How will the AWARE score improve government security?
Connecting state and local government leaders
Because it is based on foundational controls -- finding and patching vulnerabilities, making sure systems are securely configured and monitoring systems for change -- AWARE will go a long way in helping agencies maintain a strong security posture.
The concept of a “credit score” metric across federal agencies sounds as good as any for measuring cyber hygiene, but will the Department of Homeland Security's Agency-Wide Adaptive Risk Enumeration score actually improve the federal government’s security posture?
I believe the AWARE score will likely succeed, because it is based on foundational controls. Very often, the biggest bang for the security buck lies in making sure foundational security controls are in place. The fundamentals of finding and patching vulnerabilities, making sure systems are securely configured and monitoring systems for change go a long way in maintaining a strong security posture. The AWARE score measures where an agency stands with operationalizing these controls.
While every agency aims to achieve a high AWARE score, the first objective should be to ensure that its security data is accurate. Until agencies are able to do that, the AWARE score will not reflect the reality of their systems.
How far are agencies from being able to report accurate data? Most are further away than one would assume. Only an agency operating at a relatively mature security level will be able to consistently report accurate information.
Identifying where an agency is from a maturity perspective is the first step in preparing for its initial AWARE score in 2020. From there, IT leaders can determine what operational capabilities will be needed to report accurate security data. Those capabilities include the ability to handle both continuous system monitoring and change detection, the depth and breadth of policy and platform coverage, the ability to provide holistic coverage of all necessary controls, and the ability to apply the AWARE metric throughout all environments -- on-premise and in virtual, private cloud and public cloud.
How can an agency gauge its maturity perspective? Maturity is determined by an agency's assessed risk based on vulnerabilities and how its systems are configured against policy. Agencies that can answer "yes" to the following questions would be considered mature and should be able to provide the data needed for an accurate AWARE score:
- Is the organization adhering to a particular policy such as the National Institute of Standards and Technology's 800-53, the CIS critical security controls or the Defense Information Systems Agency's Security Technical Implementation Guides (DISA STIGs)?
- Can the agency to continuously scan for vulnerabilities?
- If a system falls out of compliance or if vulnerabilities are discovered, is there is an owner responsible for fixing it and are there policies and procedures in place to do so?
If the answer is "no" to any of the above questions, the agency must advance in the following areas before it can provide consistently accurate information for an AWARE score.
- Asset management: Agencies must know where they keep their asset inventory and how they know how many assets they have. They should be able to identify where they store asset information, how up to date is it, how it gets updated as well as the change management process. In other words, they must know their current state at any given time.
- Security frameworks: Is the agency compliant with a security policy such as DISA STIGs and, if not, is there a plan to become compliant? Agencies will need the right processes to get there, and security solutions must map to that policy.
- Support services. Larger agencies should be able to provide security support services to the organization’s security teams for change management, policy monitoring and incident response services, for example
Keep in mind, the whole purpose of the AWARE score is to continuously describe an agency’s state of compliance and to remediate vulnerabilities. AWARE is not about achieving a high score once; agencies must maintain that score on an ongoing basis.
Why do I think agencies have a long way to go before they can generate an accurate AWARE score? The litmus test for any agency preparing for its AWARE score is if it can demonstrate compliance to NIST 800-53. If agencies are anything like commercial entities, it will likely take at least three days to generate an 800-53 compliance report. They may be able to generate a report for an audit, but they could not necessarily do it on any given day of the week. If an agency doesn’t continuously know its state of compliance, it will not be able to remediate when it falls out of compliance.
Once agencies are confident in their ability to provide accurate information to generate an AWARE score, government security will likely improve significantly. It may just take a while before that confidence is in place.