Why government agencies must embrace CDM

When Ret. Brig. Gen. Gregory Touhill announced that he would be leaving his post as federal chief information security officer, he offered cybersecurity recommendations that agencies should be sure not to overlook. Touhill called for equipping everyone, from senior-level leaders down, with the information and training needed to protect agencies’ sensitive information. He also endorsed modernizing IT systems and implementing the Continuous Diagnostics and Mitigation program, which means identifying cybersecurity risks on an ongoing basis, prioritizing risks based upon potential impacts and enabling cybersecurity personnel to mitigate the most significant problems first.

CDM embraces a risk-based approach to security, shifting cybersecurity from solely a technical issue to an everyday business priority. In the private sector, this shift is old news; however, across many government agencies, it continues to be a novelty. 

Touhill is right. If government agencies want to protect the IT systems, applications and information that matters most -- while facing the challenge of limited resources and budget -- they must shift their focus from technology to risk. That means first and foremost identifying mission-critical assets and who has access to them,  then tackling the threats and vulnerabilities that could compromise those assets. It’s a focused approach that targets the assets that, if compromised, would cause the most damage to the organization.

A key component to this risk-based approach is beginning to surface now -- value at risk. In the private sector, VaR is not a novel concept. It has been used across companies for years to drive critical decision-making and manage types of risk other than cyber. Cyber VaR in the private sector means mapping potential financial impact to applications at risk of compromise and prioritizing remediation based on which actions reduce that impact the most.

In government, however, it’s all about mission impact. That means calculating a quantifiable measurement of cyber risk -- including fiscal effects and impact to the mission -- that’s based on current detectable conditions in the organizational environment using information gathered from existing security tools and organizational context. If a system or application were compromised today, how much damage would it cause to the mission? Vulnerabilities and threats to assets that carry the most significant mission impact and have the greatest potential for exploitation should be at the top of the mitigation list.

While the concept seems straightforward, most attempts to accurately calculate VaR have fallen short. Doing it right requires a comprehensive and integrated view of cyber risk, including threats, vulnerabilities and asset value. Experts must then work with the cyber, business and organizational teams to try to estimate probabilities of particular events and their ability to compromise each application’s confidentiality, integrity and availability.  One challenge to this approach is that there is far too little historical data with which to make accurate estimates.  Further,  even if leaders were able to guesstimate probabilities with any accuracy, those predictions would refer to only a single point in time.  That makes it difficult to drill down to the level of detail required to drive daily decisions and actions beyond protecting those applications with the greatest theoretical risk. 

Without the right tooling and approach, agencies will be challenged to fulfill the CDM mandate.

To accurately calculate mission impact on a continuous basis, organizations must factor in current threats and vulnerabilities in their environment, assess how those conditions elevate the potential for compromise and prioritize their activities accordingly.  This approach uses actual events occurring within the organization, together with external threat intelligence data, to measure the potential for compromise and estimate loss impacts that can result from those exposures. 

The benefit to this approach is that it is based on actual conditions “on the ground” and can be aggregated to drive prioritization decisions from front-line responders all the way up to senior executives. Security leaders can validate how much risk was removed from the organization due to actions taken using actual loss impact metrics tailored to their specific environment.

As the private sector shifts to a risk-based approach, so too should government. The plugging-holes method of layering one security technology on top of another to cover gaps that led to or could lead to a compromise isn’t working. Instead, it’s creating an endless pile of threat alerts and vulnerabilities, leaving security teams guessing which ones are the most critical and need immediate mitigation.  By embracing CDM, which supports a risk-based approach to cybersecurity, agencies will be able to change the conversation from trying to remediate every threat and vulnerability to deciding what actions to take to best minimize the impact of cyber risks on the organization.