Challenges from all sides beset CISOs

Changing rules, evolving technologies require rapid adjustments.

Government agencies rely on their chief information security officers to stay on top of evolving threats to their information technology systems. But CISOs must balance a variety of needs and requirements to keep their organization’s networks safe. A panel of government CISOs discussed these issues at a recent meeting sponsored by the Armed Forces Communications Electronics Association’s Bethesda, Md., chapter.

Moderated by Jerry Davis, NASA's deputy chief information officer for IT security, the panel examined how CISOs balance their existing mission needs with new and pending rules, managing new technology trends such as real-time data monitoring, and working with the vendor community.

Davis noted that the federal government was going through a period of change as it renewed emphasis on cybersecurity, citing the nearly 40 cyberspace related bills currently under consideration in Congress. Davis added that the role of the CISO continues to evolve, as they increasingly assume greater responsibility and authority in their organizations.

When asked how they balanced their responsibilities with meeting established priorities and complying with new regulations, the panelists offered a range of answers. Patrick Howard, the Nuclear Regulatory Commission’s CISO, said that while he keeps up with his current responsibilities, he also is watching new legislation; he specifically cited a proposed law that would allow CISOs to withhold bonuses to executives and managers who did not meet federal compliance standards.

Related coverage:

Novel cybersecurity approach has plenty of fans—and naysayers

Just how continuous should continuous monitoring be?

The 20 critical security controls your organization should focus on 

Ned Goldberg, CISO at the Federal Deposit Insurance Corporation, noted that the Federal Information Security Management Act has given CISOs a great deal of authority. He said that in the FDIC, prior to FISMA, the CISO would report to a manager five levels below the chief executive officer. After FISMA, the CISO now reports to and advises the top level of management. Regarding new capabilities, Goldberg said he was excited about the possibility for continuous security monitoring and the legislation that is proposing it.

Jaren Doherty, deputy assistant secretary for information protection and risk management at the Veterans Affairs Department, backed Goldberg’s comments, noting that through FISMA, great value is provided through good information security. Noting that VA is the second-largest agency in the federal government, Doherty explained that as a large and complex organization, its security is driven by metrics. Old-style vulnerability reviews took place infrequently and produced results that were already outdated. As a comparison, he said that the agency is now developing systems to monitor the status of all desktops in the organization every 20 minutes.

Doherty said FISMA and the proposed legislation will allow VA to not only provide continuous monitoring of individual desktops but also to focus on parts of the network that come under attack and conduct real time diagnostics.

Regarding providing real-time data, Davis said IT situational awareness was an important concern for organizations. He noted that the three-year certification and accreditation process does not work and explained that organizations must get their capabilities as close to continuous monitoring as possible. However, the need for constant monitoring has changed the risk management paradigm because organizations require very good data to operate in real time.

Goldberg said government agencies must adapt their systems to manage different data feeds. However, he added that organizations are not used to juggling a variety of data streams. Administrators must look for anomalies in this large flow if incoming data, but these streams create too much log information. Organizations use software tools or outside services to locate the most important trends in data flows. Goldberg said that as a small agency with limited resources, the FDIC contracts with Symantec to help analyze its data flows.

NRC is installing real time monitoring technology during the next six to 12 months, Howard said. He explained that organizations must refine their risk measurements according to their business. However, this type of calibration cannot be done unless there is a good picture of the agency’s risk profile because all risks and events are not the same, he said.

Industry must also work closely with CISOs, the group concluded. The panelists agreed that private software firms must be more diligent in installing security features into their products and ensuring their interoperability with other systems. Davis said one of his chief frustrations was buying software tools and then spending years getting them to work with each other. New security products and diagnostic tools must be able to quickly work together to meet real time threats, he maintained.

Davis said vendors must also identify and remove any common vulnerabilities before they market their products to the federal government. He cited the example of sequel injection vulnerability in some software products as an example for the need to prevent common threats.

The Fed 100

Read the profiles of all this year's winners.


  • Then-presidential candidate Donald Trump at a 2016 campaign event. Image: Shutterstock

    'Buy American' order puts procurement in the spotlight

    Some IT contractors are worried that the "buy American" executive order from President Trump could squeeze key innovators out of the market.

  • OMB chief Mick Mulvaney, shown here in as a member of Congress in 2013. (Photo credit Gage Skidmore/Flickr)

    White House taps old policies for new government makeover

    New guidance from OMB advises agencies to use shared services, GWACs and federal schedules for acquisition, and to leverage IT wherever possible in restructuring plans.

  • Shutterstock image (by Everett Historical): aerial of the Pentagon.

    What DOD's next CIO will have to deal with

    It could be months before the Defense Department has a new CIO, and he or she will face a host of organizational and operational challenges from Day One

  • USAF Gen. John Hyten

    General: Cyber Command needs new platform before NSA split

    U.S. Cyber Command should be elevated to a full combatant command as soon as possible, the head of Strategic Command told Congress, but it cannot be separated from the NSA until it has its own cyber platform.

  • Image from Shutterstock.

    DLA goes virtual

    The Defense Logistics Agency is in the midst of an ambitious campaign to eliminate its IT infrastructure and transition to using exclusively shared, hosted and virtual services.

  • Fed 100 logo

    The 2017 Federal 100

    The women and men who make up this year's Fed 100 are proof positive of what one person can make possibile in federal IT. Read on to learn more about each and every winner's accomplishments.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group