Obama's Cybersecurity Push: What It Means for CIOs
President Obama aims to fix U.S. cybersecurity, but can the feds hit a moving target? Not without private sector support and practical solutions.
>
Within each of the 20 controls is an explanation of how attackers can exploit the area and steps you can take to prevent that, ranging from quick-win, simple tasks to advanced methods.
The U.S. Department of State has been testing the guidelines for several months. John Streufert, State's chief information security officer and the deputy CIO for information security, has mapped real security attacks that he has recently experienced to Gilligan's controls to determine whether, if a given recommendation had been in place, it would have had any effect. No private-sector companies have tested the guidelines, Gilligan says, but he is talking with several federal CIOs about doing so. The Nuclear Regulatory Commission is also piloting the guidelines.
Malware is one problem lately at State, Streufert says. Control number 12—malware defenses—calls for such tasks as checking machines daily for updated malware protections and pushing out updates every day. IT should also configure machines to scan removable devices for malware upon insertion into a laptop or PC. Also suggested is taking a firm stand: deploying network access control tools to verify security configurations and patch compliance before granting network access.
State also ran scans for unauthorized hardware and software on its networks, which are controls number one and number two. Streufert is reluctant to say how much malware or how many unauthorized devices he found, or estimate the cost of the problem. But by using Gilligan's 20 techniques, and regularly measuring and improving how the State Department staff proactively manages security, State has reduced the internal risk scores it gives itself in several critical areas by 83 percent over 11 months, Streufert says.
An End to Checklist Security
Existing federal IT security regulations—namely the Federal Information Security Management Act, or FISMA—often mandate hundreds of items to check off on a list, including such basics as password protection for sensitive applications. But FISMA doesn't guide IT managers about what kind of password works best (the Consensus Audit Guidelines call for 12 semirandom characters and two-factor authentication).
"You end up filling out long forms showing you comply but you're not necessarily secure," says Schultz of Emagined Security. He tells the story of a national laboratory that didn't have firewalls protecting its network, as mandated. But the lab passed the audit by convincing the auditor that routers were a worthy substitute, Schultz says.
"FISMA is a waste of taxpayer money," he says. "These are not standards that help an organization stand up to the kinds of attacks that occur nowadays."
Security
Receive the latest security news as it breaks.
