Herding the stray cats of federal IT ambitions

Most government agencies are embracing the benefits of cloud computing, a mobile workforce and cybersecurity measures to protect critical networks and assets. But in many cases it has been a struggle just to get to that point, and hurdles remain as different approaches present a fragmented federal IT security picture.

Some help in federating the ways government agencies implement security practices will emerge in the forthcoming final version of the National Institute of Standards and Technology’s cybersecurity framework, due next month. But some experts are advising additional measures to help the government get to a comprehensive management plan for IT security.

A new SafeGov.org report advocates a more integrated approach that moves away from compliance-based security and toward a risk-management paradigm that coordinates cross-government efforts.

“There are a lot of initiatives that agencies are responsible for, which the paper tries to highlight – cloud first, data center consolidation, continuous diagnostics and mitigation, mobility management, a whole bunch of things agencies are responsible for,” said report co-author Karen Evans, national director for the U.S. Cyber Challenge. “One major theme in our recommendations is taking a look at that and building out the architecture in order to ensure [success]. If you’re looking at these initiatives separately and try to implement them separately without looking at the integrated picture, it’s going to defeat the purposes of them.”

The first recommendation in the report calls on the Information Security and Identity Management Committee (ISIMC), part of the Federal CIO Council, to take on a leadership role by adopting and issuing integrated network architecture. It also asks the ISIMC to establish FISMA-friendly implementation plans with milestones to help agencies transition to the proposed architecture.

“Right now there’s no overarching document saying, ‘this is how all these things can potentially work together,’” Evans said. “The pool of knowledge at the Federal CIO Council can help create the documents to lay out a specific roadmap that agencies can develop and be held accountable for.”

A second recommendation targets FedRAMP, calling on the Joint Authorization Board to require cloud service providers contracting with the government to “employ penetration testing capabilities in the implemented operational environment in order to surveil, analyze and respond to threats in real-time.”

This is especially important as FedRAMP deadlines approach, Evans noted.

“Right now everyone is scrambling, what does it mean?’ This architecture would help identify [security] gaps and how to get there – ‘here’s where I am and here’s where the gap is to get to my outcome, and here’s my plan to close that gap,’” she said.

Under the recommendations, the Joint Authorization Board’s current role in governing FedRAMP and certifying cloud providers for the General Services Administration would be reinforced and broadened, ensuring that providers and their services meet requirements and policies for other agencies as well.

“The nice thing about that is it’s a proven model,” said Julie Anderson, another co-author of the report and managing director of Civitas Group. “We’re not proposing something new; we’re proposing integration of processes and how FedRAMP can be integrated into requirements and expectations.”

The report additionally calls on the Office of Management and Budget and Homeland Security Department to jointly establish metrics that inspectors general can use to measure agencies’ cybersecurity risk and program effectiveness.

“There are so many initiatives, all with good intentions – we’re trying to weave that together into an integrated approach so agencies can look at all of the policies and directives and have an understanding of what they need to do next to meet requirements,” Anderson said.