Congress to IT security: Happy fiscal New Year
Connecting state and local government leaders
Security priorities are being set for the coming fiscal year, but budget irresponsibility could make achieving them difficult.
Priorities for securing government’s IT infrastructure for the coming fiscal year include defending against insider threats posed by unmanaged privileged access and expanded continuous monitoring to address the growing complexity of outsider threats. But these issues could be dwarfed by the challenge of just keeping the lights on come Oct. 1.
“Security is probably the biggest issue we’ve got, because it underlies so much of the other things we are trying to do,” said Paul Christman, public sector vice president at Dell Software. “It can’t go on hiatus.”
Yet the fools on the Hill see the world spinning ’round toward the new budget year without any serious plans for enacting a budget to support critical operations. No doubt essential personnel will remain at their desks in the event of a shutdown, but without updated technology to support them, security will suffer.
“We’re finding it very challenging to assess and predict priorities, because our customers cannot assess and predict their priorities,” Christman said. “Funding has become chaotic and erratic.”
If there is any budget for fiscal 2014, insider threats are likely to be top-of-mind for administrators. A steady drumbeat of stories raises the question of how to manage the physical and logical access given to people agencies have decided to trust. On the IT side, systems administrators and others with privileged accounts often have way too much freedom, putting systems and the information they contain at risk.
The first step in controlling this access is effective policy. Most agencies and offices probably already have a good policy in place, Christman said. But there often are few if any controls to enforce it. Technology must match policy with the ability to monitor, track and audit the activity of those who are given the keys to the kingdom. This has been driven home by the activities of Chelsea (nee Bradley) Manning and Edward Snowden. The National Security Agency, smarting from the Snowden leaks, has responded by reducing the number of systems administrators and instituting a two-man rule requiring separate sets of credentials for access to sensitive resources.
This process would be burdensome and unnecessary for most agencies, which could effectively monitor activity with software. But that requires money, and money requires a budget.
The government also is in the process of moving from static assessments of IT security to continuous monitoring -- or continuous diagnostics and mitigation. This process is necessary to respond to a rapidly evolving threat landscape, and suites of automated tools are available to enable it. The Homeland Security Department is offering continuous monitoring as a service through blanket purchase agreements. But here again, a budget will be necessary to allow agencies to take advantage of the service in fiscal 2014.
Budget uncertainties are being compounded by the attrition of experienced procurement personnel. Because of retirements and sequester-powered furloughs, there is a shortage of officials with the know-how to effectively wend their way through acquisition regulations to take advantage of needed technology.
“I think this is going to make the next two weeks really, really strange,” Christman said of the year-end rush to spend out 2013 budgets. “I don’t see it getting any better next year.”