5 Ways Federal CIOs Plan to Improve Security Monitoring

WASHINGTON – As the federal government gradually moves to an always-on, cloud-centric IT operation, senior technology officials work to ensure that agencies’ security posture can keep pace.

The feds broadly have been trying to move beyond the days when security was a check-box, compliance-centered activity, and into an era of real-time monitoring of networks and systems.

The Department of Homeland Security and General Services Administration are formalizing that approach through the Continuous Diagnostics and Mitigation Program, or CDM. Under that initiative, which is in the midst of a multi-stage rollout, the feds look to incorporate off-the-shelf commercial security tools that will extend sensors throughout their networks, automate the search for flaws, prioritize threats by severity, and relay information back to dashboards to improve situational awareness for security workers and enterprise leaders.

That multi-view system of dashboards – where permissions can be set to limit access to a worker’s particular area of the network – comes as an acknowledgement that the agency networks are too complex and far-flung to run security operations strictly from headquarters, according to John Streufert, director of federal network resilience at DHS.

[ Analysis: Plans to Centralize Cybersecurity with DHS Seen as Step Forward ]

“Though the CIO and [CISO] have sort a perch seat to look at the security happening in the department, the actual circumstances are that security is often performed by decentralized teams,” Streufert says. “Our first recommendation on people and processes is to identify and establish your agency’s continuous diagnostics and mitigation team.”

Streufert, speaking at a government IT forum on Wednesday, also offered several additional tips for agencies to consider when implementing their own CDM programs to secure the buy-in of both security and business workers and to evaluate the success of the initiative.

Standardize Risk Scoring

Like any new and ambitious government program – particularly in a vital area like security – CDM programs need to roll out with a strong measure of accountability, Streufert says. He suggests that CIOs and CISOs adopt a uniform method of grading security vulnerabilities that would apply throughout the organization, from one bureau or business unit to the next.

“Create a standard risk scoring approach across the enterprise,” he says. “Do this for reasons of establishing apples-to-apples comparisons among the operating units within a cabinet department.”

In turn, the federal CIO Council is considering an effort that could set government-wide standards, extending that “apples-to-apples” framework to provide for meaningful comparisons from one department to another, Streufert says.

Secure Business Buy-In, Permissions

In a pilot project at the State Department, Streufert discovered that the CDM program can be considerably more effective if the business units of an organization are involved.

In that program, Streufert recalls, the decision was made to “send the grade reports simultaneously both to the technical leads [who] are responsible for security of operations and the business managers who will be impacted if security breaches stop their activity.”

As a result, leaders in the various units of the department could see the measure of the vulnerabilities associated with a system vital to their work, taking some of the abstraction out security and helping bring together business and IT personnel.

[ Also: Federal CIOs Moving Cybersecurity Beyond Compliance ]

“To deliver up that grade report simultaneously is one of the single strongest benefits to have risk-focused attention to challenges across the enterprise,” Streufert says.

At the same time, even if the reporting goes to a broader audience than just the security staff, Streufert urges due caution in setting the permission levels for the dashboard. “You need to decide who’s going to have access to the dashboard and embedded security related to it.”

Use Grade-book Tricks

The ultimate goal of CDM is to improve the security posture of the federal government, walling off sensitive data and critical systems from would-be hackers. It’s hard to argue with that vision.

As with any large-scale change in the government, however, there are cultural challenges and ways to manage the transition that can either encourage or discourage buy-in from the staff.

[ Related: Government IT’s Move to Cloud Slowed by Security Concerns, Misconceptions ]

To that end, Streufert observes that the rating system used to evaluate agencies’ progress in implementing CDM can be a powerful tool. For instance, he suggests that the grading programs calibrate their scores to the greatest risks to encourage patching outdated systems. Each workstation that ran an outdated version of Internet Explorer might be tagged with 100 “risk points” each month, for example.

As points accumulate, they could weigh down an organization’s grade, Streufert says, “to the point that the performance of the entire organization was at risk and brought to the attention of both the business leads and the technical leads for correction.”

Offer a Grace Period

Streufert also advises that CIOs take their CDM systems on a trial run before setting them up as the main driver of their security operations. He suggests they set aside six months for a “grace period” following the connection of the sensors to the dashboard.

Streufert explains that that can “allow the LAN administrators and security officers to ensure they have ownership of every device on the network and begin working with the sensors in a way to reduce false positives where problems may or may not be occurring.”

Implement Daily Monitoring

A central vision of the CDM program is the ongoing, real-time monitoring “at network speed” that can give the government a more flexible and resilient risk posture. However, that means agencies must be diligent about analyzing the threat information retrieved by the network sensors.

[ News: Splunk Digs Deeper With Stream App for Network Monitoring ]

“The entire discipline encourages that we are assessing our risk on a more continuous basis,” Streufert says, invoking the government maxim, “What gets watched, gets worked.”

It’s important, he adds, “that we shift toward attention not to security problems once every three years or in the annual report to Congress, but do this on a daily basis.”