Agencies Will Soon Have a Cyber Hygiene Score—And Will Know Where They Rank

Soon, federal agencies will have a clear idea of how they are doing on basic cybersecurity and be able to compare their posture to other agencies across the government.

The Homeland Security Department’s Continuous Diagnostics and Mitigation program, or CDM, is providing agencies with a sophisticated suite of cybersecurity tools. As those tools are put in place, the associated sensors are sending data to a centralized dashboard, giving Homeland Security and agencies a holistic view of cybersecurity throughout the federal enterprise.

Now, Homeland Security is using that data to compile cyber scores using an algorithm called AWARE, which stands for Agency-Wide Adaptive Risk Enumeration. The algorithm measures the existence of known vulnerabilities within an agency’s systems—those that have yet to be patched—and the baseline configuration settings to give an agency an overall rating on cyber hygiene.

Kevin Cox, CDM program manager at Homeland Security, likened the AWARE score to a credit score but in reverse—a higher number generally represents a worse cyber posture.

“By looking at the total number of endpoints against the score, we can come up with a per-endpoint average so that you can look at, agency by agency, how each agency is doing compared to other agencies,” Cox explained during a Nov. 28 keynote at an event hosted by FCW. “We’ll be able to have a scale as to what agencies are doing well, what agencies might need some additional support and help get us a sense of one of the most important factors in combating the threat: basic cyber hygiene—getting things patched, getting things configured.”

AWARE is based off work done by the State and Justice departments, Cox said.

The “special sauce,” Cox told Nextgov in an interview, is the ability to weight different vulnerabilities based on criticality and age, with more serious and older weaknesses given more weight.

Along with patching known vulnerabilities, Homeland Security officials are working on adding a component to measure configurations—that is, whether an agency has the right architecture in place to maintain security. Cox said they plan to start with about 30 controls, using the Defense Information Systems Agency’s Security Technical Implementation Guide, or STIG, as a baseline.

Those 30 baseline controls represent the most critical areas and most agencies already meet them, Cox said.

The program is still in development, but Cox said the department will create a set of established ranges so agencies understand how their cyber hygiene compares to others.

“AWARE is simply an instrument to get an overall view across the federal enterprise,” Cox said.

Over time, Homeland Security hopes to build in the ability to add nuance to the evaluation. For example, if an agency does not meet one of the configuration criteria but has a good reason—such as a different, acceptable mitigation strategy—that should be accurately reflected in the score.

Beyond situational awareness for agencies, the scores will also be used to help one agency determine whether it can safely integrate with another.

“Eventually what we want to do is get the AWARE score down to the system level,” Cox explained. “If I am an agency and I have a system connecting out to another agency’s system and I want to make sure that I’m not connecting to a system that’s not properly managed, I could take a look at their AWARE score and if it’s a poor score I’m going to have some questions about establishing that peer-to-peer connection.”

Cox said Homeland Security does not intend for the score to be punitive but rather informative.

“What gets measured gets done,” he said. “Once you get that visibility across the agencies, it really becomes the agencies looking at how they’re doing compared to their peers. So, it’s not necessarily that we need to come down with the hammer and say, ‘Your score’s bad and you’re not doing what you need to do.’ We’re already partnered with them, we’re getting the visibility now with the score, and we can say, ‘OK, it looks like you have a higher score than your peer, what is there that we can do to help you get that score lower?’”

The scoring system will also help agencies and others rate Homeland Security and the CDM program, Cox pointed out.

“It’s one thing we’ve been asked from our leadership, from OMB, from the Hill, from agencies: How are you able to measure the effectiveness of CDM?” he told Nextgov. “This is really our first set of metrics to say, with those sensors out there and the data feeding up to the integration layer and the dashboard, we can start to utilize that data to see how the agencies are doing from a cyber perspective.”

Nine agencies already have preliminary AWARE scores, Cox said, though he declined to offer specifics at this time. Cox said Homeland Security is working to improve the algorithm and get it rolled out to other CFO Act agencies during the second and third quarters of fiscal 2019, with a plan to be in full production at the start of fiscal 2020.