To make the grade, NRC takes a personal approach

The Nuclear Regulatory Commission’s systems have a big, red bull’s-eye on them.Every day, the agency’s systems face about 500 attempts at reconnaissance and 100 attempted denial-of-service attacks, CIO Ellis Merschoff said.And every day, NRC’s security systems strip out roughly 300 suspicious e-mail attachments and isolate about 10 virus occurrences, he added.Last year, the agency reported more than 67,000 security incidents to the Federal Computer Incident Response Center.It’s no wonder then that officials at the commission’s headquarters relentlessly hammer away about the importance of IT security awareness. The word to NRC’s 3,000 employees—who exchange about 100,000 e-mail messages a day and receive another 40,000 via the Internet—is clear and unequivocal: You’re accountable.“The message is individual responsibility,” said Louis Numkin, an NRC senior computer security specialist. “Each employee is an agent of the agency and has a responsibility to the agency as well as to their own integrity.”[IMGCAP(2)]The approach has paid off. NRC is the only agency to receive a full A grade on the federal computer security report cards issued by the House Government Reform Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census. (The National Science Foundation received an A-.)“We have an agency with the foresight to fund and support a computer security program,” Merschoff said. “That can’t be underestimated.”In some ways, NRC had a jump on security, spurred by the nature of its work. The commission regulates commercial nuclear power plants in the United States and the civilian use of nuclear materials; it goes without saying that a security breach at the agency could be catastrophic.Its computer security program predates the Web, dating from 1980, about five years after it took over from the former Atomic Energy Commission and became an independent regulatory agency.NRC’s history of focusing on technical safety and security may have given it an edge over other federal agencies in meeting goals and requirements under the Federal Information Security Management Act and making the grade under Congress’ watchful eye.“We’ve managed to build on this each year since 1980 to get to the point where we are today,” Merschoff added. His security team includes acting senior information security officer Charlotte Turner and senior computer security specialists Numkin, Louis Grosman and Kathy Lyons-Burke.The agency stresses IT security awareness from the top down. “We require everyone, including the commissioners, to take computer-security training annually,” he said. “When my boss takes training, it puts a whole lot more pressure on me, which puts pressure on those below me.”NRC’s employees and contractors must take a 10-part, self-paced course—they can do it online—followed by a quiz to gauge what they’ve learned. If they pass the quiz, they receive a certificate. The course takes about an hour, Turner said.By the end of last year, 99 percent of the commission’s employees, interns and contractors had satisfactorily completed the course.The agency also requires its 33 systems security officers to take separate online coursework on computer security.Being keen on security is infectious at NRC. An additional 255 employees and contractors have taken the senior-level course to further their knowledge and understanding of IT security. Besides the training, the commission also hosts an annual computer security awareness day, coinciding with the International Computer Security Awareness Day.Last November, the event drew about 1,000 employees who listened to speeches and presentations, visited vendor exhibits and collected informational brochures.The commission has even created an IT security mascot, CyberTyger, whose cartoon image is ubiquitous around the agency. CyberTyger appears on posters, brochures and giveaway items, and in the agency newsletter.These efforts have produced marked improvement in security—the agency’s recent A grade was up from a C in 2002.“The commission has a bunch of focused people who are dedicated to the task of being compliant with FISMA as early as possible,” said George Schu, vice president of the public-sector group for VeriSign Inc. of Mountain View, Calif., which provides security consulting to NRC.But the A grade doesn’t mean it can’t do better.For example, the inspector general’s office for the commission, in its 2003 security report to the Office of Management and Budget, found that NRC’s master inventory needs improvement, “as limited segments of the NRC IT infrastructure are being examined.”A full inventory of critical IT assets is a major obligation in implementing FISMA and a prelude to certifying and accrediting IT assets for security, another FISMA mandate.Merschoff agreed that NRC’s inventory management could be enhanced.“It’s an essential part of FISMA,” he said. “But it’s difficult. We hope to continue to stress and improve in that area in the next year.”Merschoff explained that one of NRC’s hurdles in getting a handle on its technology assets is accounting for specialized applications.“We have only 3,000 employees, but we’re an organization dominated by engineers and scientists,” he said. “They tend to work in diverse areas that require specialized software support, anything from thermohydraulic computer codes to detailed security analyses.”“We have the heart of the inventories under control and our biggest challenge is assuring that special-use, peripheral applications are fully accounted for,” Merschoff said.To be sure, the muscular role of the IG helps keep NRC security officials on their toes.FISMA requires agencies to have their information security programs and practices independently evaluated each year, either by the agency IG or an independent auditor.Merschoff described the relationship between NRC’s CIO office, which is responsible for managing the commission’s information security program, and the IG as “a good, healthy dynamic tension.”That means the CIO’s office and IG auditors don’t always see eye to eye.“They take an independent look and come to the table with findings,” he said. “Sometimes we disagree, and sometimes we agree. When we disagree, they’ll listen, and in the end we may agree to disagree with the findings or we may find a common area of agreement. But they’re always willing to hear us out, and we’re willing to listen to their findings.”The bottom line, though, is that the open dialogue between the two offices gets results.“We recognize that the audits are to help us to get better,” Merschoff said. “It works because the IG has independent talent that’s equivalent to our own in terms of experience and competence.”The success so far of NRC’s IT security program illustrates that much of security and compliance with regulations and laws is really about process and procedures, VeriSign’s Schu said.“It’s not always so much about technology,” he said. “It’s not always about having the best firewalls or the best virtual private networks or the best intrusion detection system. You can have all that stuff but if you have sloppy policies and procedures, it’s just not going to make the grade.”The commission’s biggest challenge is dealing with the tension between keeping up the pace of mission accomplishment and having a slow, rigorous and disciplined approach to IT security, Merschoff said.“It would be easy to do things quickly, but that’s the wrong answer,” he said. “We have to do the right things just fast enough.”