Cybersecurity

Herding the stray cats of federal IT ambitions

concept cybersecurity art

Most government agencies are embracing the benefits of cloud computing, a mobile workforce and cybersecurity measures to protect critical networks and assets. But in many cases it has been a struggle just to get to that point, and hurdles remain as different approaches present a fragmented federal IT security picture.

Some help in federating the ways government agencies implement security practices will emerge in the forthcoming final version of the National Institute of Standards and Technology’s cybersecurity framework, due next month. But some experts are advising additional measures to help the government get to a comprehensive management plan for IT security.

A new SafeGov.org report advocates a more integrated approach that moves away from compliance-based security and toward a risk-management paradigm that coordinates cross-government efforts.

“There are a lot of initiatives that agencies are responsible for, which the paper tries to highlight – cloud first, data center consolidation, continuous diagnostics and mitigation, mobility management, a whole bunch of things agencies are responsible for,” said report co-author Karen Evans, national director for the U.S. Cyber Challenge. “One major theme in our recommendations is taking a look at that and building out the architecture in order to ensure [success]. If you’re looking at these initiatives separately and try to implement them separately without looking at the integrated picture, it’s going to defeat the purposes of them.”

The first recommendation in the report calls on the Information Security and Identity Management Committee (ISIMC), part of the Federal CIO Council, to take on a leadership role by adopting and issuing integrated network architecture. It also asks the ISIMC to establish FISMA-friendly implementation plans with milestones to help agencies transition to the proposed architecture.

“Right now there’s no overarching document saying, ‘this is how all these things can potentially work together,’” Evans said. “The pool of knowledge at the Federal CIO Council can help create the documents to lay out a specific roadmap that agencies can develop and be held accountable for.”

A second recommendation targets FedRAMP, calling on the Joint Authorization Board to require cloud service providers contracting with the government to “employ penetration testing capabilities in the implemented operational environment in order to surveil, analyze and respond to threats in real-time.”

This is especially important as FedRAMP deadlines approach, Evans noted.

“Right now everyone is scrambling, what does it mean?’ This architecture would help identify [security] gaps and how to get there – ‘here’s where I am and here’s where the gap is to get to my outcome, and here’s my plan to close that gap,’” she said.

Under the recommendations, the Joint Authorization Board’s current role in governing FedRAMP and certifying cloud providers for the General Services Administration would be reinforced and broadened, ensuring that providers and their services meet requirements and policies for other agencies as well.

“The nice thing about that is it’s a proven model,” said Julie Anderson, another co-author of the report and managing director of Civitas Group. “We’re not proposing something new; we’re proposing integration of processes and how FedRAMP can be integrated into requirements and expectations.”

The report additionally calls on the Office of Management and Budget and Homeland Security Department to jointly establish metrics that inspectors general can use to measure agencies’ cybersecurity risk and program effectiveness.

“There are so many initiatives, all with good intentions – we’re trying to weave that together into an integrated approach so agencies can look at all of the policies and directives and have an understanding of what they need to do next to meet requirements,” Anderson said.

About the Author

Amber Corrin is a former staff writer for FCW and Defense Systems.

Featured

  • Cybersecurity

    DHS floats 'collective defense' model for cybersecurity

    Homeland Security Secretary Kirstjen Nielsen wants her department to have a more direct role in defending the private sector and critical infrastructure entities from cyberthreats.

  • Defense
    Defense Secretary James Mattis testifies at an April 12 hearing of the House Armed Services Committee.

    Mattis: Cloud deal not tailored for Amazon

    On Capitol Hill, Defense Secretary Jim Mattis sought to quell "rumors" that the Pentagon's planned single-award cloud acquisition was designed with Amazon Web Services in mind.

  • Census
    shutterstock image

    2020 Census to include citizenship question

    The Department of Commerce is breaking with recent practice and restoring a question about respondent citizenship last used in 1950, despite being urged not to by former Census directors and outside experts.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.