requirements for systems security, but agencies lacked adequate IT security staffs and were faced with shrinking budgets.'We, like other agencies, have begun to focus on IT security over the last couple of years,' Leidinger said. 'Since we've just begun to focus on it, there's a lot of work to do in a relatively short period of time.'Although agencies have been reluctant to contract out all their security functions, he said, many have hired vendors to perform limited IT security services.Based on its audits, the Government Ac- countability Office 'doesn't see a widespread movement toward managed security services but continued use of contractors to perform certain IT security functions at some agencies,' said Gregory Wilshusen, acting director for information security issues at GAO. Such functions include monitoring, intrusion de-tection, training, vulnerability assessments and testing security controls.Deals for IT security services have taken many forms. Contractors may work in-house, side by side with federal employees, or at vendor centers, monitoring data from agency network sensors. Agencies may pursue separate contracts for services such as certification and accreditation, antivirus software, patch management and configuration management.But increasingly, agencies are grouping security tasks in large contracts, Campbell said.Agencies are picking different services from different vendors based on their needs, Leidinger said. 'I suspect there are IT contractors working in every department working in IT security,' he said. Each agency's systems, configurations, hardware and software arrangements, and production requirements will influence the selection of a security team, Leidinger said.Like other IT services that once were delivered through standalone contracts, integrators now incorporate security into large IT services contracts, then subcontract out the security functions. Most new systems have security built in, so when an integrator receives a large systems development contract, information assurance is part of the deal, Input's Campbell said.'IT security is getting lumped into larger overall contracts,' he said.Government gets better prices when a single vendor provides numerous services. In the past, agencies tended to award small contracts to several different vendors, but the wiser step is to hire a systems integrator to handle such tasks, Campbell said.For example, Symantec Corp. of Cupertino, Calif., signed an agreement this month with Raytheon Co. to offer its managed security services to Raytheon's customers, which include many government agencies, said Brian Finan, Symantec's director for homeland security and strategic programs.At the Veterans Affairs Department, contractors work on-site to help VA's Central Incident Response Center staff, said Pedro Cadenas Jr., deputy to the associate deputy assistant secretary for cyber- and information security. 'We don't make the demarcation between contractors and government employees, because contractors work for us,' he said.Typically, contractors bring expertise in forensics and help government employees get up to speed on analysis techniques and monitoring intrusion detection sensors, Cadenas said.On the flip side, the department's IT workers make sure the contract workers understand how the organization runs and what applications are in use, he said.But Cadenas rings a note of caution regarding agencies that rely too heavily on vendors for their security operations.'The agencies, in my opinion, that are going to get themselves into trouble are the ones that outsource all [IT security], and then when the money goes away or they take a hit, they have no fallback position,' he said.Agencies will continue to rely on contractors, Leidinger said. Many IT departments are building security staffs and developing greater expertise, but in many cases the focus is on managing security contractors.Vendors already populate many agencies' IT security staffs, sometimes outnumbering federal employees two to one, for example at Education. The ratio is near that at VA.Even after Education builds up its staff, it will continue to rely on contractors. 'We know that our IT needs are way beyond our staff capabilities, just in terms of hours in a day,' Leidinger said.