Cybersecurity

Federal CISOs want more education and training to help boost incident response

Shutterstock image (by solarseven): digital connection with people. 

Federal CISOs agree that investment in workforce training and education is the key to increasing incident response capabilities.

If budgets weren't an issue, Department of Homeland Security CISO Jeffrey Eisensmith said during a panel on CISO priorities for 2018 at the Sept. 13 Billington Cybersecurity Summit in Washington, D.C., he would put a "significant investment in workforce both in training and retention" by instituting performance-based training and testing."

Essye Miller, the Defense Department's deputy CIO for cybersecurity, emphasized a "holistic" approach that included education of contractors and government workers.

"The investment piece in this is very important but it has to be holistic," Miller said, adding that efforts must include the proper education of contractors, corporate managers and industry partners to develop appropriate security posture.

The panelists, who represented the Departments of Treasury, Defense, Health and Human Services, and Homeland Security as well as industry, agreed the president's cybersecurity order provided the necessary framework to guide those investments.

"The executive order gave us specific direction to make those investments," and encouraged leaders to seek out their vulnerabilities and address them, said Jack Donnelly, the Treasury Department's CISO and associate cybersecurity CIO. "Find your greatest risk and then systematically address them."

The DOD was already in process of implementing the requirements of the order, but Miller said its signing helped shift the agency's internal perspective.

"We have to move from this compliance based environment to one where we're doing real risk assessment," she said. The cyber order's framework directive "shifted the conversation of it to include our industry partners" and tackle the challenge of sharing information with industry and "having our industry partners bringing back information to us if they haven't already."

For Northrop Grumman CISO Mike Papay, incident response is a weak point that needs to be reinforced.

"I want to be really good at incident response…to respond to any kind of threat within minutes, not find out 226 days after," he said. "I want to know when the threat is and be able to defeat it within minutes, not days, not weeks. And the only way to do that is to do information sharing at the tactical level."

In a separate keynote address, Director of National Intelligence Dan Coats called out attacks on infrastructure -- as well as on defense networks and technology companies, falsifying data and disinformation campaigns -- as a primary concern.

Coats also drove home the need for the intelligence community, government at large, and private companies to maximize gathered intelligence through collaboration.

"We need to find better ways to work together," by pooling resources and engaging the private sector, Coats said. "Government may have a competitive advantage in detecting malicious activity and possible understanding an actor's capabilities and intent," he added, "but this threat information, as important as it is, this information alone is not sufficient."

During the CISO panel, Donnelly said that infrastructure management should have the same element of precision as insurance actuaries when it comes to risk assessment.

"What's the risk of not replacing the infrastructure and what's the return?" he asked. "It has to be just like the insurance organizations: you're this old, you're in this health condition, we're going to charge you this much." Just as actuaries use available data and statistics to make a risk determination, Donnelly said, cyber professionals should too.

Note:  This article was updated on Sept. 18 to correct a quote attribution.  Remarks made by Northrop Grumman CISO Mike Papay had been erroneously attributed to another event speaker. 

About the Author

Lauren C. Williams is a staff writer at FCW covering defense and cybersecurity.

Prior to joining FCW, Williams was the tech reporter for ThinkProgress, where she covered everything from internet culture to national security issues. In past positions, Williams covered health care, politics and crime for various publications, including The Seattle Times.

Williams graduated with a master's in journalism from the University of Maryland, College Park and a bachelor's in dietetics from the University of Delaware. She can be contacted at lwilliams@fcw.com, or follow her on Twitter @lalaurenista.

Click here for previous articles by Wiliams.


Featured

  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.