Challenges from all sides beset CISOs

Changing rules, evolving technologies require rapid adjustments.

Government agencies rely on their chief information security officers to stay on top of evolving threats to their information technology systems. But CISOs must balance a variety of needs and requirements to keep their organization’s networks safe. A panel of government CISOs discussed these issues at a recent meeting sponsored by the Armed Forces Communications Electronics Association’s Bethesda, Md., chapter.

Moderated by Jerry Davis, NASA's deputy chief information officer for IT security, the panel examined how CISOs balance their existing mission needs with new and pending rules, managing new technology trends such as real-time data monitoring, and working with the vendor community.

Davis noted that the federal government was going through a period of change as it renewed emphasis on cybersecurity, citing the nearly 40 cyberspace related bills currently under consideration in Congress. Davis added that the role of the CISO continues to evolve, as they increasingly assume greater responsibility and authority in their organizations.

When asked how they balanced their responsibilities with meeting established priorities and complying with new regulations, the panelists offered a range of answers. Patrick Howard, the Nuclear Regulatory Commission’s CISO, said that while he keeps up with his current responsibilities, he also is watching new legislation; he specifically cited a proposed law that would allow CISOs to withhold bonuses to executives and managers who did not meet federal compliance standards.

Related coverage:

Novel cybersecurity approach has plenty of fans—and naysayers

Just how continuous should continuous monitoring be?

The 20 critical security controls your organization should focus on 

Ned Goldberg, CISO at the Federal Deposit Insurance Corporation, noted that the Federal Information Security Management Act has given CISOs a great deal of authority. He said that in the FDIC, prior to FISMA, the CISO would report to a manager five levels below the chief executive officer. After FISMA, the CISO now reports to and advises the top level of management. Regarding new capabilities, Goldberg said he was excited about the possibility for continuous security monitoring and the legislation that is proposing it.

Jaren Doherty, deputy assistant secretary for information protection and risk management at the Veterans Affairs Department, backed Goldberg’s comments, noting that through FISMA, great value is provided through good information security. Noting that VA is the second-largest agency in the federal government, Doherty explained that as a large and complex organization, its security is driven by metrics. Old-style vulnerability reviews took place infrequently and produced results that were already outdated. As a comparison, he said that the agency is now developing systems to monitor the status of all desktops in the organization every 20 minutes.

Doherty said FISMA and the proposed legislation will allow VA to not only provide continuous monitoring of individual desktops but also to focus on parts of the network that come under attack and conduct real time diagnostics.

Regarding providing real-time data, Davis said IT situational awareness was an important concern for organizations. He noted that the three-year certification and accreditation process does not work and explained that organizations must get their capabilities as close to continuous monitoring as possible. However, the need for constant monitoring has changed the risk management paradigm because organizations require very good data to operate in real time.

Goldberg said government agencies must adapt their systems to manage different data feeds. However, he added that organizations are not used to juggling a variety of data streams. Administrators must look for anomalies in this large flow if incoming data, but these streams create too much log information. Organizations use software tools or outside services to locate the most important trends in data flows. Goldberg said that as a small agency with limited resources, the FDIC contracts with Symantec to help analyze its data flows.

NRC is installing real time monitoring technology during the next six to 12 months, Howard said. He explained that organizations must refine their risk measurements according to their business. However, this type of calibration cannot be done unless there is a good picture of the agency’s risk profile because all risks and events are not the same, he said.

Industry must also work closely with CISOs, the group concluded. The panelists agreed that private software firms must be more diligent in installing security features into their products and ensuring their interoperability with other systems. Davis said one of his chief frustrations was buying software tools and then spending years getting them to work with each other. New security products and diagnostic tools must be able to quickly work together to meet real time threats, he maintained.

Davis said vendors must also identify and remove any common vulnerabilities before they market their products to the federal government. He cited the example of sequel injection vulnerability in some software products as an example for the need to prevent common threats.

The Fed 100

Save the date for 28th annual Federal 100 Awards Gala.


  • computer network

    How Einstein changes the way government does business

    The Department of Commerce is revising its confidentiality agreement for statistical data survey respondents to reflect the fact that the Department of Homeland Security could see some of that data if it is captured by the Einstein system.

  • Defense Secretary Jim Mattis. Army photo by Monica King. Jan. 26, 2017.

    Mattis mulls consolidation in IT, cyber

    In a Feb. 17 memo, Defense Secretary Jim Mattis told senior leadership to establish teams to look for duplication across the armed services in business operations, including in IT and cybersecurity.

  • Image from

    DHS vague on rules for election aid, say states

    State election officials had more questions than answers after a Department of Homeland Security presentation on the designation of election systems as critical U.S. infrastructure.

  • Org Chart Stock Art - Shutterstock

    How the hiring freeze targets millennials

    The government desperately needs younger talent to replace an aging workforce, and experts say that a freeze on hiring doesn't help.

  • Shutterstock image: healthcare digital interface.

    VA moves ahead with homegrown scheduling IT

    The Department of Veterans Affairs will test an internally developed scheduling module at primary care sites nationwide to see if it's ready to service the entire agency.

  • Shutterstock images (honglouwawa & 0beron): Bitcoin image overlay replaced with a dollar sign on a hardware circuit.

    MGT Act poised for a comeback

    After missing in the last Congress, drafters of a bill to encourage cloud adoption are looking for a new plan.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group