Energizing Your Efforts Know IT Security Your Best Friend FISMA, Phase II Fine Tuning FISMA Up & Down Industry Insights IT Security [PDF]

Then the administration promoted Marie O’Neill Sciarrone to Special Assistant to the President for Homeland Security and Senior Director for Cybersecurity and Information Sharing Policy.

Those 30,000 foot level moves are significant. They should not only provide much needed funding for cybersecurity efforts, but also add thump to movements such as creating a governmentwide standard desktop configuration, implementing HSPD-12 and instituting reality-based COOP where agencies recognize mobile computing and telecommuting are not optional, but
essential to maintaining and enhancing their operations.

All of this points to more focus on IT security – physical and cyber – by government decision makers responsible for driving business value and setting the IT agenda.

The Wide Open Network
Clarke told the audience that over the years hackers through attacks such as Midnight Maze and Titan Ring have successfully infiltrated supposedly secure systems and stolen terabytes of secure data. And like the 20th century missile race, as defenses improved, attackers got smarter, raising the stakes. “Then the attacks stopped,” said Clarke, “probably because they found a way to do it that can’t be detected.” Clarke also explained that real pros even “clean up” after they finish leaving no trace of their crime and asked the chilling question, “If they can do this, why shouldn’t they be able to shut down our critical
infrastructure and shut off our systems?”

So why is it that our IT systems seem to be vulnerable to attack? Can’t we write code to protect us? Clarke explains that would be difficult since most code is written outside the U.S. And while it would be safer to have all sensitive code written inside the U.S., it would be only a matter of time before an adversary exploits any software weaknesses.

Networks are already laced with “trap doors” in both software and hardware says Clarke.

So, what does that mean? Clarke asks what are we protecting – the system or the data? “The network isn’t valuable, it’s the data on the network, both the data at rest and the data being used,” explains Clarke.

To secure the data Clarke says securing source codes are important and that “major players” are getting together looking for ways to share information using encryption technologies. And organizations such as the Center for Security and International Studies are examining the issue and are commissioned to come up with recommendations for government cybersecurity by December 2008.

Reality Based Strategy
Clarke says we need to accept the fact there are routers and fire walls in use that are laced with “trap doors”. “We cannot have 100% security and we need to accept the fact people are going to get in and start pursuing a different strategy designed on protecting the data itself.”

“We need to look for ways for encrypting information so makes it impossible to use,” adds Clarke. “We can’t close the doors, but we can encrypt information and do a better job of assigning the digital rights as to who can see what data.”

“We need to find ways of locking data down and making it accessible to only those authorized to use it without having to go through bulky authentication systems. It must be easy and seamless to the user.”

Clarke was an advocate of a single “closed loop network” for government. This proposal was rejected, but the idea of reducing the number of government Internet gateways promoted by OMB in its Trusted Information Connections initiative shows that government realizes the security implications of a wide open government IT infrastructure with thousands of gateways to be protected.  Further realization has hit big-time that there needs to be real-time security monitoring.

Moreover, the recent released NIST guidelines to help agencies with their FISMA reporting about managing risk acknowledge that security risks are changing and dynamic and traditional procedures for certification and assessment may be difficult to use.

Cyber SaaS?
So what does Clarke advocate?

First of all government needs someone in charge with the authority and resources to drive change in culture and
compliance with directives.

Clarke also advocates government begin to look closely getting cyber services on demand through a Software as a Service (SaaS) solution. “It would take from the individual agencies the burden of running 27 different systems and create a SaaS alternative; one that is efficient, competent, outsourced, but closely managed by the federal government; one that allows departments to hook in and get what they need when they need it.”