California develops its own cybersecurity metrics
Connecting state and local government leaders
The California Cybersecurity Maturity Metrics are designed to help state agencies evaluate their risk postures through qualitative and quantitative measures.
The California Department of Technology supports is close to 150 state entities providing government services, so securing all those systems can be a heavy lift. To help the state get a better handle on the effectiveness of its security programs, CDT devised the California Cybersecurity Maturity Metrics to benchmark agencies' security posture and measure progress as audits and improvements are made.
The metrics take best practices from the National Institute of Standards and Technology’s Cybersecurity Framework and the Center for Internet Security's top 20 controls, then tailors them for California agencies. They were created through a year-long effort, involving CDT, the California Cybersecurity Integration Center, California Highway Patrol and the California Military Department.
“We held almost a dozen workshops with half of the departments in the state sending representatives,” California Chief Information Security Officer Peter Liebert told GCN.
The maturity metrics will be gathered from sources agencies already use, such as those collected during audits by the CDT's Office of Information Security or through independent security assessments, according to the Statewide Information Management Manual.
The metrics address policy, system categorization and governance and measure security maturity in five categories and across 34 controls:
- Identify: Governance, data and system categorization and vulnerability scanning.
- Protect: Account management, encryption and system configurations.
- Detect: Network and end-point monitoring.
- Respond: Incident response plans and testing.
- Recover: Technology recovery plans and testing.
“We decided to use the five categories in NIST’s [Cybersecurity Framework] so this framework makes sense for leaders who are not very savvy in the cybersecurity space to be able to compare their agencies to others,” Liebert said.
The scores are weighted, with a “0” indicating low program maturity and a “4” representing high program maturity scale, according to a CDT technology letter.
The maturity metrics focus on measures that will provide the highest return on investment -- i.e., those leveraging existing assets and those that help agencies balance cybersecurity visibility, decision-making and efficiency in resource allocation and overall security spending, according to CDT's 2017 Annual Report. They will also help CDT track gaps and statewide trends so it can identify where additional guidance, training and remediation support can help improve cybersecurity.
Tracking the maturity metrics will run on a four-year cycle. In the first year, environments are examined for policy requirements. The second year examines compliance with the metrics set out by the Cybersecurity Framework, and the final two years examine the results from the independent security assessments to determine changes from the initial baseline measurements.
The metrics are also meant to complement the assessments that the California Military Department already conducts for many agencies through its cybercrime division. CDT’s Office of Information Security also performs policy-based audits for high-risk entities.
The metrics can help empower smaller state agencies to make a case for improving their cybersecurity posture despite having a smaller workforce, Leibert said.
According to NIST, more than 20 states are using its Cybersecurity Framework to improve their cybersecurity posture.
“Independent verification through the security metrics … is extremely valuable from an oversight perspective,” Liebert said. “As these metrics become part of the normal process, we will be collecting data and providing results to the corresponding departments and leadership.”