The uphill battle for network defense

With news of online breaches and nation-state hacks nearly every week, it’s not just Boy Scouts who are striving to “be prepared.” Government agencies and law enforcement units see improving their cybersecurity hygiene as a critical step to mitigating attacks.

While it's true  that the human is the weak link in most information security breaches, the public sector is realizing there is only so much it can do to change the behavior of its employees. According to research last year from the CERT Division of the Software Engineering Institute of Carnegie Mellon University, insiders were the source of “50 percent of incidents where private or sensitive information was unintentionally exposed.”  Survey respondents reported that insider threats included malicious activities but also mistakes by employees, such as falling for a phishing scam.

For many government agencies, “cyber hygiene is often equated to compliance,” according to Carlos Solari, vice president of cybersecurity services at Comodo. “Effective processes for patching, perimeter defenses and identity and access management are examples. However, it is not a sufficient level of protection to deter advanced threats. That is why cybersecurity professionals are often heard saying that ‘compliance is not security.’” The National Institute for Standards and Technology's Cyber Security Risk Framework proposes a progression for building defense-in-depth, but “not all organizational processes are equal,” Solari said.  And, as many industry experts point out, not all data is equal. “One can say it simply as, ‘protect first what matters most,'” he added.

That is not always easy for public sector agencies burdened with legacy systems that have trouble keeping up the current information management demands, according to William F. Nagle, vice president of product management for Discover Technologies. Old legacy systems and fewer experienced cybersecurity workers present a problem. “At some point, the gap between what is currently available to older and homegrown systems -- this still includes manual paper processes -- becomes too large to ignore,” Nagle said. “Secondly, as budgets are reduced, agencies are expected to provide the same level of service with fewer workers.”

Threat detection

Federal and state agencies and their law enforcement components are arguably at an important crossroads in their cybersecurity evolution right now, as threats become more pervasive and pernicious and online, mobile, cloud and internet protocols are increasingly more central to their work.

Unfortunately, “for a long time, agencies have been collecting and recording data -- like a DVR -- but [they’re] not effectively analyzing it to improve their security postures,” said David Rubal, chief technologist for data and analytics at DLT Solutions.

“It’s vital that cybersecurity analysts have the capacity to proactively use the data they are collecting, regardless of the source, to see the trends and patterns and make predictions,” Rubal said. “Agencies need to knock down the walls between their cybersecurity and data management functions, and facilitate a conversation about how better analytics can help them through enhanced threat detection, mitigation and analysis stages of cybersecurity.”

Between the recent Cybersecurity Executive Order and the expected passage of the Modernizing Government Technology Act of 2017 (both of which highlight a need for more cybersecurity investment) and the increasing threat level, industry insiders expect that more money will be invested in new and emerging technologies. And, indeed, many government agencies are already committing to a new “massive investment in security technology,” according to Brian Contos, chief information security officer and vice president of security strategy for Verodin.

The problem, according to Contos, is that government agencies are not getting the appropriate "payoff" for their investment. “These [agencies] are not seeing an equation where security effort equals effectiveness,” Contos said. “Most organizations have no idea how little value they are getting for their security solutions.”

Part of that problem stems from government's broad and diverse needs when it comes to updating their digital security platforms. Among one of the most basic tools, according to Yossi Appleboum, co-CEO of Sepio Systems, are those that help agencies know exactly what is on their network -- in other words, “tools for tracking hardware inventory, finding rogue devices within this inventory and disabling them.”

Agencies also need a way to root out hidden malware that exfiltrates data from secure networks, which is what happened with the massive Office of Personnel Management breach in 2014, which went undetected for many months.

Endpoint protection

Cameron Chehreh, chief operating officer, chief technology officer and vice president for Dell EMC's federal unit, agreed that many new technologies are emerging aimed at “hardening the defensive postures of agencies” by looking specifically at where users interact with the networks -- the growing multiplicity of endpoints. Through its partnership with endpoint security firm Cylance, Dell has been working with public-sector clients to look for anomalies that could signal network intrusion. “When it finds an anomaly in a signature or behavioral pattern, it alerts admins to a possible threat,” Chehreh said, adding that Dell is also using new technology in RSA’s Archer dashboards for continuously monitoring and evaluating risk management by looking for anomalies in empirical data. “These technologies, coupled with deeper threat intelligence, are creating greater situational awareness within agencies,” he said.

Agencies should also "leverage a technology that provides continuous security monitoring visibility into vulnerabilities across the entire enterprise network.” said BluVector's chief Technology and Strategy Officer Travis Rosiek. Such tools "will help mitigate the risks of systems that require longer cycles to apply patches or other configuration changes that can’t keep up with evolving cyber threats,” he said.

Containment is another increasingly popular technology to endpoint protection, according to Solari. Containment is designed to stop the methods, like writing to registry and hard drives, malware uses to infect endpoint devices, he said. It works not just for known malware, but also for unknown or previously undiscovered malware that typifies most zero-day attacks.

“Consider the idea of discovering software [as] an embedded malicious macro, as an example, with no patch available, running rampant in your network,” Solari said. “The defense-in-depth of traditional security does not know what it is, and the malware progresses up the cyber kill chain to create the impact: ransomware, the theft of sensitive information or other kinds of attacks. Containment stops that progression by enabling a prevention method.”

Open source technologies are also being embraced more pervasively and aggressively in the public sector by agencies that want to stretch their information security budgets and potentially get more capacity out of their systems. “With open source, you will typically see a higher level of capability for the same capital outlay,” according to William F. Nagle, vice president of product management for Discover Technologies. “Open source technologies not only enable the control that agencies seek from a long-term perspective, but [they] also enable them to utilize existing IT teams that desire to stay hands on.”

And by using open source technologies, the often-financially strapped public sector benefits from “more eyeballs on the screen” -- roughly 54,000 open-source developers around the world who are constantly finding and patching vulnerabilities and improving on these technologies, said Ankur Laroia, leader of solutions strategy for Alfresco, which does about 60 percent of its work in the public sector.

“The current and past administration pushed for ‘open source first’,” Laroia said. “There’s no ‘black-box’ with this code. By virtue of it being more transparent, it is more secure.” Indeed, the previous security posture of ‘security by obscurity’ seems to be giving way to a growing attitude of ‘security by transparency,’ according to industry experts.

Cloud is also playing a bigger role in managing the security and complex process management demands around government functions like handling social entitlements and benefits and storing W-2 data and other sensitive personal information here, according to Laroia. “When you look at attack vectors from nation-states and cybercriminals, they’re going after the processes as well as the assets themselves,” he said. By containing these processes and assets, agencies are more able to prevent spoofing and impersonation from bad actors, he added.Challenges and opportunities

Despite recent advances in security technology, the challenges for the public sector in improving its cyber hygiene remain the same as they have for many years: “complex networks, legacy installations, very few dollars to re-architect or rebuild the IT base with new secure capabilities, difficulty sharing actionable cyber threat intelligence and slowness in meeting evolving threats,” Solari said. “There is also the added complexity and time associated with a long acquisition lifecycle, and the challenge is getting larger.”

Indeed, the public sector’s traditional acquisition cycle “does not allow for consistent innovation and upgrades to technology,” according to Chehreh. “The government simply cannot access tech at the pace of innovation, and thus innovations pass and vulnerabilities are exposed.” This problem is compounded by the nearly one million attempted intrusions to our national IT infrastructure each day, he added. “There is a large disconnect between the ability to fight cyber threats and the government's ability to acquire the needed tools quickly.”

The recent cybersecurity executive order, however, could help change these trends, by speeding funding turnarounds to as little as 30 to 50 days or appropriating a new vehicle for acquiring cyber technologies.

Chehreh said he believes new technologies like containment and open-source that allow applications to operate in a more protected virtual environment that “cannot propagate or allow the progression of the cyber kill chain.”  Those innovations, he said, when combined with greater transparency and better methods for sharing threat intelligence, offer agencies the potential to “push a big boulder up a steep hill.”