Better cybersecurity depends on better information management

Just sharing is not enough

It might sound like heresy, but information sharing is overrated, said Tony Sager of the National Security Agency.

IT security officials already are overloaded with information, Sager said. As chief of the vulnerability analysis and operations group in NSA’s Information Assurance Directorate, which runs Red Team penetration tests, Sager has generated his share of security information over the past 33 years. But that data often contributes little to improving the security of government IT systems, he said Tuesday at the Symantec Government Symposium on IT security in Washington.

“Dumping our inboxes at each other is not going to cut it,” Sager said. “Being at the right meeting is not going to do it. The key to success in IT security is information management.” E-mail exchanges and meeting attendance don't scale, he noted; an agency official can't increase them indefinitely as the demand rises.


Related stories:

A cyber bill worth enacting

NIST updates specs for the latest version of SCAP


Information management means getting the right information into the hands of those who need it. That requires not data dumps, but standards for tools that can analyze data and make it available irrespective of its source; standards such as the Security Content Automation Protocol, jointly developed by the NSA, the National Institute of Standards and Technology and the private sector.

SCAP, a set of protocols for standardizing the way security information is defined and handled, is part of an evolution toward making cybersecurity more strategic and less tactical and reactive, said Ron Ross, senior computer scientist at NIST who spoke with Sager. SCAP compliant products can take information from multiple sources in a variety of formats and make it available to users.

Agencies generally are good at the tactics of cybersecurity, Ross said, but they are not so good at enterprisewide risk management.

“You have to start the risk management process at the top of the organization,” he said, so that tools on the front line can contribute effectively. “We have to get better at governance, first and foremost.”

Sager said he came to his conclusion on the importance of information management after more than 30 years of analyzing vulnerabilities and probing the defenses of Defense Department agencies. He came up with three primary observations.

“The optimal place to solve a security problem is never where you found it,” he said. Red Team exploits can identify a vulnerability in a network or system, but the root cause and ultimate solution lies in better management practices earlier in the system lifecycle.

Secondly, there are few surprises in IT security, Sager said. “If something is happening to you today, something identical or close to it happened to somebody yesterday and will happen to somebody else tomorrow.” But the people who already have the information seldom communicate with those who need it, he said.

Finally, “all the signs you needed to stop a threat or mitigate it were there, but they were not available to the cyber defender.” Too often the warning signals of a security incident appear significant only in hindsight. That is good forensics, but poor security, he said.

The solution is to make better use of existing information to identify vulnerabilities, mitigate threats and manage risks.

Although Sager and Ross are realists who do not believe in a simple solution for cybersecurity, they also are optimistic about the ability of agencies to use evolving technology and techniques to counter escalating threats.

“Our business is evolution,” Ross said. NIST is in the process of harmonizing security guidance across government, developing a single set of standards and controls that both civilian and national defense communities can draw from to establish appropriate levels of security. And the administration’s recent emphasis on continuous monitoring of IT systems is more of an adaptation to newly available tools and more aggressive attacks rather than a shift in strategy, he said.

“We’re getting better at this as we go,” Ross said. But so are the attackers, and agencies cannot expect to achieve complete security. New techniques for agile defense that can raise the costs for attackers and limit the impact of successful attacks can help to maintain effective risk management, he said.

Standardization and interoperability will be a major contributor to this, Sager said. “We can’t afford any more stand-alone tools in our environment,” he said. “We need to start demanding this from vendors.”

About the Author

William Jackson is a Maryland-based freelance writer.

FCW in Print

In the latest issue: Looking back on three decades of big stories in federal IT.

Featured

  • Anne Rung -- Commerce Department Photo

    Exit interview with Anne Rung

    The government's departing top acquisition official said she leaves behind a solid foundation on which to build more effective and efficient federal IT.

  • Charles Phalen

    Administration appoints first head of NBIB

    The National Background Investigations Bureau announced the appointment of its first director as the agency prepares to take over processing government background checks.

  • Sen. James Lankford (R-Okla.)

    Senator: Rigid hiring process pushes millennials from federal work

    Sen. James Lankford (R-Okla.) said agencies are missing out on younger workers because of the government's rigidity, particularly its protracted hiring process.

  • FCW @ 30 GPS

    FCW @ 30

    Since 1987, FCW has covered it all -- the major contracts, the disruptive technologies, the picayune scandals and the many, many people who make federal IT function. Here's a look back at six of the most significant stories.

  • Shutterstock image.

    A 'minibus' appropriations package could be in the cards

    A short-term funding bill is expected by Sept. 30 to keep the federal government operating through early December, but after that the options get more complicated.

  • Defense Secretary Ash Carter speaks at the TechCrunch Disrupt conference in San Francisco

    DOD launches new tech hub in Austin

    The DOD is opening a new Defense Innovation Unit Experimental office in Austin, Texas, while Congress debates legislation that could defund DIUx.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group