5 ways agencies can clean up their cyber hygiene
Connecting state and local government leaders
Following cyber hygiene best practices will ensure agencies can keep their systems healthy, provide high-value cybersecurity and remain agile and responsive to citizen needs.
Since the concept of cyber hygiene was described by Vinton Cerf in an address to Congress in 2000, government agencies have been cognizant of maintaining a holistic view of their security posture. In fact, in recent years there have been numerous efforts made to improve how agencies maintain their cyber hygiene. In 2017, the Promoting Good Cyber Hygiene Act was introduced to help establish best practices for cyber hygiene by the National Institute of Standards and Technology. And in 2018, the Department of Homeland Security created the AWARE score to help agencies compare their cybersecurity methods against agencies across government.
Despite all of the work being done to establish better situational awareness, agencies are still lacking certain basic elements required for effective cyber hygiene. And, as cyberattacks continue to increase in severity and occurrence, agencies must take the appropriate steps to manage and mitigate the risks associated with the fastest-growing crime of our time.
Here are five tips agencies should follow when it comes to analyzing and improving their cyber hygiene:
1. Know all the assets and end points on the network. To maintain and secure their critical IT infrastructure, agencies must first understand the nitty-gritty of their current networks, ensuring they know all of their existing assets and end points. This must be continually tracked and updated, as all software and hardware have a different lifespans, versions and service plans. By knowing their complete IT footprint, agencies can provide all of the recommended upgrades, updates and patches, providing employees with an IT network that is reinforced with the security needed to operate effectively and to deliver mission success and positive customer experience.
2. Use the full toolset. Resource utilization is the backbone of any project execution, and as such, being able to fully use all resources in an agency’s toolset is crucial for improving cyber hygiene. Despite common belief, most organizations have a plethora of tools but use only about 20% of their capabilities. This can be due to lack of knowledge, skepticism of capabilities and wariness of adopting new applications.
3. Define metrics that matter. Cross-industry studies show that on average, less than half of an organization’s structured data is actively used in making decisions. Further, less than 1% of unstructured data is analyzed or used at all. In end-to-end solutions, having metrics in place to fully understand data is the best way for an agency to paint a clear picture of its business performance. Defining early on what metrics that matter can truly formalize -- and mature -- processes and lead to better security. Translating these measures in business terms can then help prioritize countermeasures and mitigate any cyber risks.
4. Automate, automate, automate. Reducing human impact can be one of the best protective measures for cybersecurity. Although there are no guarantees, processes that are automated and use artificial intelligence and machine learning reduces human errors and brings cohesiveness and consistency to responses and even harmonizes cybersecurity data for real-time solutions. Automation also often allows IT staff to tackle more complex issues, freeing them from mundane and routine tasks.
5. Deploy real-time dashboards. A good dashboard can have a big impact in mission-critical decision-making. In fact, having a dashboard that configures real-time data to provide actionable information is crucial to giving any agency a competitive edge when it comes to serving citizens. Plus, the right data visualizations can help agencies keep track of metrics and automated processes in real-time, driving efficiency and improving decision-making.
Having holistic cyber hygiene doesn't just benefit the government; it also supports the individuals who work in agencies. Cyber risks are expanding, so introducing a streamlined approach for a positive employee experience is essential to improving security operations.
Ultimately, developing a comprehensive cyber hygiene strategy and the necessary procedures that accompany it is crucial for today’s enterprises. Strong best practices result in a unified approach, ensuring the government has the basic elements required to keep agencies healthy, provide high-value cybersecurity, while also remaining agile and responsive to customer needs. With the recent DHS directive requiring agencies to ensure effective and timely remediation of critical and high vulnerabilities through periodic assessments, this has never been more important.