CyberEye

Blog archive
Man with New Year

Congress to IT security: Happy fiscal New Year

Priorities for securing government’s IT infrastructure for the coming fiscal year include defending against insider threats posed by unmanaged privileged access and expanded continuous monitoring to address the growing complexity of outsider threats. But these issues could be dwarfed by the challenge of just keeping the lights on come Oct. 1.

“Security is probably the biggest issue we’ve got, because it underlies so much of the other things we are trying to do,” said Paul Christman, public sector vice president at Dell Software. “It can’t go on hiatus.”

Yet the fools on the Hill see the world spinning ’round toward the new budget year without any serious plans for enacting a budget to support critical operations. No doubt essential personnel will remain at their desks in the event of a shutdown, but without updated technology to support them, security will suffer.

“We’re finding it very challenging to assess and predict priorities, because our customers cannot assess and predict their priorities,” Christman said. “Funding has become chaotic and erratic.”

If there is any budget for fiscal 2014, insider threats are likely to be top-of-mind for administrators. A steady drumbeat of stories raises the question of how to manage the physical and logical access given to people agencies have decided to trust. On the IT side, systems administrators and others with privileged accounts often have way too much freedom, putting systems and the information they contain at risk.

The first step in controlling this access is effective policy. Most agencies and offices probably already have a good policy in place, Christman said. But there often are few if any controls to enforce it. Technology must match policy with the ability to monitor, track and audit the activity of those who are given the keys to the kingdom. This has been driven home by the activities of Chelsea (nee Bradley) Manning and Edward Snowden. The National Security Agency, smarting from the Snowden leaks, has responded by reducing the number of systems administrators and instituting a two-man rule requiring separate sets of credentials for access to sensitive resources.

This process would be burdensome and unnecessary for most agencies, which could effectively monitor activity with software. But that requires money, and money requires a budget.

The government also is in the process of moving from static assessments of IT security to continuous monitoring -- or continuous diagnostics and mitigation. This process is necessary to respond to a rapidly evolving threat landscape, and suites of automated tools are available to enable it. The Homeland Security Department is offering continuous monitoring as a service through blanket purchase agreements. But here again, a budget will be necessary to allow agencies to take advantage of the service in fiscal 2014.

Budget uncertainties are being compounded by the attrition of experienced procurement personnel. Because of retirements and sequester-powered furloughs, there is a shortage of officials with the know-how to effectively wend their way through acquisition regulations to take advantage of needed technology.

“I think this is going to make the next two weeks really, really strange,” Christman said of the year-end rush to spend out 2013 budgets. “I don’t see it getting any better next year.”

Posted by William Jackson on Sep 20, 2013 at 12:07 PM


Featured

  • Telecommunications
    Stock photo ID: 658810513 By asharkyu

    GSA extends EIS deadline to 2023

    Agencies are getting up to three more years on existing telecom contracts before having to shift to the $50 billion Enterprise Infrastructure Solutions vehicle.

  • Workforce
    Shutterstock image ID: 569172169 By Zenzen

    OMB looks to retrain feds to fill cyber needs

    The federal government is taking steps to fill high-demand, skills-gap positions in tech by retraining employees already working within agencies without a cyber or IT background.

  • Acquisition
    GSA Headquarters (Photo by Rena Schild/Shutterstock)

    GSA to consolidate multiple award schedules

    The General Services Administration plans to consolidate dozens of its buying schedules across product areas including IT and services to reduce duplication.

Stay Connected

Sign up for our newsletter.

I agree to this site's Privacy Policy.