We’re approaching the end of the second week of the federal shutdown and so far there have been no cyber crises. This is the point in the movie where the hero says, “It’s quiet out there. Almost too quiet.”
We should not assume that because we haven’t seen major actions against our IT systems that nothing is happening. If we have learned anything from experience it is that the breaches we don’t see are far worse than the ones we do, and there’s no reason to believe that stealthy intrusions are less likely now that staff, funding and other resources have been cut to the bone.
The United States is the number one target in an ongoing global cyber cold war and that is not going to stop because Congress will not pass a budget.
“It is wishful thinking that in the current environment we are not going to be targeted and that a few people can manage all of that infrastructure,” said Vijay Basani, CEO of EiQ Networks, which provides security intelligence tools and services to the government.
Since Oct. 1, shuttered websites have been sending the wrong message to our enemies and our friends about our commitment to cybersecurity. A particular concern: Online versions of the National Institute of Standards and Technology’s cybersecurity guidance are unavailable and NIST’s work on a cybersecurity framework for critical infrastructure, due Oct. 10, has been halted, unfinished.
Yet our IT systems have not disappeared. Patching and monitoring cannot get the same level of attention as during normal operations and dealing with cybersecurity as a crisis rather than a process is bad policy and bad security.
Essential crews remain at work, but the morale of IT and security professionals still on the job without pay cannot be very good and the prospect of hiring qualified professionals in the future becomes bleaker by the day. What competent worker would choose to go to work for a dysfunctional government that won’t pay its bills as long as there are jobs in the private sector?
Basani warned that the impact of gridlock began even before the shutdown. The sequester cut into budgets before the end of the fiscal year, when many procurements and acquisitions are done. And contracts that were in place by the end of the year cannot be implemented, so upgrades and replacement of systems, components and security tools are delayed. Meanwhile, the Homeland Security Department’s Continuous Diagnostics and Mitigation program, which was to be spurred by the award of 17 blanket purchase agreements in August, has been essentially put on hold until government can get back to business.
In short, as Basani said, “as much as politicians talk about cybersecurity, I don’t think they really understand the implications of the shutdown on cybersecurity.”
The best we can hope for is that those in charge learn from this experience and realize that cybersecurity should be outside the scope of political spitting matches.
The worst we can fear is that nothing is learned because there is no obvious cyber Armageddon and we do not see the cancer working its way through out systems.
Posted by William Jackson on Oct 11, 2013 at 1:00 PM1 comments
Federal efforts to create cybersecurity frameworks for government and for critical private infrastructures have had an impact on international views about cybersecurity, says J. Paul Nicholas, Microsoft’s senior director of global security and diplomacy.
“When I meet with customers in other parts of the world, it always surprises me how much they know about FISMA and FedRAMP,” Nicholas said, referring to the Federal Information Security Management Act and the Federal Risk and Authorization Management Program.
But there still is no common template for cyber policies, and various international development efforts are progressing separately. In the United States, the National Institute of Standards and Technology is creating the Cybersecurity Framework, a set of voluntary security recommendations for critical infrastructure. Across the ocean, the European Commission is creating the Network and Information Security Platform. And as nations develop strategies for securing their cyber environments, there is a risk that unaligned policies could create a fragmented or poorly secured global infrastructure.
Some differences among national policies are inevitable, Nicholas said. “Cybersecurity is going to vary country by country,” because each nation faces a unique set of risks and has its own needs. To help create a common foundation on which policies can work together, Microsoft has produced a whitepaper, “Developing a National Strategy for Cybersecurity.” The paper advises focusing on the basics and building on established best security practices. It advises that any strategy be:
- Outcome focused
- Respectful of privacy and civil liberties
- Globally relevant.
Although the Government Accountability Office has rated federal IT security as a high-risk area since 1999, Nicholas, co-author of the Microsoft paper, praised the progress being made in this country to establish a regulatory regime for cybersecurity, including FISMA.
“FISMA has really been a journey,” and important work is being done under it, he said. “Could it be better? Yes. But it is being fine-tuned to improve risk management.”
NIST has come through in providing guidance in its 800-series of reports on IT security, Nicholas said. Although FISMA and the NIST guidance are aimed at the U.S. government, their influence extends well beyond. “There is a framework and mentality that did not exist 10 years ago. FISMA better enables the U.S. government to have a risk dialog with the private sector. They are able to discuss things with a similar set of experiences.”
This is not to say that FISMA, which is far from perfect, is or should be the model for national strategies. The challenge to come up with some kind of functioning global system for securing cyberspace involves as much diplomacy as technology. “It’s about deciding what needs to be done and how to move forward,” Nicholas said.
Posted by William Jackson on Oct 09, 2013 at 11:39 AM4 comments
Most government IT professionals − by a wide margin − would rather be trapped in an elevator for 24 hours than have their networks hacked, according to a recent survey.
This could explain why cybersecurity is listed as the top area for expanded IT spending in the coming year, with 59 percent saying they expect increased security spending, topping cloud computing by 14 percentage points.
The results from a survey of 400 federal, state and local government officials conducted for Cisco underscore the foundational importance of cybersecurity. Being stuck in an elevator would ruin your day. A breach of your network or data could ruin your career − and 71 percent said they’d rather be stuck in the elevator. If your security does not work, nothing else really matters.
Feds tend to be more conscious of this than those in state and local government. Improving security is the second place technology goal in the overall survey at 22 percent, behind reducing costs (28 percent), but security is tops in the federal sector. Budget constraints are the top threat to IT infrastructure, at 35 percent overall, and cyberattacks come in second, at 17 percent, but attacks are seen as a bigger threat in the federal sector than among state and local organizations. This does not necessarily mean that federal networks are more vulnerable than those in state and local systems, but the U.S. government is a high-profile target for hacktivists, criminals looking for valuable intellectual property and other nations engaged in espionage.
Cybersecurity professionals are in an almost no-win situation. In just about every assessment of security they come up looking bad. If they are graded on compliance with regulations, they are told that they are ignoring real-world security. If they focus on practical security, compliance is likely to slip. And complete security is impossible in a dynamic environment in which the functionality and configuration of hardware and software change on a daily basis. The best they can do is manage an acceptable risk. But no risk looks acceptable after a breach.
The professionals surveyed know that there is no simple answer to improving cybersecurity. Twenty-one percent of them listed better technology as the most effective way to improve security, followed by better enforcement of policies at 18 percent and better employee training at 15 percent. But most of them refused to single out one factor for improvement; 42 percent said that all three were equally important.
One factor not addressed in the survey is stability. It is hard to secure a system while ensuring its operational availability to users when you don’t know from day to day, let alone year to year, what financial and manpower resources are going to be available. The chaotic state of government over the last few years, illustrated most recently by the government shutdown forced by political hostage-taking, erodes IT security along with every other measure of performance. I imagine that if it had been offered as a choice in the survey, a rational Congress would top the wish list for IT professionals.
Posted by William Jackson on Oct 07, 2013 at 11:21 AM2 comments
Well, they’ve done it; Congress has shut down the federal government. On the bright side, it means less traffic on the streets and highways for Washington-area workers who do have to go into the office. But managing traffic on networks with a skeleton staff could be more of a challenge, especially if your organization has let the number of accounts with elevated access privileges get out of hand.
The insider threat has received a lot of attention in the wake of leaks of embarrassing information from the State Department and the National Security Agency. Following disclosures of classified information by contractor Edward Snowden, NSA Director Gen. Keith Alexander announced that the agency was reducing the number of its systems administrators by 90 percent from around 1,000. A reasonable move, if maybe a little late. But it raises the question, why did NSA have 1,000 administrators in the first place?
“Everyone in the world has the same problem,” said John Worrall, chief marketing officer for CyberArk, which sells tools to help manage privileged accounts. “It’s not just the NSA.”
Privileged accounts tend to accrete over time. Expanded access is granted and never revoked. People leave and accounts remain. Over time it is not impossible for organizations to find that they have a one-to-one ratio of users to elevated accounts.
“It’s a huge challenge,” said Eric Noonan, chief executive officer of CyberSheath Service International. Often it results from a desire by administrators to be helpful. “A lot of times it is easier to provided elevated access to end users,” to allow them to fix their own problems, he said.
“It creates a multiplicity of accounts you didn’t know you had, and each one becomes an attack vector,” Worrall said.
Any account can be an attack vector, of course, but privileged or administrative accounts create more risk because they give users the ability to make fundamental changes in the configuration of network and enterprise elements. This kind of access is necessary for administrators to keep systems up and running, but they also can abuse the access by opening and closing doors, installing and removing software, accessing and exporting data and then covering up tracks afterwards.
People with these accounts now are being sent home, most likely with their accounts and privileges intact. There will be a skeleton staff on duty at most IT shops to provide support for exempted workers who remain on the job, and a minimum level of staffing is required for security monitoring and incident response. But it will be a tough job for them to monitor and lock down all of the accounts that could be open to abuse.
The solution is to begin managing the proliferation of accounts before there is a crisis. The most direct way to do this is what Noonan calls the brute force method: Eliminate all elevated access, and give the privileges back one at a time only as they are needed. “It’s painful,” he said. “A lot shy away from the problem.” But if the issue becomes serious enough, organizations can be compelled to use brute force.
A more managed way is to first discover all of the accounts and audit them for need. To do this, agencies need a comprehensive policy defining what privileges are to be granted under what conditions. But policy without an enforcement mechanism is meaningless. Controls must be put in place and activity monitored -- not only to enforce policy, but to investigate incidents after the fact. Tools for discovering, monitoring and managing accounts are available (CyberArk is just one vendor; there are others as well).
Access control, like all good security practices, is an ongoing process. If management is confined to discovering and cleaning, it is inevitable that the number of accounts with elevated privileges will creep back up.
This is not much help for anyone babysitting a network with reduced staff now. But it is one more thing for the to-do list when things return to normal.
Posted by William Jackson on Oct 01, 2013 at 1:12 PM3 comments