Federal agencies are moving closer to a common approach to cybersecurity as they work to meet targets for several governmentwide initiatives by the end of this month. Agency officials say those efforts should produce greater security for federal networks and agencies’ missions.
Although the initiatives add up to an overall defense-in-depth strategy, they’ve arisen separately. Each addresses a different element of the larger strategy, said Dan Chenok, senior vice president at Pragmatics and chairman of the Information Security and Privacy Advisory Board. That board advises the National Institute of Standards and Technology.
To properly implement the initiatives, agencies must have effective management and operations, Chenok said.
“Although the initiatives are primarily technical, there are management issues, like training and awareness, and there are operational issues, like incorporating security properly into budgeting and making sure you’ve got security planned for,” he said.
That list of initiatives includes transitioning to IPv6, the next-generation Internet protocol; implementing a software standard, the Federal Desktop Core Configuration for Microsoft’s XP and Vista operating systems; completing Trusted Internet Connections (TIC), a gateway consolidation project; installing gateway-monitoring technology under a program called Einstein; making continued progress on completing security clearances, registering agency personnel and providing personal identity verification cards, a program authorized by Homeland Security Presidential Directive 12.
The Office of Management and Budget, the National Institute of Standards and Technology, and the CIO Council are helping agencies implement those security initiatives, said Karen Evans, OMB’s administrator for e-government and information technology. The TIC and Federal Desktop Core Configuration efforts, in particular, are difficult but necessary, she said. “Agencies understand the threat that we face and the urgency to make our desktops and networks more secure.”
The various initiatives provide different layers of security, Chenok said. The core configuration standard helps agencies manage the security of desktop PCs, and TIC makes monitoring Internet traffic easier by greatly reducing the number of gateways carrying data into and out of agency networks. Meanwhile, IPv6 will make the Internet more versatile and secure.
Digg
De.licio.us
Slashdot
Technorati
