Cyber Eye: FISMA or not, better security appears imminent
Connecting state and local government leaders
There is evidence that agencies are making progress in their struggle to secure federal IT systems.
There is evidence that agencies are making progress in their struggle to secure federal IT systems.Forget the congressional report cards. They are too coarse-grained to give an accurate picture of the status of cybersecurity. But a recent survey of federal information security officers shows an increase in the amount of time devoted to IT architecture development and a decrease in time spent on inventory control and systems administration. And although CISOs said they are spending more time on compliance reporting, they appear to have more manpower and money to devote to the nuts and bolts of monitoring and administering their systems.The upshot? This could mean that agencies are getting past the paper chase of complying with the Federal Information Security Management Act and are finally using FISMA to help improve IT security.Laying the groundwork for FISMA as an effective tool for managing IT security has been difficult. IT shops strapped for cash and manpower have complained that they were forced to choose between doing the required FISMA paperwork or actually fixing their systems. Guidance and standards for FISMA compliance, developed by the National Institute of Standards and Technology, are still evolving. The Ds and Fs awarded to many agencies by the House Government Reform Committee in its annual report cards reflect this struggle.'We can get lost in the details of FISMA,' warned Ron Ross, manager of NIST's FISMA program.But some agencies have begun to embrace FISMA. The Justice Department has gone from an F in the 2004 report card to a B this year. More important, DOJ officials said, they have moved past the paperwork exercise of initial inventories and baselines and now have a program in place to improve IT security.The transition was painful, officials from the agency said. The key to getting from FISMA paperwork to focusing on security was leadership. In the case of DOJ, this came from IT security staff director Dennis Heretick, who took the lead in developing tools to automate the compliance process and securing the support of officials throughout the department. DOJ is becoming a model not only for the tools of FISMA compliance, but for the processes as well.One CISO said FISMA already is a good tool for improving IT security. 'It has been a powerful catalyst for culture change in senior management,' she said.That culture change might be what's reflected in those figures mentioned earlier from the second CISO survey by Intelligent Decisions Inc. of Ashburn, Va.A year ago, of 30 CISOs interviewed for the first survey, 45 percent had no dedicated IT security staff, and a remaining percentage had five people or fewer. In the survey released last month, only 14 percent of CISOs surveyed reported no staff. Forty-three percent had up to five professionals and 32 percent had up to 20 full-time staffers.Money for security might also be easier to get. While most CISOs report having a budget of less than $500,000, that figure dropped to 54 percent this year from 62 percent in November. Those CISOs reporting budgets of $1 million to $5 million jumped from 5 percent last year to 32 percent now.The samples in the survey may be too small to make these figures significant. But maybe attitudes are shifting and IT security is being managed more professionally than ever before. And maybe we'll see the results of those trends when the next FISMA grades come around.
It just takes leadership
William Jackson is a GCN senior writer. E-mail him at wjackson@postnewsweektech.com.
William Jackson
It just takes leadership
William Jackson is a GCN senior writer. E-mail him at wjackson@postnewsweektech.com.