Bruce Brody | Waiting for 'Son of FISMA'

More than two weeks before the House Government Reform Committee released its latest round of FISMA grades, Bruce Brody predicted there would be little improvement. He was right. The overall grade for the federal government was D+, the same grade it received a year ago.Brody is vice president of information security for Input Inc., a market research firm in Reston, Va., that specializes in government IT contracts and issues. But his expertise in FISMA comes from his stints as chief information security officer with, first, the Veterans Affairs Department, then the Energy Department. Brody says he's the only person to hold that position in two Cabinet-level organizations.To Brody, FISMA is a useful exercise that has delivered benefits to agencies, but which doesn't go far enough.Brody: We have to be very clear and point out that FISMA has done a great service to the community by increasing the awareness of the issue of information security, and by putting in place certain aspects of a governance structure, where the senior agency information security officer is identified, certain roles are ascribed to that person and that person reports to the CIO. Also, the connection of risk-based decisions to budget is another important contribution of FISMA.We're about to see the fifth round of grades out of the FISMA process. [The grades were released March 16, after this interview was conducted.] I'm going to predict that those grades will not show appreciable progress in terms of increasing overall information security in the executive branch. Moreover, I'm going to assert that those grades aren't entirely meaningful, because, the way the process has been implemented, there are ways to get good grades and not be secure and ways to get bad grades and be more secure.What I really am advocating is that we take a look at where FISMA has brought us to date: We accept and acknowledge all those contributions that FISMA has given us, then we start talking about where we need to go next.Brody: All right. GISRA'the Government Information Security Reform Act' which was the first version of FISMA, sort of was born out of the Y2K days. Y2K was very much a look at, system by system, site by site, fixes for systems that would have problems with the Y2K code. ... It became the prevailing thought process on the Hill and in policy circles that you could simply take that momentum and apply it to information security.What the system-by-system, site-by-site approach doesn't fully account for are infrastructure-level and enterprisewide improvements that can be put into place to increase the security posture of an organization but for which FISMA does not give adequate credit.Brody: Right, if you're looking at a specific system. Now we bring in the other part of the FISMA process. It is the oversight community, specifically the [inspector general], that must write a companion report ... with the CIO, which then goes forward to OMB and Capitol Hill to be read and graded. Well, the inspector general must gain an appreciation for those infrastructurewide programs, or is then reduced to the typical audit process of system by system, site by site, which is what FISMA supports.So it's very possible for a CIO to be putting in place infrastructure strengthening and hardening, and yet the IG's report'because these things are hard to audit'doesn't fully account for that. An agency can be far more secure, but get an F, than some department or agency that went and put Band-Aids on a bunch of systems, is less secure, but got a B.Brody: If you just step back for a minute and say, well, what do we really need to know about government systems? We need to know what we have, because that tells us what our inventory is of all our systems and all our networks. What are the boundaries of our enterprise, so we know where the networks touch. All these systems and network devices: What are their configurations, because we've got to be able to manage those configurations if we want to have security. Who is on these systems and networks at any given time? And what are they doing? If we know those five things, then we can begin to address security with technical-based processes.Now, if the next version of FISMA were written to say that I need to know those five things ... and then to certify that they are taking the technical steps necessary to either come to 100 percent knowledge of those things [or] to verify the security of those things, that would be a pretty effective piece of legislation.Brody: I can point to dozens of those kinds of initiatives, where there are individual pockets around the government who get the idea of being secure and are working feverishly, notwithstanding all the compliance distractions. Remember, it's always easier to say you're compliant than to say you're secure. But the issue here is ... you have an overarching policy framework of compliance that you still have to march to.What I'd like to see is all of that tied together from a leadership and policy standpoint across the executive branch, and right now the only framework that exists for that is FISMA. So the only discussion you can have across the entire executive branch is in the context of FISMA and the President's Management Agenda. Both of those impose a compliance mentality on the executive branch leadership, which is at times a little at variance with [the attitude of] let's get the job completely secure. What I'd love to see is the marriage of compliance and security. Right now, it's a shotgun wedding; compliance holds the shotgun. [It clearly is] the ascendant philosophy. ...It could be maybe the next round of evolution is what we're talking about, taking this away from compliance and a paperwork drill and more into a let's-get-secure, technically-based process kind of drill. Son of FISMA.