Federal CISOs want more education and training to help boost incident response

Federal CISOs agree that investment in workforce training and education is the key to increasing incident response capabilities.

If budgets weren't an issue, Department of Homeland Security CISO Jeffrey Eisensmith said during a panel on CISO priorities for 2018 at the Sept. 13 Billington Cybersecurity Summit in Washington, D.C., he would put a "significant investment in workforce both in training and retention" by instituting performance-based training and testing."

Essye Miller, the Defense Department's deputy CIO for cybersecurity, emphasized a "holistic" approach that included education of contractors and government workers.

"The investment piece in this is very important but it has to be holistic," Miller said, adding that efforts must include the proper education of contractors, corporate managers and industry partners to develop appropriate security posture.

The panelists, who represented the Departments of Treasury, Defense, Health and Human Services, and Homeland Security as well as industry, agreed the president's cybersecurity order provided the necessary framework to guide those investments.

"The executive order gave us specific direction to make those investments," and encouraged leaders to seek out their vulnerabilities and address them, said Jack Donnelly, the Treasury Department's CISO and associate cybersecurity CIO. "Find your greatest risk and then systematically address them."

The DOD was already in process of implementing the requirements of the order, but Miller said its signing helped shift the agency's internal perspective.

"We have to move from this compliance based environment to one where we're doing real risk assessment," she said. The cyber order's framework directive "shifted the conversation of it to include our industry partners" and tackle the challenge of sharing information with industry and "having our industry partners bringing back information to us if they haven't already."

For Northrop Grumman CISO Mike Papay, incident response is a weak point that needs to be reinforced.

"I want to be really good at incident response…to respond to any kind of threat within minutes, not find out 226 days after," he said. "I want to know when the threat is and be able to defeat it within minutes, not days, not weeks. And the only way to do that is to do information sharing at the tactical level."

In a separate keynote address, Director of National Intelligence Dan Coats called out attacks on infrastructure -- as well as on defense networks and technology companies, falsifying data and disinformation campaigns -- as a primary concern.

Coats also drove home the need for the intelligence community, government at large, and private companies to maximize gathered intelligence through collaboration.

"We need to find better ways to work together," by pooling resources and engaging the private sector, Coats said. "Government may have a competitive advantage in detecting malicious activity and possible understanding an actor's capabilities and intent," he added, "but this threat information, as important as it is, this information alone is not sufficient."

During the CISO panel, Donnelly said that infrastructure management should have the same element of precision as insurance actuaries when it comes to risk assessment.

"What's the risk of not replacing the infrastructure and what's the return?" he asked. "It has to be just like the insurance organizations: you're this old, you're in this health condition, we're going to charge you this much." Just as actuaries use available data and statistics to make a risk determination, Donnelly said, cyber professionals should too.

Note:  This article was updated on Sept. 18 to correct a quote attribution.  Remarks made by Northrop Grumman CISO Mike Papay had been erroneously attributed to another event speaker.