Challenges from all sides beset CISOs

Government agencies rely on their chief information security officers to stay on top of evolving threats to their information technology systems. But CISOs must balance a variety of needs and requirements to keep their organization’s networks safe. A panel of government CISOs discussed these issues at a recent meeting sponsored by the Armed Forces Communications Electronics Association’s Bethesda, Md., chapter.

Moderated by Jerry Davis, NASA's deputy chief information officer for IT security, the panel examined how CISOs balance their existing mission needs with new and pending rules, managing new technology trends such as real-time data monitoring, and working with the vendor community.

Davis noted that the federal government was going through a period of change as it renewed emphasis on cybersecurity, citing the nearly 40 cyberspace related bills currently under consideration in Congress. Davis added that the role of the CISO continues to evolve, as they increasingly assume greater responsibility and authority in their organizations.

When asked how they balanced their responsibilities with meeting established priorities and complying with new regulations, the panelists offered a range of answers. Patrick Howard, the Nuclear Regulatory Commission’s CISO, said that while he keeps up with his current responsibilities, he also is watching new legislation; he specifically cited a proposed law that would allow CISOs to withhold bonuses to executives and managers who did not meet federal compliance standards.

Related coverage:

Novel cybersecurity approach has plenty of fans—and naysayers

Just how continuous should continuous monitoring be?

The 20 critical security controls your organization should focus on 

Ned Goldberg, CISO at the Federal Deposit Insurance Corporation, noted that the Federal Information Security Management Act has given CISOs a great deal of authority. He said that in the FDIC, prior to FISMA, the CISO would report to a manager five levels below the chief executive officer. After FISMA, the CISO now reports to and advises the top level of management. Regarding new capabilities, Goldberg said he was excited about the possibility for continuous security monitoring and the legislation that is proposing it.

Jaren Doherty, deputy assistant secretary for information protection and risk management at the Veterans Affairs Department, backed Goldberg’s comments, noting that through FISMA, great value is provided through good information security. Noting that VA is the second-largest agency in the federal government, Doherty explained that as a large and complex organization, its security is driven by metrics. Old-style vulnerability reviews took place infrequently and produced results that were already outdated. As a comparison, he said that the agency is now developing systems to monitor the status of all desktops in the organization every 20 minutes.

Doherty said FISMA and the proposed legislation will allow VA to not only provide continuous monitoring of individual desktops but also to focus on parts of the network that come under attack and conduct real time diagnostics.

Regarding providing real-time data, Davis said IT situational awareness was an important concern for organizations. He noted that the three-year certification and accreditation process does not work and explained that organizations must get their capabilities as close to continuous monitoring as possible. However, the need for constant monitoring has changed the risk management paradigm because organizations require very good data to operate in real time.

Goldberg said government agencies must adapt their systems to manage different data feeds. However, he added that organizations are not used to juggling a variety of data streams. Administrators must look for anomalies in this large flow if incoming data, but these streams create too much log information. Organizations use software tools or outside services to locate the most important trends in data flows. Goldberg said that as a small agency with limited resources, the FDIC contracts with Symantec to help analyze its data flows.

NRC is installing real time monitoring technology during the next six to 12 months, Howard said. He explained that organizations must refine their risk measurements according to their business. However, this type of calibration cannot be done unless there is a good picture of the agency’s risk profile because all risks and events are not the same, he said.

Industry must also work closely with CISOs, the group concluded. The panelists agreed that private software firms must be more diligent in installing security features into their products and ensuring their interoperability with other systems. Davis said one of his chief frustrations was buying software tools and then spending years getting them to work with each other. New security products and diagnostic tools must be able to quickly work together to meet real time threats, he maintained.

Davis said vendors must also identify and remove any common vulnerabilities before they market their products to the federal government. He cited the example of sequel injection vulnerability in some software products as an example for the need to prevent common threats.