Cybersecurity

Federal CISOs want more education and training to help boost incident response

Shutterstock image (by solarseven): digital connection with people. 

Federal CISOs agree that investment in workforce training and education is the key to increasing incident response capabilities.

If budgets weren't an issue, Department of Homeland Security CISO Jeffrey Eisensmith said during a panel on CISO priorities for 2018 at the Sept. 13 Billington Cybersecurity Summit in Washington, D.C., he would put a "significant investment in workforce both in training and retention" by instituting performance-based training and testing."

Essye Miller, the Defense Department's deputy CIO for cybersecurity, emphasized a "holistic" approach that included education of contractors and government workers.

"The investment piece in this is very important but it has to be holistic," Miller said, adding that efforts must include the proper education of contractors, corporate managers and industry partners to develop appropriate security posture.

The panelists, who represented the Departments of Treasury, Defense, Health and Human Services, and Homeland Security as well as industry, agreed the president's cybersecurity order provided the necessary framework to guide those investments.

"The executive order gave us specific direction to make those investments," and encouraged leaders to seek out their vulnerabilities and address them, said Jack Donnelly, the Treasury Department's CISO and associate cybersecurity CIO. "Find your greatest risk and then systematically address them."

The DOD was already in process of implementing the requirements of the order, but Miller said its signing helped shift the agency's internal perspective.

"We have to move from this compliance based environment to one where we're doing real risk assessment," she said. The cyber order's framework directive "shifted the conversation of it to include our industry partners" and tackle the challenge of sharing information with industry and "having our industry partners bringing back information to us if they haven't already."

For Northrop Grumman CISO Mike Papay, incident response is a weak point that needs to be reinforced.

"I want to be really good at incident response…to respond to any kind of threat within minutes, not find out 226 days after," he said. "I want to know when the threat is and be able to defeat it within minutes, not days, not weeks. And the only way to do that is to do information sharing at the tactical level."

In a separate keynote address, Director of National Intelligence Dan Coats called out attacks on infrastructure -- as well as on defense networks and technology companies, falsifying data and disinformation campaigns -- as a primary concern.

Coats also drove home the need for the intelligence community, government at large, and private companies to maximize gathered intelligence through collaboration.

"We need to find better ways to work together," by pooling resources and engaging the private sector, Coats said. "Government may have a competitive advantage in detecting malicious activity and possible understanding an actor's capabilities and intent," he added, "but this threat information, as important as it is, this information alone is not sufficient."

During the CISO panel, Donnelly said that infrastructure management should have the same element of precision as insurance actuaries when it comes to risk assessment.

"What's the risk of not replacing the infrastructure and what's the return?" he asked. "It has to be just like the insurance organizations: you're this old, you're in this health condition, we're going to charge you this much." Just as actuaries use available data and statistics to make a risk determination, Donnelly said, cyber professionals should too.

Note:  This article was updated on Sept. 18 to correct a quote attribution.  Remarks made by Northrop Grumman CISO Mike Papay had been erroneously attributed to another event speaker. 

About the Author

Lauren C. Williams is a staff writer at FCW covering defense and cybersecurity.

Prior to joining FCW, Williams was the tech reporter for ThinkProgress, where she covered everything from internet culture to national security issues. In past positions, Williams covered health care, politics and crime for various publications, including The Seattle Times.

Williams graduated with a master's in journalism from the University of Maryland, College Park and a bachelor's in dietetics from the University of Delaware. She can be contacted at lwilliams@fcw.com, or follow her on Twitter @lalaurenista.

Click here for previous articles by Johnson.


Rising Stars

Meet 21 early-career leaders who are doing great things in federal IT.

Featured

  • SEC Chairman Jay Clayton

    SEC owns up to 2016 breach

    A key database of financial information was breached in 2016, possibly in support of insider trading, said the Securities and Exchange Commission.

  • Image from Shutterstock.com

    DOD looks to get aggressive about cloud adoption

    Defense leaders and Congress are looking to encourage more aggressive cloud policies and prod reluctant agencies to embrace experimentation and risk-taking.

  • Shutterstock / Pictofigo

    The next big thing in IT procurement

    Steve Kelman talks to the agencies that have embraced tech demos in their acquisition efforts -- and urges others in government to give it a try.

  • broken lock

    DHS bans Kaspersky from federal systems

    The Department of Homeland Security banned the Russian cybersecurity company Kaspersky Lab’s products from federal agencies in a new binding operational directive.

  • man planning layoffs

    USDA looks to cut CIOs as part of reorg

    The Department of Agriculture is looking to cut down on the number of agency CIOs in the name of efficiency and better communication across mission areas.

  • What's next for agency cyber efforts?

    Ninety days after the Trump administration's executive order, FCW sat down with agency cyber leaders to discuss what’s changing.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group