Hiring Alone Will Not Solve Government’s Security Problems

Protecting government data requires significant investments in talent and technology. However, a recent survey of nearly 3,000 security professionals from The Ponemon Institute and ServiceNow indicates that hiring more staff will not be enough to solve the government’s security problems.

I like to call this the “Patching Paradox.” While agencies plan to hire more cyber experts, they will need to adopt automation tools that scan for vulnerabilities and threats to fix broken patching processes if they want to secure their data.

Most data breaches occur because of a failure to patch known vulnerabilities, yet many government agencies struggle with the basic hygiene of patching because they use manual processes that cannot scale—and they cannot prioritize what needs to be patched. If agencies understood the relationship of their configuration items to services being provided and prioritized those services, they could quickly detect and patch vulnerabilities and significantly reduce the risk of a breach. Rather than invest in automation tools, most government IT professionals are planning to hire new employees within the year whose main purpose will be patching security vulnerabilities. Manually coordinating patching activities and responses across teams is a poor use of time and resources. Turning to automated IT management solutions will allow agencies to move from the “finger in the dike” reactionary security process to a more efficient and more secure computing environment.

There are many reasons why it is difficult for agencies to patch security vulnerabilities, including uncertain asset visibility, limited resources and outdated reporting methods. Two out of three respondents said they cannot easily track whether vulnerabilities are being patched in a timely manner, and 72 percent don’t have enough resources to keep up with the volume of patches. Another major reason why government agencies are struggling to keep up is because many still use emails and spreadsheets to manage the process, so things slip between the cracks and many times there is no record of actions taken.

The survey results were especially alarming because more than half of the respondents said they spend more time navigating manual processes than responding to vulnerabilities. In fact, more than half said manual processes put them at a disadvantage when patching vulnerabilities and were spending 50 hours or more managing the vulnerability response process. That’s the equivalent of at least one full-time employee doing nothing but monitoring systems for threats and vulnerabilities when those functions could be done by an IT management solution. That could freeing up time for that employee to proactively develop or integrate new security features.

Thankfully, broken processes can be fixed. There are several key steps that organizations should take to improve their security posture. First, take an unbiased look at your response capabilities. You cannot find the right solution unless you know the problem. Then, tackle low hanging fruit by breaking down data barriers between security and IT. This will help save time lost on coordinating between teams. Once these steps have been taken, you can optimize response processes and automate as much as you can.

Now is the time for government to automate IT management processes because the threat will increase. With machine learning and artificial intelligence, hackers are outpacing government agencies in many cases. They are finding vulnerabilities faster than CIOs and CTOs can patch them. We need to arm government technology leaders with the tools they need to combat these threats. Adding more talent alone won’t address the core issue plaguing today’s security teams. Automating routine processes and prioritizing vulnerabilities will help organizations avoid the “patching paradox,” instead focusing their people on critical work to dramatically reduce the likelihood of a breach.

Bob Osborn is the federal chief technology officer of ServiceNow, joined the enterprise IT cloud company in 2014 after an extensive career in the federal government. He served as the Deputy CIO of the National Renewable Energy Laboratory. Prior to that, he was the CIO and Associate Administrator for Information Management of the National Nuclear Security Administration and served as the deputy CIO of the U.S. Transportation Command within the Department of Defense.