In info sharing, trust counts

Commission studies ideas for next president

Security culprits lurk

The Justice Department, which launched its security operations center in October 2007, has found that continuous monitoring and determining the life cycle of a security incident are critical to information security, said Mischel Kwon, acting deputy director of information technology security at Justice and chief IT security technologist.

Justice received an A-plus on the latest score card for the Federal Information Security Management Act from Rep. Tom Davis (R-Va.), ranking minority member of the Oversight and Government Reform Committee.

“Much of the traffic that has hurt our systems is just usual traffic,” Kwon said. That’s why it’s important to track the Web sites that department employees visit. A brief visit to an unsecure consumer site could allow a virus to infect an agency computer and spread through the internal network, she said.

— Mary Mosquera

Agencies are expected to share information about the security vulnerabilities and attacks they’ve endured, but they’re often reluctant to do so. Randy Vickers, associate deputy director of the U.S. Computer Emergency Readiness Team at the Homeland Security Department, said recently that agencies are often reluctant to reveal the information because they think it reflects negatively on them.

“Unlike policies and technologies, this is the people part, and it is the most difficult,” Vickers said at a May 22 conference sponsored by (ISC)2. A strong convergence of policies, relationships and information sharing would improve the flow of security data among agencies, which would allow them to do more than just wait for attacks, he said.

Building relationships and trust among agencies would also help ensure cybersecurity progress as a new administration takes office, Vickers said. This summer, deadlines for several security policy and technology initiatives will converge to improve agencies’ security environment, including implementation of IPv6, Homeland Security Presidential Directive 12, the Federal Desktop Core Configuration and Trusted Internet Connections initiative, he said.

Technologies and policies can make data and systems more robust so agencies can more easily share information, but they can’t produce the trust, Vickers said. That task falls to agency leaders. Agencies experience similar security problems and should talk to one another about how they handle those daily challenges, he said.

“We’ve got to exchange the business cards upfront so we’re not waiting until the crisis happens to figure out who I need to talk to,” he said. After agencies start sharing information and giving one another feedback, the trust grows with time and experience, as it does in any relationship, he said. After the election, the president-elect will need to be immediately aware of agencies’ security environments.

The Commission on Cybersecurity for the 44th Presidency, made up of 35 private- and public-sector members, plans to produce recommendations to improve security in the next administration, said Jerry Dixon, director of analysis at Team Cymru, a commission member and former director of DHS’ National Cyber Security Division.

“All members have worked a lot with cybersecurity in government, so we have an idea of what works and what doesn’t,” he said. The Center for Strategic and International Studies sponsors the commission.
The level of activity is increasing, and the commission is on track to complete draft recommendations by the end of summer and send a final report to the president-elect in December, Dixon said.The commission aims to make sure that the new administration continues the momentum for more cybersecurity, said Amit Yoran, chief executive officer at NetWitness and former director of DHS’ National Cyber Security Division. “Otherwise, we’ll spend the administration playing catchup,” he said.

Leadership is a critical issue for progressing and creating a security culture, Yoran said. “Unless you have strong, tangible White House backing on the issue, I don’t think other organizations are able to muster the support to make meaningful progress,” he said.

The commission has made no decisions on recommendations, Dixon said, but it is discussing issues such as the merits of establishing:

  • A cyber doctrine to provide a consistent approach for responding to security events.

  • A cybersecurity commission, such as the Federal Communications Commission.

  • An identity authentication regime.

Commission workgroups are also looking at spending and acquisition for cybersecurity, public/private partnerships to make systems and infrastructure more secure, and how security components fit together.

About the Author

Mary Mosquera is a reporter for Federal Computer Week.


  • Telecommunications
    Stock photo ID: 658810513 By asharkyu

    GSA extends EIS deadline to 2023

    Agencies are getting up to three more years on existing telecom contracts before having to shift to the $50 billion Enterprise Infrastructure Solutions vehicle.

  • Workforce
    Shutterstock image ID: 569172169 By Zenzen

    OMB looks to retrain feds to fill cyber needs

    The federal government is taking steps to fill high-demand, skills-gap positions in tech by retraining employees already working within agencies without a cyber or IT background.

  • Acquisition
    GSA Headquarters (Photo by Rena Schild/Shutterstock)

    GSA to consolidate multiple award schedules

    The General Services Administration plans to consolidate dozens of its buying schedules across product areas including IT and services to reduce duplication.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.