Cybersecurity

Cybersecurity isn't just about money, OPM adviser says

Shutterstock image (by MaximP): network defense.

Cybersecurity might actually come relatively cheap.

Clifton Triplett, the special outside-of-government senior adviser hired in November by the Office of Personnel Management, made the case for using what agencies already have instead of buying new tools.

"I get a little bit frustrated that we're constantly striving for more money," Triplett said at a Bloomberg Government event on Dec. 14. "We have to get past, 'Cyber is more expensive.'"

Agencies could get a lot of bang for very few bucks just by changing behaviors -- for example, internal culture and access management -- and making better use of the tools they already have, he said.

Triplett was hired to advise Acting OPM Director Beth Cobert on cybersecurity in the wake of the massive breach that resulted in the theft of databases containing records on more than 22 million government workers, contractors and individuals included as references or sources in background checks.

"I just get concerned that we think buying a technology's a silver bullet," he said. "We have a lot of stuff already."

One place where there is a need for purchasing: modernization of antiquated legacy systems. But don't file those costs under the "cybersecurity" tab.

"That will cause harm," Triplett said, adding that modernizing legacy systems will streamline business processes, improve customer experiences and enhance government in myriad ways.

His argument that cybersecurity does not have to be expensive stands apart from modernization that needs to be happening anyway, he added.

Triplett touted the merits of two-factor authentication, keeping critical systems off the Internet and sharing information, noting that the private and public sectors must be willing to "share on suspicion, not fact" of compromises. That willingness has been tough to come by, he said, because companies fear that telling the government about a suspected breach could undermine the public's trust.

When asked about good cybersecurity metrics, Triplett said, "I often see metrics driving bad behaviors." If, say, "mean time to resolution" is a preferred metric, people might try to game it by delaying the reporting of an incident, which would ultimately damage the whole enterprise.

He also stressed that although cybersecurity does not have to be expensive, it is a never-ending battle.

"Our goal should not be zero" cybersecurity incidents reported, Triplett said. "It should be to find them at a more refined level every year."

About the Author

Zach Noble is a former FCW staff writer.

Featured

  • Comment
    Pilot Class. The author and Barbie Flowers are first row third and second from right, respectively.

    How VA is disrupting tech delivery

    A former Digital Service specialist at the Department of Veterans Affairs explains efforts to transition government from a legacy "project" approach to a more user-centered "product" method.

  • Cloud
    cloud migration

    DHS cloud push comes with complications

    A pressing data center closure schedule and an ensuing scramble to move applications means that some Homeland Security components might need more than one hop to get to the cloud.

  • Comment
    Blue Signage and logo of the U.S. Department of Veterans Affairs

    Doing digital differently at VA

    The Department of Veterans Affairs CIO explains why digital transformation is not optional.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.