Better cybersecurity depends on better information management

Just sharing is not enough

It might sound like heresy, but information sharing is overrated, said Tony Sager of the National Security Agency.

IT security officials already are overloaded with information, Sager said. As chief of the vulnerability analysis and operations group in NSA’s Information Assurance Directorate, which runs Red Team penetration tests, Sager has generated his share of security information over the past 33 years. But that data often contributes little to improving the security of government IT systems, he said Tuesday at the Symantec Government Symposium on IT security in Washington.

“Dumping our inboxes at each other is not going to cut it,” Sager said. “Being at the right meeting is not going to do it. The key to success in IT security is information management.” E-mail exchanges and meeting attendance don't scale, he noted; an agency official can't increase them indefinitely as the demand rises.


Related stories:

A cyber bill worth enacting

NIST updates specs for the latest version of SCAP


Information management means getting the right information into the hands of those who need it. That requires not data dumps, but standards for tools that can analyze data and make it available irrespective of its source; standards such as the Security Content Automation Protocol, jointly developed by the NSA, the National Institute of Standards and Technology and the private sector.

SCAP, a set of protocols for standardizing the way security information is defined and handled, is part of an evolution toward making cybersecurity more strategic and less tactical and reactive, said Ron Ross, senior computer scientist at NIST who spoke with Sager. SCAP compliant products can take information from multiple sources in a variety of formats and make it available to users.

Agencies generally are good at the tactics of cybersecurity, Ross said, but they are not so good at enterprisewide risk management.

“You have to start the risk management process at the top of the organization,” he said, so that tools on the front line can contribute effectively. “We have to get better at governance, first and foremost.”

Sager said he came to his conclusion on the importance of information management after more than 30 years of analyzing vulnerabilities and probing the defenses of Defense Department agencies. He came up with three primary observations.

“The optimal place to solve a security problem is never where you found it,” he said. Red Team exploits can identify a vulnerability in a network or system, but the root cause and ultimate solution lies in better management practices earlier in the system lifecycle.

Secondly, there are few surprises in IT security, Sager said. “If something is happening to you today, something identical or close to it happened to somebody yesterday and will happen to somebody else tomorrow.” But the people who already have the information seldom communicate with those who need it, he said.

Finally, “all the signs you needed to stop a threat or mitigate it were there, but they were not available to the cyber defender.” Too often the warning signals of a security incident appear significant only in hindsight. That is good forensics, but poor security, he said.

The solution is to make better use of existing information to identify vulnerabilities, mitigate threats and manage risks.

Although Sager and Ross are realists who do not believe in a simple solution for cybersecurity, they also are optimistic about the ability of agencies to use evolving technology and techniques to counter escalating threats.

“Our business is evolution,” Ross said. NIST is in the process of harmonizing security guidance across government, developing a single set of standards and controls that both civilian and national defense communities can draw from to establish appropriate levels of security. And the administration’s recent emphasis on continuous monitoring of IT systems is more of an adaptation to newly available tools and more aggressive attacks rather than a shift in strategy, he said.

“We’re getting better at this as we go,” Ross said. But so are the attackers, and agencies cannot expect to achieve complete security. New techniques for agile defense that can raise the costs for attackers and limit the impact of successful attacks can help to maintain effective risk management, he said.

Standardization and interoperability will be a major contributor to this, Sager said. “We can’t afford any more stand-alone tools in our environment,” he said. “We need to start demanding this from vendors.”

About the Author

William Jackson is a Maryland-based freelance writer.

Featured

  • Contracting
    8 prototypes of the border walls as tweeted by CBP San Diego

    DHS contractors face protests – on the streets

    Tech companies are facing protests internally from workers and externally from activists about doing for government amid controversial policies like "zero tolerance" for illegal immigration.

  • Workforce
    By Mark Van Scyoc Royalty-free stock photo ID: 285175268

    At OPM, Weichert pushes direct hire, pay agent changes

    Margaret Weichert, now acting director of the Office of Personnel Management, is clearing agencies to make direct hires in IT, cyber and other tech fields and is changing pay for specialized occupations.

  • Cloud
    Shutterstock ID ID: 222190471 By wk1003mike

    IBM protests JEDI cloud deal

    As the deadline to submit bids on the Pentagon's $10 billion, 10-year warfighter cloud deal draws near, IBM announced a legal protest.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.