Shows & Panels
- AFCEA Answers
- Ask the CIO
- The Big Data Dilemma
- Carrying On with Continuity of Operations
- Connected Government
- Constituent Servicing
- Continuous Monitoring: Tools and Techniques for Trustworthy Government IT
- The Cyber Imperative
- Cyber Solutions for 2013 and Beyond
- Expert Voices
- Federal Executive Forum
- Federal IT Challenge
- Federal Tech Talk
- Mission-critical Apps in the Cloud
- The Path from Legacy Systems
- The Real Deal on Digital Government
- The Reality of Continuous Monitoring... Is Your Agency Secure?
- Veterans in Private Sector: Making the Transition
Shows & Panels
Search Tags: Trusted Advisor Blog
Cyber attacks are a growing vulnerability for our homeland security and broader national interests - and federal employees are on the front lines. In fact, Politico recently reported that Congress and other government agencies face an average of 1.8 billion cyber attacks per month. Both the number of attacks and their sophistication continue to increase at an alarming rate.
In many instances, the key to successfully combating an attack is stopping it at its entry point, which is often the unsuspecting federal employee. For example, the Politico report pointed out that "…attacks are increasingly focused on infiltrating application software on Hill staffer computers…,"noting:
- In the last five months of 2009, 87 Senate offices, 13 Senate committees and seven other offices were attacked by spear-phishing attacks, which appeared as e-mail messages to staffers urging them to open infected attachments or click on bad links.
- Cyber security must be an agency priority. Cyber security education and training are much like any other agency initiative: if leadership indicates that something is a priority, agency employees will take action. Agency leadership must make it clear that cyber security education and training are a priority, model the behavior they ask of their employees, and dedicate resources to address the problem and its solution. If they do so, federal employees will respond accordingly.
- Education and training must be continuous. Hackers, terrorists, and other bad cyber actors do not wait for reporting requirements or other compelling organizational issues to decide when to attack - they just do. Education and training efforts should be ongoing, consistently updated, and test employees' understanding of the topic on a regular basis. Agencies must be as persistent and agile in their training as cyber attackers are in their efforts to do harm.
- All agency employees must be included in training. All agency employees, and their contractors, are vulnerable to cyber attacks. No grade level is too high or too entry-level to be excluded from standard education and training.
- Reporting and accountability measures must be implemented. Accountability mechanisms should be used to not only identify those personnel who have or have not received cyber security training, but also on how well they retain the information they have learned. The use of cyber security quizzes or other mechanisms to test the workforce's cyber knowledge provide a quantitative measure of the effectiveness of the training program as well as targeting specific personnel or subjects for deeper training.
The techniques used to attack information networks and exploit information are quickly evolving to the point where it is almost impossible to distinguish intrusion activity. The federal government must use an educated workforce on the cyber threat as a force multiplier as part of its cyber security strategy. Individual employees and agencies must share the responsibility for anticipating and preventing cyber attacks from succeeding.
The National Institute of Standards and Technology's (NIST) recent release of Special Publication 800-37, Revision 1 Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach is an important change in the direction of how federal agencies achieve information security and manage information system-related security risks. It shifts the focus away from a point in time Certification and Accreditation (C&A) approach to compliance towards continually assessing risk and security authorization. As a result, the federal information security community is sending a message to the broader federal community and creating an important discussion: the cyber threat is real and must be addressed in the context of its potential impact on an organization. Cyber security is not as simple as a "check the box" requirement. The paradigm shift away from point in time security and towards obtaining situational awareness of the organization's risk posture must be as pervasive in the federal government as the cyber threats are against us.
Regarding the impact on agency security procedures, the publication is clear on the focus of its new framework, stating:
The revised process emphasizes: (i) building information security capabilities into federal information systems through the application of state-of-the-practice management, operational, and technical security controls; (ii) maintaining awareness of the security state of information systems on an ongoing basis through enhanced monitoring processes; and (iii) providing essential information to senior leaders to facilitate decisions regarding the acceptance of risk to organizational operations and assets, individuals, other organizations, and the Nation arising from the operation and use of information systems.
This new Risk Management Framework builds much needed flexibility into the overall federal information security lifecycle to address the increasing nature and scope of threats in real-time, providing a number of key advantages that include:
- Continually evaluating the organization's risk posture and maintaining situational awareness of its cyber security posture
- Understanding the state and maturity of an agency's cyber security program
- Evaluating cyber security programs at key vulnerability points: people, processes, and technology
- Maintaining a focus on the security program lifecycle
- Addressing the key functions (governance, risk, management, compliance, operations) of a security program
Perhaps most importantly, agency security programs will be better positioned to evolve and mature - an absolute necessity for staying ahead of the growing and dynamic threat to our Nation's cyber security.
Hackers, terrorist organizations, cyber criminals, and nation states routinely target government and corporate entities for financial gain, military intelligence, warfare, and sometimes just for notoriety and fame. Government agencies and corporations have traditionally addressed this threat independently, but the evolution of cyberspace has changed the rules. A unified front between the private and public sector has become more critical to combat these cyber threats.
The public and private sectors are becoming increasingly interdependent - the operation of our nation's critical infrastructure, including the national power grid, transportation systems, and communication networks, depends upon the ability of public and private sector networks to share information via cyberspace. Likewise, our nation's economic superiority is predicated on our ability to maintain competitive advantages in capital markets. Our enemies are not only looking for ways to exploit vulnerabilities in our critical infrastructure, but they are also increasingly looking for ways to steal our private sector's intellectual property in order to weaken our economic standing and gain an advantage in the global economy.
Google's disclosure of "sophisticated" cyber attacks on its infrastructure reportedly originating in China offers a good example. The Washington Post recently reported that Google and the National Security Agency (NSA) are forming an alliance "to better defend Google - and its users - from future attack." Putting the agreement in place will enable the NSA and Google to share critical information to analyze the attack without violating privacy laws or policies. This alliance will help Google better defend its intellectual property critical to our nation's economy while providing NSA key insight into the attack methods and motives of the attackers.
The need for such partnerships is certain to grow and will most likely extend to organizations that are not as large and resourced as Google but are just as critical to the strength of our nation's economy. Our adversaries are using similar attack methods to compromise systems across both sectors but they have not effectively partnered to share threat intelligence or early warning indicators. A formal partnership between the private and public sector allows the country to develop a unified and coordinated approach to defending our nation's assets.
In addressing the importance of cyber security as a government priority in testimony before a Senate Homeland Security and Governmental Affairs subcommittee last fall, Vivek Kundra, the Federal Chief Information Officer, said:
"Our Nation's security and economic prosperity depend on the stability and integrity of our Federal communications and information infrastructure." Federal News Radio has reportedthat the federal government will spend $8.3 billion on computer security this year - marking a 60% increase in four years. As Federal information security decision-makers allocate dollars and resources to protect our infrastructure, it is important to prioritize the key challenges they face. These include:
- 1. Increased use of mobile devices.Mobile devices are becoming smaller and faster every day. Agencies face even more challenges as mobile applications have now become widely used and they are even looking to build their own mobile applications to increase their productivity in the field.
- 2. Continued movement of data into the cloud. Cloud computing has become a pervasive buzzword but in the end, risk stems from a matter of oversight and control. Agencies must rely on strong governance and compliance oversight of their service providers since they do not own or control the systems where their data resides.
- 3. Changing regulatory environment. NIST has undergone sweeping changes across their Special Publications by introducing a new Risk Management Framework and introducing new nomenclature such as "Security Authorization." OMB continues to press their performance metrics as a part of the FISMA reporting process and could see some changes in the next 9 months.
- 4. Application security. Attackers have now moved their focus from the network and infrastructure level to the application layer. We're seeing more attacks proliferated through applications such as Adobe and web browsers but some high profile data breaches stemmed from custom web applications through SQL injection attacks.
- 5. Developing/maturing offensive capabilities. "Understanding the offensive to build the defensive" has become the mantra for today's cyber security efforts. The ability to understand the mindset of an attacker and their methods becomes critical in building defenses that focus on these attack vectors.
Reigning in the changes can pose a difficult problem for several agencies but it ultimately comes down to understanding the threats to your particular agency and narrowing your defenses on those areas. Focus and prioritization become key in the constant battle.
While 2010 turns the page to a new decade, many threats from the past 10 years persist. In the cyber security world, nations such as China continue building cyber capabilities from an offensive and defensive perspective, resulting in what has become a new arms race.
In response to these threats, the Federal government hopes to shore up its defensive capabilities by mandating new FISMA performance metrics that incorporate "real-time" countermeasures—with real-time being the keyword. Real-time denotes the ability to identify, act, and respond to minimize the impact of attacks. This leads to our movement of increasing situational awareness and our ability to detect threats as they occur instead of reacting after the damage has been done. While real-time measures provide many benefits, they also carry a hefty price tag for agencies looking to implement these capabilities. Real-time capabilities can only be implemented through automated technologies and solutions. These technologies carry significant costs further straining the department or agency's already thin cyber security resources.
Government agencies currently possess varying levels of maturity to implement and maintain these capabilities and, in some cases, do not possess these capabilities at all. Although they are absolutely necessary in any "defense-in-depth" strategy, the key question becomes "How much?" and "How fast?" can we implement them. With shrinking budgets and tougher times, it becomes a difficult exercise in prioritizing investments, especially when FISMA may formally capture progress and impact an agency's grades and ultimately, their budget.
It would be impossible to implement these capabilities within a 6-12 month period, at least not effectively. Organizations need to take a risk-based approach to prioritizing initiatives and developing a strategy that allows agencies to prioritize their investments to obtain the greatest return and most importantly the biggest risk reduction to support their missions.