A CIO's view of cybersecurity
Connecting state and local government leaders
Having a clear, detailed view of what's going on inside an agency's network is the most important aspect of cybersecurity.
It’s no secret that cybersecurity has emerged as a critical issue for the U.S. government and will likely have the continued focus of the Obama administration. From the perspective of an agency chief information officer, I think it is worth putting cybersecurity response into context and offering a few suggestions going forward.
First, there is protection. We want to keep the bad guys out. This gets the most attention, partly because it is fairly easy to measure — at least, if you discover they got in. Perhaps more important, it carries a high risk of an article in the Washington Post or Wall Street Journal, and avoiding embarrassment is a key goal. Another name for this part of cybersecurity is “building Maginot Lines.”
Second, there is detection. We want to find the bad guys if they get in. My good friend Alan Paller at the SANS Institute tells me that this might be the hardest one to implement. Bad guys are clever; they keep changing the nature of the software they use to break in. They change faster than we can keep up.
Third, there is remediation. We want to get rid of malicious software if we find it. At minimum, we always have the option of erasing the whole computer and reinstalling everything — that is, everything except the bad guys’ software.
Fourth, there is integrity. We want to make sure that the bad guys haven’t changed anything inside our network. This point makes me particularly nervous. If the purpose of a penetration is merely to change the information with little concern about sending the results, we will find it harder to identify compromised data.
Finally, there is availability or resiliency. Even if the bad guys get in and even if we cannot find or remove their software, we still might need an application to run, even if it is compromised, if the application is critical to our mission.
What would I recommend focusing on first?
The most important issue to me is to ensure status transparency. This requires knowledge of what is going on at a sufficiently granular level to act on it. At the Transportation Department, we created the Cyber Security Management Center to provide security visibility into every system and network at the department. We now receive regular reports from CSMC on the quality of access and incident reports.
My second goal would be to centralize as much of the IT infrastructure as possible, including desktop PCs, networks and nonspecialized servers. This improves security, has the potential to reduce duplication, and allows individual agencies to focus more on their missions. The Defense Information Systems Agency’s approach to providing information services to the Defense Department, with common capabilities, security and other services, offers a constructive model for civilian departments.
Lastly, we need to create a more standardized approach to cybersecurity, including making it part of investment decisions across government. When my office recently reviewed the budgets of individual DOT programs, we found large disparities in the way we approach and implement security.
The work of the National Institute of Standards and Technology, the Information Systems Security Line of Business and the newly formed Security and Identity Management Committee of the CIO Council can help provide leadership in this area. How the next administration decides to centralize coordination of cybersecurity policy will be particularly important.
We also must consider specific applications, such as a financial system, as individual, vertical implementations and look at general requirements such as project management discipline horizontally across all applications.
Cybersecurity must be treated as an individual discipline and extended horizontally in an integrated approach across technology decisions. Emphasizing both will help us better address the IT security challenges of the future.
NEXT STORY: Bridging the PKI gap