Government Hiring Practices Hamper Cybersecurity Efforts

Federal agencies find it difficult to hire unconventional but well-qualified talent to battle cyberattacks, experts say.

by former NSA contractor Edward Snowden is the harm done to agencies' ability to hire "non-standard" people, who may not have college degrees but who have superior computer skills.

And, of course, there's the pay issue. David Bray, CIO of the Federal Communications Commission, said that when he's trying to recruit someone in IT, he tells them, "We can't pay what the private sector does," but that they will have a compelling mission they can find fulfilling.

Bray said his agency is using its ambassadors program, which brings in contractors from outside Washington, D.C., for a maximum of 120 days, to get new perspectives and fresh ideas. He suggested that perhaps the government could have a "reserve corps" of cybersecurity professionals, former ambassadors who have returned to the private sector, on call for cyber emergencies.

Robert Childs, former chancellor of the National Defense University's Information Resources Management College, said that Singapore could be a model for US practices. Children "learn cyber hygiene in elementary schools," he said. Here, though, "children, Millennials, don't care about cyber... the young people have the skills," but not the knowledge of sound policy and governance.

Bucci added that just getting employees to follow the cybersecurity policies already on the books would help -- and that has to include the bosses.

"If the boss isn't doing it, no one else will," he said.

Wilshusen said many federal agency leaders are starting to understand the importance of recruiting better talent. "The incidents reported to US-CERT have more than doubled in the past four years." But it's going to take more than just agency leaders recognizing the problem.

Childs pointed to previous cyberattacks, including when attackers shut down much of Estonia's electronic infrastructure in 2007 and another on the Saudi national oil company Aramco in 2012, as acts of cyber warfare. The war between Russia and Georgia in 2008 was the first demonstration of "cyber (attacks) combined with kinetic attacks," he said.

Bucci said the US military comes closest to understanding and preparing for these kinds of orchestrated attacks. "But in a [military] exercise, add the cyber component and the exercise comes crashing to a halt within a couple of hours," he said. The leaders of the exercise will usually insist on shutting down the cyber component so they can continue, even though they won't be able to do that on a real battlefield, he said.

NIST's cyber-security framework gives critical-infrastructure operators a new tool to assess readiness. But will operators put this voluntary framework to work? Read the Protecting Critical Infrastructure issue of InformationWeek Government today.

Editor's Choice
Samuel Greengard, Contributing Reporter
Cynthia Harvey, Freelance Journalist, InformationWeek
Carrie Pallardy, Contributing Reporter
John Edwards, Technology Journalist & Author
Astrid Gobardhan, Data Privacy Officer, VFS Global
Sara Peters, Editor-in-Chief, InformationWeek / Network Computing