Every week, billions of cyber-events batter government networks. Millions of these attacks hit at network speed, and thousands succeed, as reported by the Homeland Security Department's US Computer Emergency Readiness Team. The US Navy alone was attacked almost 1 billion times in 2012. Although security analysts strain to counter these breaches, mostly with manual processes, it's likely terabytes of data are stolen.
Given this dynamic landscape, you might think federal CIOs are getting more resources to defend against mounting cyberthreats. They're not. Money and security expertise are in short supply, meaning agencies need to innovate. First and foremost, they can no longer take a piecemeal approach to information security. A holistic strategy that incorporates real-time risk management and continuous monitoring is the only way to go.
To help agencies build these more-resilient systems, the National Institute of Standards and Technology, in collaboration with the Defense and Homeland Security departments and private sector intelligence communities, has come up with security controls that focus on mobile and cloud computing, application security, the insider threat, supply chain security, and advanced persistent threats. NIST lays out these controls in its Special Publication 800-53 Revision 4. Released earlier this year, Rev 4 represents the most comprehensive update to this publication since the document's inception in 2005.
Most federal employees understand the urgency. They see the fallout from attacks, such as the recent Department of Veterans Affairs breach that exposed thousands of veterans' personally identifiable information via a software glitch. They hear that Chinese hackers penetrated the databases of the federal government's Office of Personnel Management, which contains files on all federal employees, including those who have applied for top-secret clearances.
[Windows for federal employees just got easier. Read 'Windows To Go' Device Wins Federal Cryptographic Certification.]
So it comes as no surprise that more than half of the respondents to InformationWeek's 2014 Federal Government IT Priorities Survey say cybersecurity/security is the top priority in their agencies. Seventy percent rate security as "extremely important," with another 16% viewing cyber-security/security as "very important."
Federal managers want to know "how to stop the bleeding," says Ronald Ross, project leader of NIST's FISMA Implementation Project and Joint Task Force Transformation Initiative. You can't stop all attacks or build the perfect defense system. The higher-level objective is resilience. "What does it mean to have an adequate degree of resilience in a modern information system that supports critical missions?" Ross asks, in a question that's neither rhetorical nor unique to federal agencies. State and local governments as well as private sector companies are struggling, too -- anyone with valuable information and using very complex high-end technology is subject to the same types of threats.
Resiliency means "becoming healthy after something bad happens," says Bret Hartman, VP and CTO of Cisco's security business group. "That is a good way to think of security because it's impossible to stay healthy all the time." Agencies should consider the attack continuum and which technologies they need in place before an attack occurs, during an attack, and after the attack to do systems remediation. This last area is still maturing and is where the biggest challenge lies today, Hartman says.
Time for better cyber "hygiene"
To address resiliency in federal government, NIST and its partner agencies are focusing on two tracks: improving "cyber hygiene," and designing IT system architectures that can bounce back from damage and contain attacks. A good way to view cyber-security, says Ross, is to have a way to address areas "above the water line," such as known patching and maintenance, and those below the water line -- problems you can't see that could cause trouble and inflict serious damage without warning.
Cyber hygiene focuses on tasks that security administrators deal with daily, such as promptly updating operating systems and applications with the latest security patches or making sure all operating systems and network devices are configured properly to close down attack vectors that could be exploited. IT must also assemble and maintain a complete inventory of everything on the agency's network and the information it has to protect.
With NIST 800-53 R4, the government is starting to address security below the water level, too. Specifically, we're talking about contingency-planning types of controls, which allow agencies to define alternate processing capabilities, storage sites, and communications plans in case of a natural disaster, like a hurricane, or a cyber-attack. "We have contingency plans in place and run those exercises as frequently as we need to, so when the event happens, we can move smoothly into that backup scenario," Ross says.
new issue of InformationWeek Government Tech Digest
(free registration required).