In info sharing, trust counts

Commission studies ideas for next president

Security culprits lurk

The Justice Department, which launched its security operations center in October 2007, has found that continuous monitoring and determining the life cycle of a security incident are critical to information security, said Mischel Kwon, acting deputy director of information technology security at Justice and chief IT security technologist.

Justice received an A-plus on the latest score card for the Federal Information Security Management Act from Rep. Tom Davis (R-Va.), ranking minority member of the Oversight and Government Reform Committee.

“Much of the traffic that has hurt our systems is just usual traffic,” Kwon said. That’s why it’s important to track the Web sites that department employees visit. A brief visit to an unsecure consumer site could allow a virus to infect an agency computer and spread through the internal network, she said.

— Mary Mosquera

Agencies are expected to share information about the security vulnerabilities and attacks they’ve endured, but they’re often reluctant to do so. Randy Vickers, associate deputy director of the U.S. Computer Emergency Readiness Team at the Homeland Security Department, said recently that agencies are often reluctant to reveal the information because they think it reflects negatively on them.

“Unlike policies and technologies, this is the people part, and it is the most difficult,” Vickers said at a May 22 conference sponsored by (ISC)2. A strong convergence of policies, relationships and information sharing would improve the flow of security data among agencies, which would allow them to do more than just wait for attacks, he said.

Building relationships and trust among agencies would also help ensure cybersecurity progress as a new administration takes office, Vickers said. This summer, deadlines for several security policy and technology initiatives will converge to improve agencies’ security environment, including implementation of IPv6, Homeland Security Presidential Directive 12, the Federal Desktop Core Configuration and Trusted Internet Connections initiative, he said.

Technologies and policies can make data and systems more robust so agencies can more easily share information, but they can’t produce the trust, Vickers said. That task falls to agency leaders. Agencies experience similar security problems and should talk to one another about how they handle those daily challenges, he said.

“We’ve got to exchange the business cards upfront so we’re not waiting until the crisis happens to figure out who I need to talk to,” he said. After agencies start sharing information and giving one another feedback, the trust grows with time and experience, as it does in any relationship, he said. After the election, the president-elect will need to be immediately aware of agencies’ security environments.

The Commission on Cybersecurity for the 44th Presidency, made up of 35 private- and public-sector members, plans to produce recommendations to improve security in the next administration, said Jerry Dixon, director of analysis at Team Cymru, a commission member and former director of DHS’ National Cyber Security Division.

“All members have worked a lot with cybersecurity in government, so we have an idea of what works and what doesn’t,” he said. The Center for Strategic and International Studies sponsors the commission.
The level of activity is increasing, and the commission is on track to complete draft recommendations by the end of summer and send a final report to the president-elect in December, Dixon said.The commission aims to make sure that the new administration continues the momentum for more cybersecurity, said Amit Yoran, chief executive officer at NetWitness and former director of DHS’ National Cyber Security Division. “Otherwise, we’ll spend the administration playing catchup,” he said.

Leadership is a critical issue for progressing and creating a security culture, Yoran said. “Unless you have strong, tangible White House backing on the issue, I don’t think other organizations are able to muster the support to make meaningful progress,” he said.

The commission has made no decisions on recommendations, Dixon said, but it is discussing issues such as the merits of establishing:


  • A cyber doctrine to provide a consistent approach for responding to security events.

  • A cybersecurity commission, such as the Federal Communications Commission.

  • An identity authentication regime.


Commission workgroups are also looking at spending and acquisition for cybersecurity, public/private partnerships to make systems and infrastructure more secure, and how security components fit together.

About the Author

Mary Mosquera is a reporter for Federal Computer Week.

The Fed 100

Save the date for 28th annual Federal 100 Awards Gala.

Featured

  • computer network

    How Einstein changes the way government does business

    The Department of Commerce is revising its confidentiality agreement for statistical data survey respondents to reflect the fact that the Department of Homeland Security could see some of that data if it is captured by the Einstein system.

  • Defense Secretary Jim Mattis. Army photo by Monica King. Jan. 26, 2017.

    Mattis mulls consolidation in IT, cyber

    In a Feb. 17 memo, Defense Secretary Jim Mattis told senior leadership to establish teams to look for duplication across the armed services in business operations, including in IT and cybersecurity.

  • Image from Shutterstock.com

    DHS vague on rules for election aid, say states

    State election officials had more questions than answers after a Department of Homeland Security presentation on the designation of election systems as critical U.S. infrastructure.

  • Org Chart Stock Art - Shutterstock

    How the hiring freeze targets millennials

    The government desperately needs younger talent to replace an aging workforce, and experts say that a freeze on hiring doesn't help.

  • Shutterstock image: healthcare digital interface.

    VA moves ahead with homegrown scheduling IT

    The Department of Veterans Affairs will test an internally developed scheduling module at primary care sites nationwide to see if it's ready to service the entire agency.

  • Shutterstock images (honglouwawa & 0beron): Bitcoin image overlay replaced with a dollar sign on a hardware circuit.

    MGT Act poised for a comeback

    After missing in the last Congress, drafters of a bill to encourage cloud adoption are looking for a new plan.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group