Better cybersecurity depends on better information management

It might sound like heresy, but information sharing is overrated, said Tony Sager of the National Security Agency.

IT security officials already are overloaded with information, Sager said. As chief of the vulnerability analysis and operations group in NSA’s Information Assurance Directorate, which runs Red Team penetration tests, Sager has generated his share of security information over the past 33 years. But that data often contributes little to improving the security of government IT systems, he said Tuesday at the Symantec Government Symposium on IT security in Washington.

“Dumping our inboxes at each other is not going to cut it,” Sager said. “Being at the right meeting is not going to do it. The key to success in IT security is information management.” E-mail exchanges and meeting attendance don't scale, he noted; an agency official can't increase them indefinitely as the demand rises.

Related stories:

A cyber bill worth enacting

NIST updates specs for the latest version of SCAP

Information management means getting the right information into the hands of those who need it. That requires not data dumps, but standards for tools that can analyze data and make it available irrespective of its source; standards such as the Security Content Automation Protocol, jointly developed by the NSA, the National Institute of Standards and Technology and the private sector.

SCAP, a set of protocols for standardizing the way security information is defined and handled, is part of an evolution toward making cybersecurity more strategic and less tactical and reactive, said Ron Ross, senior computer scientist at NIST who spoke with Sager. SCAP compliant products can take information from multiple sources in a variety of formats and make it available to users.

Agencies generally are good at the tactics of cybersecurity, Ross said, but they are not so good at enterprisewide risk management.

“You have to start the risk management process at the top of the organization,” he said, so that tools on the front line can contribute effectively. “We have to get better at governance, first and foremost.”

Sager said he came to his conclusion on the importance of information management after more than 30 years of analyzing vulnerabilities and probing the defenses of Defense Department agencies. He came up with three primary observations.

“The optimal place to solve a security problem is never where you found it,” he said. Red Team exploits can identify a vulnerability in a network or system, but the root cause and ultimate solution lies in better management practices earlier in the system lifecycle.

Secondly, there are few surprises in IT security, Sager said. “If something is happening to you today, something identical or close to it happened to somebody yesterday and will happen to somebody else tomorrow.” But the people who already have the information seldom communicate with those who need it, he said.

Finally, “all the signs you needed to stop a threat or mitigate it were there, but they were not available to the cyber defender.” Too often the warning signals of a security incident appear significant only in hindsight. That is good forensics, but poor security, he said.

The solution is to make better use of existing information to identify vulnerabilities, mitigate threats and manage risks.

Although Sager and Ross are realists who do not believe in a simple solution for cybersecurity, they also are optimistic about the ability of agencies to use evolving technology and techniques to counter escalating threats.

“Our business is evolution,” Ross said. NIST is in the process of harmonizing security guidance across government, developing a single set of standards and controls that both civilian and national defense communities can draw from to establish appropriate levels of security. And the administration’s recent emphasis on continuous monitoring of IT systems is more of an adaptation to newly available tools and more aggressive attacks rather than a shift in strategy, he said.

“We’re getting better at this as we go,” Ross said. But so are the attackers, and agencies cannot expect to achieve complete security. New techniques for agile defense that can raise the costs for attackers and limit the impact of successful attacks can help to maintain effective risk management, he said.

Standardization and interoperability will be a major contributor to this, Sager said. “We can’t afford any more stand-alone tools in our environment,” he said. “We need to start demanding this from vendors.”