CDM Bill Is a Small Price for Major Cybersecurity Improvements

Cyberattacks on federal infrastructure continue to be one of the greatest threats to U.S. national security, jeopardizing the integrity of our nation’s data and proving costly for the federal government.

A 2018 report published by the White House Council of Economic Advisers estimates that cyber crime costs the U.S. economy between $57 billion and $109 billion per year, or 0.3 and 0.6 percent of the value of all the U.S. goods and services. Among bills that address cybersecurity, a bill to advance the federal government’s Continuous Diagnostics and Mitigation program stands out as a good bet.

The Homeland Security Department's CDM program, which was first established in 2013, was designed to help combat outside threats and provide “consistent government-wide set of information security continuous monitoring (ISCM) tools and services at a reduced cost that enhances the government's ability to identify and mitigate the impact of emerging cyber threats,” according to the DHS website.  These are worthy aims, and they’re still spot on after five years of the program’s existence.

The CDM program represents a real improvement over past federal guidelines for securing systems in civilian agencies as well as states, territories and localities. However, the program has been criticized for being too slow to provide funding to address urgent and rapidly emerging threats. The program has also been plagued by unclear definitions of requirements and a lack of coordination between agencies. Nevertheless, CDM has much to recommend it, particularly its systemic, risk-based approach to cybersecurity.

That’s why the Advancing Cybersecurity Diagnostics and Mitigation Act (H.R. 6443), approved by the House Homeland Security Committee, is much needed. It aims to create a new, comprehensive and agile CDM program, much like a Defense Department program of record. The legislation has the potential to correct many of the shortcomings of the CDM program’s initial implementation if carried out to the fullest extent.

H.R. 6443’s emphasis on making regular improvements to keep pace with emerging technologies is a welcome effort, as innovation is critical for CDM success. Technology continues to evolve drastically, and government systems must keep pace. The CDM bill is a necessary step toward ensuring that the practice of cyber hygiene throughout the federal government is the norm and not the exception. The bill will also better ensure that emerging threats are addressed quickly across the government’s large attack surface.

It’s difficult to manage diagnostics and mitigation at the scale of the federal government, resulting in difficulties to proactively combat bad actors. The CDM Act would require DHS to create a much more overarching approach to this problem and the program.

Furthermore, the legislation would make the CDM program capabilities available to any federal agency, regardless of reimbursement. This component of the legislation aims to address complaints that the full implementation of the program has only been partly covered by DHS. This would ensure more effective funding and oversight and provide needed resources to agencies that are facing critical threats each day.

The bill also includes clear instructions for the head of DHS to take more ownership of the structure and implementation of the CDM program. The bill calls on the Secretary of Homeland Security to put forth a new and improved CDM strategy within roughly six months of the legislation’s passage and use data collected through CDM to create a report on the government’s cyber risk posture for the Senate Committee on House Homeland Security and Government Affairs within three months.

The legislation could be even stronger, however, if it included a provision to promote the interoperability of cybersecurity tools. In a quest to combat the most recent threats, many agencies have purchased single-use products that don’t talk to each other or share context to build a complete picture of the battlefield. As a security industry, we’ve willingly provided those tools, but we haven’t provided an underlying way to integrate the parts into a greater whole. What’s needed is a coordinated defense—one in which security tools share threat information on a real-time basis—not just within a single agency but within and across many agencies and departments. Building in a requirement for interoperability would not only improve the security posture of civilian agencies, but it would also save federal dollars, ensuring that the CDM program provides good security value.

Overall, H.R. 6443 is a welcome and necessary effort to improve a program that is integral to the security of our nation’s data and infrastructure. It is critical to increasing visibility across federal agencies and increasing coordination to combat cyberattacks. The CDM Act, with slight modification, will help this program achieve its full potential and ultimately better prepare federal agencies for imminent attacks on their infrastructure.

A recent Congressional Budget Office estimate places the cost of the legislation at less than $500,000 over the 2019-2023 period. This is a small price to pay to modify a program that could have such major rewards.

Tom Gann is the chief public policy officer and head of government relations for McAfee.