Network security: Age matters less than maturity
Connecting state and local government leaders
Network administrators must ensure that their infrastructures are mature enough to handle the latest threat as well as rapidly changing security requirements.
Much has been written about aging government IT networks, but not enough attention has been paid to the maturity of those networks. While it’s important for agency IT professionals to modernize legacy networks, it is equally critical for them to ensure that their infrastructures are mature enough to handle rapidly changing security requirements. They must have faith that any potential threats or problems can be addressed and remediated quickly, regardless of the age of their network components.
Creating a more mature network can be a challenge, however. In addition to looking at various network connections, IT professionals must consider the policies and procedures they use to enforce network security. Are current practices adequate for responding to current and future threats? How do they approach introducing new devices and users on their networks? What is the response time for dealing with potential exploitations?
A majority of respondents to a recent SolarWinds cybersecurity survey indicated they have “good” IT controls for addressing these questions. They are managing security to the expectations of their policies.
However, other respondents listed their controls as “excellent.” They are going beyond just meeting policy expectations and, as a result, are seeing greater success with risk monitoring and mitigation. They feel better equipped to handle potential threats and undoubtedly share two common understandings.
First, they recognize that network intrusions will happen and are preparing accordingly. Second, they are willing to embrace change.
Those two beliefs are important for creating mature networks that are ready to handle potential threats.
The network will be hacked -- it’s just a matter of how badly
Prospects of inevitable intrusions are growing from both internal and external threats. Beyond global and near-peer adversaries, our cybersecurity survey revealed increasing concerns about careless, untrained or malicious insider threats. The latter is especially disconcerting, as malicious insiders are more likely to be aware of how to beat internal processes. Meanwhile, untrained employees may not be up to speed on the latest tactics used by enterprising bad actors, such as homograph attacks that use misspelled domain names to lure users onto phishing sites.
An agencywide proactive approach to network security is required. IT managers should initiate comprehensive and frequent security training for all agency professionals to make them more cognizant of the tactics used to infiltrate networks and show them how they can help prevent attacks. Training can be complemented by advanced continuous network monitoring, which can identify the tools that are being used on the network and help filter out potentially dangerous rogue devices and users. It can also reduce redundancies and complexities created by unnecessary tools taking up network resources.
Accept and embrace change
When The Defense Information Systems Agency introduced its Security Technical Implementation Guides and Command Cyber Readiness Inspections, there was a palpable sense of nervousness -- and even paralysis -- among some people in the federal IT community. Many wondered how the new guidelines would affect their ability to do their jobs. Others were concerned about how to effectively prepare their agencies to meet DISA’s requirements.
But change is an inherent part of an IT manager's job, and the ability to manage change is essential, particularly when dealing with today’s escalating and evolving threats. Security processes cannot be set in stone, but must be readily adaptable to new needs and requirements. When new security policies are issued, it is because leaders perceive a potential threat that requires a different type of reaction from agencies. IT teams must be ready to work within those new policies, even if they must modify their approaches to do so.
In some cases, security policies may require flexibility. For example, network operations centers that employ multiple screens may not always be in compliance with rules pertaining to unlocked and unattended workstations. Still, these centers are important to network security because they provide in-depth network visibility and help teams monitor the tools they use to quickly identify, isolate and remediate issues.
The government cannot afford the equivalent of what took place in Atlanta, where the SamSam ransomware attack left the city scrambling to restore critical resources. Agencies need strong, mature networks that are able to quickly and automatically identify and fix issues in minutes as opposed to hours or days. With the right mix of policies and tools -- and the right mindsets -- teams can successfully raise their networks’ maturity levels to comfortable points.