Better cybersecurity depends on better information management

Just sharing is not enough

It might sound like heresy, but information sharing is overrated, said Tony Sager of the National Security Agency.

IT security officials already are overloaded with information, Sager said. As chief of the vulnerability analysis and operations group in NSA’s Information Assurance Directorate, which runs Red Team penetration tests, Sager has generated his share of security information over the past 33 years. But that data often contributes little to improving the security of government IT systems, he said Tuesday at the Symantec Government Symposium on IT security in Washington.

“Dumping our inboxes at each other is not going to cut it,” Sager said. “Being at the right meeting is not going to do it. The key to success in IT security is information management.” E-mail exchanges and meeting attendance don't scale, he noted; an agency official can't increase them indefinitely as the demand rises.


Related stories:

A cyber bill worth enacting

NIST updates specs for the latest version of SCAP


Information management means getting the right information into the hands of those who need it. That requires not data dumps, but standards for tools that can analyze data and make it available irrespective of its source; standards such as the Security Content Automation Protocol, jointly developed by the NSA, the National Institute of Standards and Technology and the private sector.

SCAP, a set of protocols for standardizing the way security information is defined and handled, is part of an evolution toward making cybersecurity more strategic and less tactical and reactive, said Ron Ross, senior computer scientist at NIST who spoke with Sager. SCAP compliant products can take information from multiple sources in a variety of formats and make it available to users.

Agencies generally are good at the tactics of cybersecurity, Ross said, but they are not so good at enterprisewide risk management.

“You have to start the risk management process at the top of the organization,” he said, so that tools on the front line can contribute effectively. “We have to get better at governance, first and foremost.”

Sager said he came to his conclusion on the importance of information management after more than 30 years of analyzing vulnerabilities and probing the defenses of Defense Department agencies. He came up with three primary observations.

“The optimal place to solve a security problem is never where you found it,” he said. Red Team exploits can identify a vulnerability in a network or system, but the root cause and ultimate solution lies in better management practices earlier in the system lifecycle.

Secondly, there are few surprises in IT security, Sager said. “If something is happening to you today, something identical or close to it happened to somebody yesterday and will happen to somebody else tomorrow.” But the people who already have the information seldom communicate with those who need it, he said.

Finally, “all the signs you needed to stop a threat or mitigate it were there, but they were not available to the cyber defender.” Too often the warning signals of a security incident appear significant only in hindsight. That is good forensics, but poor security, he said.

The solution is to make better use of existing information to identify vulnerabilities, mitigate threats and manage risks.

Although Sager and Ross are realists who do not believe in a simple solution for cybersecurity, they also are optimistic about the ability of agencies to use evolving technology and techniques to counter escalating threats.

“Our business is evolution,” Ross said. NIST is in the process of harmonizing security guidance across government, developing a single set of standards and controls that both civilian and national defense communities can draw from to establish appropriate levels of security. And the administration’s recent emphasis on continuous monitoring of IT systems is more of an adaptation to newly available tools and more aggressive attacks rather than a shift in strategy, he said.

“We’re getting better at this as we go,” Ross said. But so are the attackers, and agencies cannot expect to achieve complete security. New techniques for agile defense that can raise the costs for attackers and limit the impact of successful attacks can help to maintain effective risk management, he said.

Standardization and interoperability will be a major contributor to this, Sager said. “We can’t afford any more stand-alone tools in our environment,” he said. “We need to start demanding this from vendors.”

About the Author

William Jackson is a Maryland-based freelance writer.

Featured

  • Cybersecurity

    DHS floats 'collective defense' model for cybersecurity

    Homeland Security Secretary Kirstjen Nielsen wants her department to have a more direct role in defending the private sector and critical infrastructure entities from cyberthreats.

  • Defense
    Defense Secretary James Mattis testifies at an April 12 hearing of the House Armed Services Committee.

    Mattis: Cloud deal not tailored for Amazon

    On Capitol Hill, Defense Secretary Jim Mattis sought to quell "rumors" that the Pentagon's planned single-award cloud acquisition was designed with Amazon Web Services in mind.

  • Census
    shutterstock image

    2020 Census to include citizenship question

    The Department of Commerce is breaking with recent practice and restoring a question about respondent citizenship last used in 1950, despite being urged not to by former Census directors and outside experts.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.