A peek inside the government’s cyber strategy

By Nick Mirabile, director of cybersecurity

It seems like every month there’s a new high-profile cyberattack wreaking havoc on our networks. Which is why we recently gathered three federal IT leaders to talk about cybersecurity and how they’re safeguarding their agencies in an era of emerging threats.

This panel discussion last month was fascinating, with success stories on what they’re doing to protect networks, as well as the biggest challenges for how to stay ahead of the threats. I picked up on a few themes important for companies selling cybersecurity solutions to agencies:

1. Access, access, access

The primary strategy agencies are using for protecting government data from getting into the wrong hands is access control. The Air Force is investing a lot of brain power into identity management and access management, said panelist, Dr. Leslie Perkins, deputy chief technology officer for the Air Force. She says the service wants to control access no matter the platform and wants to be able to easily change a person’s access from day to day if necessary.

The Air Force is also looking at how applications interact with platforms and whether they’re accessing the appropriate data and providing it to the correct people.

2. Fear of the cloud lingers

Nearly 90 percent of government entities are still afraid to move critical assets to the cloud because of security and privacy concerns.

The panel of government experts acknowledged that it’s a huge problem, but Sally Holcomb, another of our panelists and deputy chief information officer for the National Security Agency, says there are security gains by being in the cloud.

With attribute-based access control in the cloud environment, data can be protected to tiny granularity, with pieces of it being shared with specific individuals. “You can’t do that in a normal data repository and legacy environment,” she says. “We embraced the cloud eagerly because of that gain.”

The cloud has also allowed NSA to have better analysis and visibility of its data and to quickly pick up on anomalies and act on them.

The agency is also looking to commercial providers that can work with multi-fabric cloud environments. The company has to have the essential security requirements in place, including physical protection and all the requirements of a government system.

3. Agencies want to share

There’s a big push in government to leverage shared services in the cloud, said the panel. But it’s a challenge to move forward on shared services because of staff freezes and budget constraints, said Mark Kneidinger, director of the Federal Network Resilience division at the Department of Homeland Security, who also participated in our cyber panel.

He’s advising agencies to look at prioritizing items that are duplicative, as well as legacy applications. He’s also focusing on smaller federal agencies with stretched IT staffs that could look for opportunities to move applications to the cloud.

Agencies also expressed an interest in sharing information about what types of IT solutions they’re investing in and how those solutions are performing. “How I spend money really depends on how well I know what my colleagues are spending and if they’re willing to share,” says Perkins.

4. Who owns cyber? Everybody!

Government is going through a mindset shift in terms of who owns the cybersecurity challenge within each agency. No longer should it rest on the shoulders of the organization’s CIO or CISO, says Kneidinger.

DHS is working with the people who control the agency IT budgets—mission owners, political appointees, deputy secretaries—and educating them on why cybersecurity is so critical and where it needs to be applied, as well as the ramifications if it’s not being applied. “Awareness is critical and we’re really pushing that aggressively,” Kneidinger added.

Hear more of the panel discussion and reach out to immixGroup’s Market Intelligence team for more guidance on selling cybersecurity to government.