The federal government's now-mandatory security configuration standard for Microsoft Windows XP and Vista, known as the Federal Desktop Core Configuration, can greatly improve federal information security because three people saw a way to make it work.
One of them was Kenneth Heitkamp, associate director of life cycle management at the Air Force's Office of the Chief Information Officer. Heitkamp had to show evidence to Karen Evans, administrator for e-government and information technology at the Office of Management and Budget, that a standard security configuration was feasible. Evans lives in West Virginia, but she often acts like a native of the Show Me state. "Karen Evans was from Missouri on this one," Heitkamp said.
Evans wanted proof that a standard security configuration for Windows that had worked for the Air Force would satisfy the other military services' needs before expanding it governmentwide.
"Once we got all four services to agree, it gave her the model house that other federal agencies could look at," Heitkamp said.
Heitkamp's success at leading the Air Force to adopt a standard Windows security configuration became the foundation for what many experts say is potentially the most effective security policy that the government has adopted.
"This was not easy," said Tony Sager, chief of the National Security Agency's Vulnerability and Operations Group. "If it was, people would have done it in the past. There is a lot of operational pain with tighter security, which makes this very challenging."
The Air Force provided compelling evidence, but Evans asked for more. She sought the advice of Paul Bartock, NSA's technical director for network operational vulnerabilities, and Shelly Bird, chief architect at Microsoft Consulting Services.
"Ken's leadership and commitment to making the federal government a safer environment is to be commended," Evans said. "The Federal Desktop Core Configuration is truly a private/public partnership, and it was clearly demonstrated by the commitment of the team, which included Shelly and Paul. We are where we are today due to their efforts."
Bartock had hands-on experience with the core configuration at Defense Department sites, so he knew how the security settings could, in some cases, hinder normal operations.
"We had all this operational context and had a body of knowledge to make informed decisions," Bartock said. "We pulled vendors in at the end to get their input, which helped us leverage their security guides."
Bartock led NSA teams that went to sites to test the core configuration in operational environments. "We showed up at DOD sites, they said you recommended that and it broke this," he said. "We got feedback that was important."
Bartock applied that knowledge to making a case for which security settings the FDCC should include.
"The operational managers would say these security settings are impacting our applications, and we could argue that we need them for these reasons and let us find a countermeasure so the applications will work," Bartock said. "Now application developers have a clear understanding of what security must run against their software," he added.
Bird contributed to the FDCC as the leader of a team that developed group policies and virtual machines for agencies to test whether their applications would run with the standard security settings in place.
Bird also worked closely with OMB, the National Institute of Standards and Technology, NSA and the Defense Information Systems Agency to develop thousands of security settings in the desktop core configuration standard.
"The toughest part was figuring out how to translate the standard into something from Air Force that civilian agencies would accept," Bird said. "The challenge for NIST was to work its way through the baseline. We had a fairly lucky convergence of events, including the maturing of the Secure Content Automation Protocol program" for verifying that mandatory security settings have not changed.
Bird said SCAP brought necessary accountability to the program and helped persuade NIST to support it.
"We are simplifying what it takes to get this in place, and we are trying to make this implementation-oriented," Bird said. "What surprised a lot of people was the general response from agencies that 'This is great, and you will help us get through this.'"
