Shows & Panels
- The 2014 Big Picture on Cyber Security
- AFCEA Answers
- Ask the CIO
- Connected Government
- Consolidating Mission-critical Systems
- Constituent Servicing
- Continuous Monitoring: Tools and Techniques for Trustworthy Government IT
- The Data Privacy Imperative: Safeguarding Sensitive Data
- Eliminating the Pitfalls: Steps to Virtualization in Government
- Federal Executive Forum
- Federal Tech Talk
- Government Cloud Brokerage: Who, What, When, Where, Why?
- Government Mobility
- Mission-critical Apps in the Cloud
- Mobile Device Management
- The Modern Federal Threat Landscape
- The Path from Legacy Systems
- Understanding the Intersection of Customer Service and Security in the Cloud
Shows & Panels
Search Tags: Cyber
Prepare for the worst…and hope for the best. This unofficial mantra of the emergency preparedness and response community also applies to cyber preparedness. This week seven federal agencies, 11 states, 12 international partners, and 60 private sector companies are doing just that: preparing for the worst in cyberspace. These organizations are all participants in Cyber Storm III, a global cybersecurity preparedness exercise led by the U.S. Department of Homeland Security. By the end of the week, these organizations will have responded to a fictionalized cyber threat scenario designed to test their individual and collective capabilities to respond to cyber attacks and the National Cyber Incident Response Plan (Interim Version, September 2010). Federal cyber preparedness has never been more important. The threat to federal information assets and networks is diverse, persistent, and growing. In recent testimony before the U.S. House of Representatives, General Keith Alexander, Commander of the U.S. Cyber Command, stated that U.S. Department of Defense networks are "probed roughly 250,000 times an hour" and characterized the "…shift toward operationalizing cyber tools as weapons to damage or destroy" as a "great concern to us at Cyber Command." The National Cyber Incident Response Plan states:
- Preparedness activities, including establishing common situational awareness in a common operational picture, are shared responsibilities across Federal, State, Local, Tribal, and Territorial governments and the private sector.
- Governance: bringing together the mission, policies, architectures, and organizational alignment to establish the who and what for risk management strategies.
- Risk management: establishing risk tolerance thresholds and implementing the technologies and processes that will assess, prioritize, and monitor risk on a continual basis.
- Compliance: ensuring the organization maintains a cyber security posture compliant with federal laws, regulations, guidelines, and standards with the ability to demonstrate sound risk management strategies when scrutinized by internal and external auditors and Inspectors General.
- Operations: designing, implementing, and monitoring security controls at the operational and tactical levels to include the ability to adequately respond to, withstand, and remediate cyber attacks.
By evaluating federal cybersecurity programs through this framework, agencies can better understand their capabilities and live up to their shared responsibility for cyber preparedness.
People exercise risk management, consciously and unconsciously, every day.
Many of us drive on a daily basis. Some speed, and risk the chance of getting caught, while others are more conservative and drive the exact speed limit. We base our decision on whether or not to exceed the speed limit on the information available to us at the time, including our knowledge, past experiences, or the conditions we see in front of us. We weigh the risks against impacts and consequences, making decisions based upon our tolerance for the outcomes. The same is true for federal cyber risk management.
Securing federal information and assets in cyberspace is the primary driver behind cybersecurity. Even so, other factors help define risk, including the potential for negative publicity if a cyber breach occurs, the impact to budget/performance plans if FISMA grades fall short, or the potential for investigations or congressional hearings if the burning issue of the day burns a bit too bright for too long. Federal cyber risk management fundamentally boils down to making risk decisions based upon an agency's risk tolerance - and the drivers behind an agency's tolerance vary across the federal government.
Risk is defined as the likelihood of a future event that may have unintended or unexpected consequences. Federal agencies make the best cyber risk management decisions by using data and information to evaluate the agency's strengths and weaknesses for delivering on its cyber mission in the context of potential threats.
Agencies must use information and data from various disparate sources across the enterprise to make these decisions, including audit log information, vulnerability data, asset information, the agency's regulatory compliance status, external and internal threat activity, human capital risks to the cybersecurity mission, and many more. As challenging as it may be for agencies to consume large volumes of disparate data, it is a challenge that is essential to overcome for agencies to make the best cyber risk management decisions.
Is this achievable? Absolutely. The business intelligence movement established the foundation allowing agencies to minimize risk exacerbated by ad-hoc decision-making. Leveraging business intelligence capabilities for cybersecurity enables agencies to aggregate data across technical and organizational stovepipes and to provide agency cybersecurity leaders with mechanisms for making informed, risk decisions. By better understanding the cyber landscape, federal cybersecurity leaders can - much like our speeding driver example - understand "how fast" to drive and make better investment decisions when addressing enterprise cybersecurity risks.
Cybersecurity is among the federal government's top priorities…and with good reason. The cyber threat is complex and evolving rapidly. According to the U.S. Government Accountability Office (GAO), the number of cyber incidents reported by federal agencies increased by 400% over a four year period. Also, cyber threats come from multiple sources (e.g., terrorists, criminal organizations, hackers, disgruntled insiders, rogue nations, etc.) with a host of motivations for, and resources to, attack.
To beat the cyber threat, federal Chief Information Security Officers (CISOs) must assess risk, develop cybersecurity policies, and build the operational infrastructure to execute an agency cybersecurity program. They also need experienced cybersecurity professionals - that's where we come in… A dedicated cybersecurity firm - and the market leader in providing risk management, governance, operations, and compliance services to the federal government - our team takes pride in being the government's trusted advisor for cybersecurity.
In this space, we will share our insights on the news, challenges, and policies that drive decision-making and problem solving around cybersecurity in the federal government. By discussing key cybersecurity topics in this blog, and highlighting those of other federal community thought leaders in our companion "Trusted Advisor Series" on WTOP radio, we hope to add value to this critical dialogue. We look forward to sharing this online experience with you. - KCG's Trusted Advisor
August 12th, 2010 at 11 AM
How does one assure trust in Cyberspace? As citizens, government, and business enterprise increase the amount of information that is shared online, fundamental questions arise around security requirements, data and identity management, and infrastructure. Trusted online environments can reduce costs, expand services, and are critical to protecting how, and to whom, information is shared. Securing identities in transactions is an essential component to building trusted online systems and a critical priority for both business and government. As online information sharing and collaborative services evolve between people and technologies, will trust emerge as the next "Killer App"?
Tags: technology , Expert Voices presented by Booz Allen , Booz Allen , Expert Voices , Citi , Citibank , NSTIC , trust , trusted services , trust framework , securing identity , identity management , cybersecurity , cyber , cyberspace , Michael Farber , IT , John Clippinger , Berkman Center for Internet & Society , Dr. Jeff Voas , NIST , Hilary Ward , Global Transaction Services
What's the big deal about a 32-character string of secret code in the logo of the Pentagon's U.S. Cyber Command. The new military command was launched in late May to help centralize Defense Department efforts to protect its computer networks, which are under constant threat from attackers. The Associated Press reports it was created to frustrate everyone from run-of-the-mill hackers to foreign governments looking to steal sensitive information or crash critical, life-sustaining computer systems.
Thursday, June 17th
The sophistication of security breaches of federal information systems and reports of improper access to these systems continues to grow at an alarming rate. Clearly, there is concern about and a desire to improve the security of these critical infrastructures. So where and how do we begin to effectively safeguard today's systems from cyber threats and increasing system vulnerabilities? c
Cyber attacks are a growing vulnerability for our homeland security and broader national interests - and federal employees are on the front lines. In fact, Politico recently reported that Congress and other government agencies face an average of 1.8 billion cyber attacks per month. Both the number of attacks and their sophistication continue to increase at an alarming rate.
In many instances, the key to successfully combating an attack is stopping it at its entry point, which is often the unsuspecting federal employee. For example, the Politico report pointed out that "…attacks are increasingly focused on infiltrating application software on Hill staffer computers…,"noting:
- In the last five months of 2009, 87 Senate offices, 13 Senate committees and seven other offices were attacked by spear-phishing attacks, which appeared as e-mail messages to staffers urging them to open infected attachments or click on bad links.
- Cyber security must be an agency priority. Cyber security education and training are much like any other agency initiative: if leadership indicates that something is a priority, agency employees will take action. Agency leadership must make it clear that cyber security education and training are a priority, model the behavior they ask of their employees, and dedicate resources to address the problem and its solution. If they do so, federal employees will respond accordingly.
- Education and training must be continuous. Hackers, terrorists, and other bad cyber actors do not wait for reporting requirements or other compelling organizational issues to decide when to attack - they just do. Education and training efforts should be ongoing, consistently updated, and test employees' understanding of the topic on a regular basis. Agencies must be as persistent and agile in their training as cyber attackers are in their efforts to do harm.
- All agency employees must be included in training. All agency employees, and their contractors, are vulnerable to cyber attacks. No grade level is too high or too entry-level to be excluded from standard education and training.
- Reporting and accountability measures must be implemented. Accountability mechanisms should be used to not only identify those personnel who have or have not received cyber security training, but also on how well they retain the information they have learned. The use of cyber security quizzes or other mechanisms to test the workforce's cyber knowledge provide a quantitative measure of the effectiveness of the training program as well as targeting specific personnel or subjects for deeper training.
The techniques used to attack information networks and exploit information are quickly evolving to the point where it is almost impossible to distinguish intrusion activity. The federal government must use an educated workforce on the cyber threat as a force multiplier as part of its cyber security strategy. Individual employees and agencies must share the responsibility for anticipating and preventing cyber attacks from succeeding.
The non-profit Bipartisan Policy Center recently hosted Cyber ShockWave - a live, mock cyber attack against the nation. The exercise simulated the government's response to a cyber crisis with former Cabinet and national security experts acting as presidential advisors in the fictional drill. The exercise highlighted the dangers of cyber-terrorism and the government's preparedness to respond to such an attack.
Hackers, terrorist organizations, cyber criminals, and nation states routinely target government and corporate entities for financial gain, military intelligence, warfare, and sometimes just for notoriety and fame. Government agencies and corporations have traditionally addressed this threat independently, but the evolution of cyberspace has changed the rules. A unified front between the private and public sector has become more critical to combat these cyber threats.
The public and private sectors are becoming increasingly interdependent - the operation of our nation's critical infrastructure, including the national power grid, transportation systems, and communication networks, depends upon the ability of public and private sector networks to share information via cyberspace. Likewise, our nation's economic superiority is predicated on our ability to maintain competitive advantages in capital markets. Our enemies are not only looking for ways to exploit vulnerabilities in our critical infrastructure, but they are also increasingly looking for ways to steal our private sector's intellectual property in order to weaken our economic standing and gain an advantage in the global economy.
Google's disclosure of "sophisticated" cyber attacks on its infrastructure reportedly originating in China offers a good example. The Washington Post recently reported that Google and the National Security Agency (NSA) are forming an alliance "to better defend Google - and its users - from future attack." Putting the agreement in place will enable the NSA and Google to share critical information to analyze the attack without violating privacy laws or policies. This alliance will help Google better defend its intellectual property critical to our nation's economy while providing NSA key insight into the attack methods and motives of the attackers.
The need for such partnerships is certain to grow and will most likely extend to organizations that are not as large and resourced as Google but are just as critical to the strength of our nation's economy. Our adversaries are using similar attack methods to compromise systems across both sectors but they have not effectively partnered to share threat intelligence or early warning indicators. A formal partnership between the private and public sector allows the country to develop a unified and coordinated approach to defending our nation's assets.
There is a new alliance in the battle for cybersecurity. Though neither side has confirmed it, The Washington Post recently reported that Google has asked the NSA to help investigate the mid-December cyber attack against its networks "to better defend Google - and its users - from future attack." This partnership demonstrates the increasing interdependencies between the public and private sector in defending against cyber threats.