Making the most of your cyber dollar
The White House released its fiscal year 2020 budget, which included a 5% increase in federal cyber spending. This is good news for agency chief information security officers and could provide some welcome financial relief. Before purchasing new solutions, however, agency CISOs should revisit their priorities. If they take a spring cleaning approach, they can clear out the technical clutter that siphons off resources that could be better spent on optimizing existing tools, finding the right service partners and making the budget stretch further.
Assess the current situation
To start, CISOs should look at the tools that are currently deployed and evaluate them by asking these questions: Are they up to date? Do they evolve to meet the latest threats? If not, why are they still being used?
Another place to look is at hiring. Is the agency hiring to support a toolset that is not adequately covered? Perhaps the expert assigned to manage that tool has left, creating a need to backfill. This approach to hiring creates the dreaded single-point-of-subject-matter-expert failure, where an expert leaves and the tool's efficacy degrades. It’s a vicious cycle. If the tool under evaluation does not enhance the agency's cyber arsenal and align to its strategy, CISOs should sunset it and move on.
Invest in optimization
In conducting this analysis, CISOs will uncover what needs to be optimized. This may require hiring experts to come in and help optimize the most essential tools or making investments into training and expanding the team’s capabilities.
Custom content is the fuel that drives much of the advanced capabilities offered in many security tools. A simple way to optimize these tools is to ensure that the library of parsers, rules, reports and other pieces of custom content can be easily deployed to detect threats that simple detection rules or signatures cannot. CISOs not already allocating time to this activity will find it’s a small upfront investment that pays big dividends in the end.
Dealing with unpredictable cyber threats requires a unique security posture. The reality is that to win the battle against advanced cyber attacks, agencies need security teams proactively searching through networks to detect and respond to advanced threats that evade traditional rule-or signature-based security controls. The powerful combination of threat intelligence, analytics and automated security tools combined with critical operational experience is what leads to success. With the shortage of qualified cyber talent available, agencies struggle to build teams that have the depth and breadth to protect and defend against bad actors and nation-states alike. This sends them on a search for the right partner to become a key part of their IT security strategy and address the talent gap.
There are simply too few high-quality cybersecurity professionals available for every agency to maintain a robust cybersecurity posture. Keeping staff trained and up-to-date on the latest technologies and threats is a daunting undertaking for organizations trying to focus on their core mission.
For those agencies facing the brain drain or that don’t have the bandwidth to optimize their security environment, an alternative option is to seek out a cyber-as-a-service provider, a partner that can deliver outcome-based solutions and remove the burden of tool ownership and talent acquisition.
While a 5% increase in federal agency budgets helps, CISOs’ budgets are still constrained given the ever-increasing threat, so they must continue to be creative in making their security dollars stretch in fiscal year 2020. The good news is that they will uncover opportunities for resource savings. Many agencies already have all the tools that they need to do the job. By shifting the focus to optimization, they can make their existing dollars going further.
Jon Check is senior director of cyber protection solutions, Raytheon Intelligence, Information and Services.