Offense must drive IT defense
Connecting state and local government leaders
Officials assess risk management approaches in government systems at Executive Leadership Conference.
Agencies seeking to secure federal information systems should use attack-based metrics as one of several approaches to reduce vulnerabilities and better manage risks, according to a group of government and industry officials.Escalating threats to agencies' information systems continue to put pressure on the government to find better ways to manage risks. But of three core factors commonly associated with determining risk assessments ' threats, vulnerability and impact ' the only factor that can really be managed and reduced is vulnerability, said Alan Paller, director of research at the SANS Institute.Current government guidance on assessing information system security leaves too much room for interpretation, which in turn breeds uncertainty, said Paller, who was a member of a panel on managing risks at the American Council for Technology and Industry Advisory Council's Executive Leadership Conference in Williamsburg, Va., today.'Uncertainty causes wasteful wars between inspectors general and chief information officers,' Paller said.He said a better approach would borrow banking-industry measures that deal with many of the same information technology security concerns. Specifically, Paller recommended that agencies:However, to be successful, agencies have to embrace the notion that 'defense must be informed by offense,' Paller said. They must staff IT security teams with people who have dealt with cyberattacks, and those teams need to focus on attack-based metrics when prioritizing response measures, he added.Agencies have a long way to go to get to that point, he said, citing a recent estimate that at a typical agency, '70 percent of the [IT security] staff has soft skills, [and] only 30 percent have specialized security skills.' We need to reverse that ratio, he added.Paller was followed by a group of panelists that included Sallyanne Harper, chief financial officer and chief administrative officer at the Government Accountability Office; Cathleen Berrick, director of GAO's Homeland Security and Justice Team; Karen Evans, administrator of e-government and IT at the Office of Management and Budget; Gregory Friedman, inspector general at the Energy Department; and Erik Hopkins, a member of the professional staff of the Senate's Homeland Security and Governmental Affairs Committee.Among other measures, panelists recommended that agencies improve their risk management efforts by:
- Engineer to block against known attacks.
- Buy systems that have embedded security.
- Continually monitor and fix vulnerabilities to known attack vectors.
- Monitor new attacks that highlight critical vulnerabilities on a daily basis.
- Find innovative ways to block new attacks.
- Automate to make old defenses inexpensive to maintain and direct spending to more important issues.
- Ensure business continuity and effective incident response.
- Completing the transition to having government desktop computers fully compliant with the Federal Desktop Core Configuration. 'Offense has to know what the environment is to work on the defense,' one panelist said.
- Tapping the expertise of GAO analysts and IGs who have had the opportunity to see and share best practices in risk management.
- Expanding the discipline of risk management through training and exposure to commercial experts.
- Including the people actively involved in cybersecurity in high-level decision-making circles.
- Being careful not to become paralyzed by fear of risk in the process of mitigating vulnerabilities.
NEXT STORY: New administration, new employment landscape