New cybersecurity team meets this week

The Office of Management and Budget has created a task force that this week will begin figuring out how agencies can share cybersecurity functions.The team of senior IT managers will look at training, incident response, disaster recovery, contingency planning and how agencies select security products.Clay Johnson III, OMB's deputy director for management, early this month sent a letter to deputy secretaries asking them to tap senior officials who possess strong security management skills to participate in the interagency task force.The March 23 kick-off meeting will start a six-month study. By September, the group must develop a business case for IT security functions that can be provided centrally by agencies or vendors.Over the past four years, agencies have been sluggish in improving their IT security.Congress' recently released fifth annual security report card gave the government a D for its security overall.And agencies are more than a year late in meeting the administration's goal of certifying and accrediting the security of 80 percent of their systems. This month, OMB noted in the latest Federal Information Management Security Act report that only 77 percent of all systems had been accredited.OMB wants the new cybersecurity task force to ferret out functions that, if shared or standardized, will mean quick and easy improvements across the government.Karen Evans, OMB's administrator for IT and e-government, said guidance from the task force's findings will be available to agencies for the fiscal 2007 budget cycle.'We are on a fast timeline,' Evans said at the Cybersecurity Conference sponsored by GCN this month in Washington. 'We have to capitalize on the work each agency is doing by sharing best practices and taking advantage of volume buys and common tools.'OMB will apply the line-of-business methodology it is using to create cross-government systems programs to support financial, grant and human resources services. But OMB officials said the end result likely will not be a centralized security provider.Each agency has its own security needs and risk profiles, and the study might not support the use of common providers for all IT security needs, Evans said. But she said there are likely enough common needs that she doubts that it makes good business sense for the 26 major agencies to go entirely their own way.Drew Ladner, former Treasury CIO and chief executive officer of Zuri Technology of Washington, said a cybersecurity line of business makes the most sense for some needs.'Decisions about services and technologies of IT security that are more mature and static, such as certification and accreditation support, can be centralized without yielding inferior outcomes, whereas less mature dimensions of IT security, such as many aspects of patch management and vulnerability assessments, are best left to decentralized decision-making,' he said.The Air Force's recent agreement with Microsoft Corp. for desktop PCs that are configured in a standard way and for patch management testing and implementation is an illustration of what a cybersecurity LOB could provide.'This is the best example of a business process that other agencies can take advantage of,' said Alan Paller, director of the SANS Institute of Bethesda, Md. 'Air Force can do one set of tests on a patch and blast it out because they have a common set of configurations.'OMB, the Air Force, Microsoft, the Homeland Security Department and others want to expand the Air Force program to all of government.DHS will not redistribute patches but make the four standard configurations available for other agencies to implement. This will let other agencies benefit from the testing the Air Force will conduct as part of its agreement with Microsoft.An OMB official said there will be no additional cost to agencies for software if they are using the same products as the Air Force.OMB, however, sees the Air Force and cybersecurity LOB initiatives as related but different efforts.'While they are complementary and intrinsically related, they are two separate initiatives,' said an OMB official who requested anonymity. 'The Microsoft agreement preceded the organization of the cybersecurity line of business effort, thus the configuration management initiative under the Microsoft agreement will inform the overall line of business analysis since it is a government best practice.'Paller said OMB's goal with the line of business should be to determine standard specifications for security functions such as vulnerability assessments, intrusion detection and firewalls.'If the inputs and outputs are standard, then the products are all compatible and an agency could manage its security from a dashboard,' Paller said.