Cybersecurity

Cybersecurity isn't just about money, OPM adviser says

Shutterstock image (by MaximP): network defense.

Cybersecurity might actually come relatively cheap.

Clifton Triplett, the special outside-of-government senior adviser hired in November by the Office of Personnel Management, made the case for using what agencies already have instead of buying new tools.

"I get a little bit frustrated that we're constantly striving for more money," Triplett said at a Bloomberg Government event on Dec. 14. "We have to get past, 'Cyber is more expensive.'"

Agencies could get a lot of bang for very few bucks just by changing behaviors -- for example, internal culture and access management -- and making better use of the tools they already have, he said.

Triplett was hired to advise Acting OPM Director Beth Cobert on cybersecurity in the wake of the massive breach that resulted in the theft of databases containing records on more than 22 million government workers, contractors and individuals included as references or sources in background checks.

"I just get concerned that we think buying a technology's a silver bullet," he said. "We have a lot of stuff already."

One place where there is a need for purchasing: modernization of antiquated legacy systems. But don't file those costs under the "cybersecurity" tab.

"That will cause harm," Triplett said, adding that modernizing legacy systems will streamline business processes, improve customer experiences and enhance government in myriad ways.

His argument that cybersecurity does not have to be expensive stands apart from modernization that needs to be happening anyway, he added.

Triplett touted the merits of two-factor authentication, keeping critical systems off the Internet and sharing information, noting that the private and public sectors must be willing to "share on suspicion, not fact" of compromises. That willingness has been tough to come by, he said, because companies fear that telling the government about a suspected breach could undermine the public's trust.

When asked about good cybersecurity metrics, Triplett said, "I often see metrics driving bad behaviors." If, say, "mean time to resolution" is a preferred metric, people might try to game it by delaying the reporting of an incident, which would ultimately damage the whole enterprise.

He also stressed that although cybersecurity does not have to be expensive, it is a never-ending battle.

"Our goal should not be zero" cybersecurity incidents reported, Triplett said. "It should be to find them at a more refined level every year."

About the Author

Zach Noble is a former FCW staff writer.

Featured

  • Cybersecurity
    Boy looks under voting booth at Ventura Polling Station for California primary Ventura County, California. Joseph Sohm / Shutterstock.com

    FBI breach notice rules lauded by states, but some want more

    A recent policy change by the FBI would notify states when their local election systems are hacked, but some state officials and lawmakers want the feds to inform a broader range of stakeholders in the election ecosystem.

  • paths (cybrain/Shutterstock.com)

    Does strategic planning help organizations?

    Steve Kelman notes growing support for strategic planning efforts -- and the steps agencies take to keep those plans relevant.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.