Keeping Up with Compliance in the Digital Age 

As the Homeland Security Department’s Continuous Diagnostics and Mitigation program enters its seventh year, its positive impact on federal agencies' cybersecurity is clear. Since implementation, Homeland Security has been able to field and navigate over 35,000 security incidents, and fiscal 2018 marked the first time in 12 years that federal civilian agents avoided major cyberattacks. 

But even as the program plans to expand to include state and local governments, most civilian agencies still lag behind when it comes to fully implementing the necessary measures to ensure network security and data protection. As agencies kick off the new year, those that have gaps in their security and aren’t fully in compliance with the Federal Information Security Management Act should reevaluate what steps they can take to benefit from the CDM program and meet federal cybersecurity requirements. 

Since its introduction in 2013, the CDM program has stood out as unique in the federal space because of its design and objective. The program is intended to remove obstacles faced by federal technology teams across civilian agencies, to offer Homeland Security support, and to provide Homeland Security with a full view of the threats these federal technology systems collectively face. To this end, the agency researched security tools and placed those that passed vetting on a CDM approved list, allowing agencies to use the CDM program to cover the cost of select solutions. From there, a four-phase approach rounds out the CDM program, encouraging agencies to properly implement these tools in the context of their system.

Barriers to Adoption 

While CDM seemingly eliminates two of the biggest obstacles to implementing a robust security program—cost and expertise—reluctance to comply still persists among some agencies due to misconceptions about the program. Some are daunted by CDM, believing that it will require a total overhaul of security structure. In actuality, the program is designed so that agencies can audit their current program and fill in the gaps through a manageable, step-by-step approach. 

Another source of confusion stems from the CDM-approved product list. Some are under the impression that they are mandated to use the tools on this list, when in fact agencies can continue to use other tools—provided they are still functional, effective and the agency has their own funds to cover the cost. 

Finally, other agencies may be reluctant to comply because it requires data sharing with Homeland Security, but these concerns are unwarranted. In viewing data, Homeland Security aims to be a second set of eyes to spot vulnerabilities. Its mission is to prevent security breaches, not pass down punitive action based on any findings. 

Benefits of Implementation

Once agencies move past misconceptions, CDM’s benefits are clear. In addition to saving money and streamlining operations, organizations that have already adopted CDM understand more about what’s happening within their networks. This knowledge empowers teams to quickly spot and deal with suspicious activity that would otherwise go unnoticed. For these agencies, the CDM program has also been a deterrent for hackers interested in the most vulnerable targets. As they become more difficult to infiltrate, bad actors tend to move on to lower hanging fruit. 

For agencies that may be farther behind in their security roadmap—or who may not have even started building one—the new year is a good time to start strengthening your security posture, taking a proactive approach to security. They should begin by first taking an inventory of their existing security tools. Once the agency knows what they have available, they can determine what tools they need in the short and long term. This should be done enterprise-wide to build a strong security system protecting the entire agency. 

Once the gaps are identified, the right tools can be acquired through the CDM program and implemented by Homeland Security and agency technology personnel. By working with the agency, Homeland Security becomes an extension of the technology team, stretching the capacity to monitor activity and improve defenses. Agencies can also use a third-party service provider for additional support. 

Whether federal agencies are fully compliant with FISMA or have yet to start, it’s important to remember that creating and maintaining a secure network should be thought of as a journey, not a destination. While the CDM program goes a long way toward securing agencies’ security infrastructures, it is not a silver bullet. The cybersecurity landscape is always changing and protecting against vulnerabilities is an ongoing process. All agencies will benefit if they consistently adopt lessons learned through the CDM program in their day-to-day operations.  

Marc Chenoweth is a technical consultant for Security at Force 3.