Better cybersecurity depends on better information management

Just sharing is not enough

It might sound like heresy, but information sharing is overrated, said Tony Sager of the National Security Agency.

IT security officials already are overloaded with information, Sager said. As chief of the vulnerability analysis and operations group in NSA’s Information Assurance Directorate, which runs Red Team penetration tests, Sager has generated his share of security information over the past 33 years. But that data often contributes little to improving the security of government IT systems, he said Tuesday at the Symantec Government Symposium on IT security in Washington.

“Dumping our inboxes at each other is not going to cut it,” Sager said. “Being at the right meeting is not going to do it. The key to success in IT security is information management.” E-mail exchanges and meeting attendance don't scale, he noted; an agency official can't increase them indefinitely as the demand rises.


Related stories:

A cyber bill worth enacting

NIST updates specs for the latest version of SCAP


Information management means getting the right information into the hands of those who need it. That requires not data dumps, but standards for tools that can analyze data and make it available irrespective of its source; standards such as the Security Content Automation Protocol, jointly developed by the NSA, the National Institute of Standards and Technology and the private sector.

SCAP, a set of protocols for standardizing the way security information is defined and handled, is part of an evolution toward making cybersecurity more strategic and less tactical and reactive, said Ron Ross, senior computer scientist at NIST who spoke with Sager. SCAP compliant products can take information from multiple sources in a variety of formats and make it available to users.

Agencies generally are good at the tactics of cybersecurity, Ross said, but they are not so good at enterprisewide risk management.

“You have to start the risk management process at the top of the organization,” he said, so that tools on the front line can contribute effectively. “We have to get better at governance, first and foremost.”

Sager said he came to his conclusion on the importance of information management after more than 30 years of analyzing vulnerabilities and probing the defenses of Defense Department agencies. He came up with three primary observations.

“The optimal place to solve a security problem is never where you found it,” he said. Red Team exploits can identify a vulnerability in a network or system, but the root cause and ultimate solution lies in better management practices earlier in the system lifecycle.

Secondly, there are few surprises in IT security, Sager said. “If something is happening to you today, something identical or close to it happened to somebody yesterday and will happen to somebody else tomorrow.” But the people who already have the information seldom communicate with those who need it, he said.

Finally, “all the signs you needed to stop a threat or mitigate it were there, but they were not available to the cyber defender.” Too often the warning signals of a security incident appear significant only in hindsight. That is good forensics, but poor security, he said.

The solution is to make better use of existing information to identify vulnerabilities, mitigate threats and manage risks.

Although Sager and Ross are realists who do not believe in a simple solution for cybersecurity, they also are optimistic about the ability of agencies to use evolving technology and techniques to counter escalating threats.

“Our business is evolution,” Ross said. NIST is in the process of harmonizing security guidance across government, developing a single set of standards and controls that both civilian and national defense communities can draw from to establish appropriate levels of security. And the administration’s recent emphasis on continuous monitoring of IT systems is more of an adaptation to newly available tools and more aggressive attacks rather than a shift in strategy, he said.

“We’re getting better at this as we go,” Ross said. But so are the attackers, and agencies cannot expect to achieve complete security. New techniques for agile defense that can raise the costs for attackers and limit the impact of successful attacks can help to maintain effective risk management, he said.

Standardization and interoperability will be a major contributor to this, Sager said. “We can’t afford any more stand-alone tools in our environment,” he said. “We need to start demanding this from vendors.”

About the Author

William Jackson is freelance writer and the author of the CyberEye blog.

The 2015 Federal 100

Meet 100 women and men who are doing great things in federal IT.

Featured

  • Shutterstock image (by venimo): e-learning concept image, digital content and online webinar icons.

    Can MOOCs make the grade for federal training?

    Massive open online courses can offer specialized IT instruction on a flexible schedule and on the cheap. That may not always mesh with government's preference for structure and certification, however.

  • Shutterstock image (by edel): graduation cap and diploma.

    Cybersecurity: 6 schools with the right stuff

    The federal government craves more cybersecurity professionals. These six schools are helping meet that demand.

  • Rick Holgate

    Holgate to depart ATF

    Former ACT president will take a job with Gartner, follow his spouse to Vienna, Austria.

  • Are VA techies slacking off on Yammer?

    A new IG report cites security and productivity concerns associated with employees' use of the popular online collaboration tool.

  • Shutterstock image: digital fingerprint, cyber crime.

    Exclusive: The OPM breach details you haven't seen

    An official timeline of the Office of Personnel Management breach obtained by FCW pinpoints the hackers’ calibrated extraction of data, and the government's step-by-step response.

  • Stephen Warren

    Deputy CIO Warren exits VA

    The onetime acting CIO at Veterans Affairs will be taking over CIO duties at the Office of the Comptroller of the Currency.

  • Shutterstock image: monitoring factors of healthcare.

    DOD awards massive health records contract

    Leidos, Accenture and Cerner pull off an unexpected win of the multi-billion-dollar Defense Healthcare Management System Modernization contract, beating out the presumptive health-records leader.

  • Sweating the OPM data breach -- Illustration by Dragutin Cvijanovic

    Sweating the stolen data

    Millions of background-check records were compromised, OPM now says. Here's the jaw-dropping range of personal data that was exposed.

  • FCW magazine

    Let's talk about Alliant 2

    The General Services Administration is going to great lengths to gather feedback on its IT services GWAC. Will it make for a better acquisition vehicle?

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above