What’s keeping states from adopting CDM?

When it comes to monitoring and securing their networks, state and local government agencies often find themselves asking whether the feds know best.

For large federal agencies, the giant Continuous Diagnostics and Mitigation program offered by the Department of Homeland Security is finally up and running after years in development. CDM “provides federal departments and agencies with the capabilities and tools that identify cybersecurity risks on an ongoing basis, prioritize these risks based upon potential impacts, and enable cybersecurity personnel to mitigate the most significant problems first,” according to the DHS website.

Technically, state and local governments can buy tools and services from this program too, but CDM has not built much of a following in this segment, industry observers said.

Opinions vary as to why this is the case. It may just be that CDM does not fit the bill for state and local agencies as well as it does for federal agencies. Joe Ford, solutions director for Mid-Atlantic and Federal at Optiv, said that the CDM contract is GSA-extended, “so not all products and technical solutions are capable of solving government mandates. Some have solutions but are not able to leverage them.”

“Industry needs to be careful that we aren’t limiting state agencies to only use solutions contained within CDM,” Ford said. “But I’ve always been a big believer that state and local agencies should use the federal government’s contracts when appropriate.”

Meanwhile, others see the plodding process that often typifies government technology implementation as muddying (or at least slowing) acceptance. Jason Macy, CTO of network security company Forum Systems, pointed out that the CDM process was broken down into three distinct phases, each meant to build upon the previous work.  The Phase 1 assessment process gathered the details of agency assets, Phase 2 was for analysis of management processes and infrastructure. The actual implementation of business processes and security protections would take place in Phase 3, building upon information gathered in the first two phases.

“However, the entire CDM process has been ineffective at providing any distinct value as it relates to actual security improvements,” Macy said, adding that he believes the CDM program is limited by its lack of focus on application programming interfaces, “which have become the epicenter of industry innovation and the primary driver of mobility, cloud, Internet of Things and enhanced protection of data and services.

“Without a focus on the very foundation of modern computing, it becomes difficult to determine how much value can be gained from legacy approaches,” Macy said, adding that the program has also been “plagued with slow delivery cycles, inadequate definitions of requirements and an overall ineffective approach to cross-agency security improvements.”

“The intentions behind CDM have been very good,” said Richard Henderson, global security strategist with Absolute Software and a long-time expert in security intelligence. “Without a doubt, many federal agencies have found themselves with a much better security posture today than they did in previous years… but there is still a long way to go.”

“There can’t be a one-size-fits-all program that will be flexible enough to meet the disparate needs of all the various government agencies and groups,” Henderson argued. That said, he believes that DHS is digesting feedback to develop and evolve the CDM program to become more flexible and robust. “This bodes really well for state, local, regional and tribal governments who are thinking about jumping in,” he added. “By the time they are ready to build out and integrate new solutions, it’s very likely many of the biggest wrinkles will have been ironed out.”

Moving in the right direction

Just as state and local and federal government agencies have not all architected their systems and security strategies in the same, lock-step fashion, the experts agree there is likely to be more than a little variance in how, and when, they might implement their own CDM approaches.

“I find it highly unlikely that you’ll find any two environments that are the same when it comes to security infrastructure and monitoring,” Henderson said. “Some groups -- with more budget, more staff, a more supportive leadership team -- or organizations that have already learned the hard way, are likely to have a more evolved and resilient security strategy than a small organization with a tiny infrastructure and even tinier headcount.”

However, Henderson said he believes that the DHS-mandated CDM program does provide agencies with potential new controls and access to tools that they didn’t have in the past. “The quantifiable metrics CDM provides agencies do a fantastic job of painting a reasonable …  picture of their environments,” letting them know  “where resources need to be shifted,” he added.

And, again, as a federal program, CDM is focused on the federal agencies first and foremost. Because CDM is a “contract vehicle with specific task orders to address specific federal regulations,” it focuses primarily on federal agencies, Ford said.

States, on the other hand, “use state contracts to procure those same types of products and related services to address state regulations. They often use their own staff or contractors to maintain those solutions,” Ford said.  “However, I believe they all are moving in the right direction.”