DOD raises the bar on info assurance

The job requirements for 80,000 Defense Department information assurance personnel just got tougher.DOD’s newly issued information assurance manual requires services and Defense agencies for the first time to formally identify all employees with responsibility for any aspect of IA, assign them positions within a new organizational structure and ensure that each worker has the certifications required for that position.The IT business community is affected as well. The manual requires that contractors who work in IA meet the same certification requirements and that people in jobs with significant responsibility be U.S. citizens.The Pentagon acquisition community is expected to make the requirements part of all new contracts.DOD finalized the manual, Information Assurance Workforce Improvement Program, DOD 8570.1-M, in December. It was issued by John Grimes, Defense CIO and assistant Defense secretary for networks and information integration.“In my personal opinion, it’s the number one accomplishment we’ve had” in 2005, said Robert Lentz, who works for Grimes as IA director and was a primary contributor to the manual.Lentz said this is the first time Defense has laid out a comprehensive IA architecture.“The joint staff back in 2003 had a computer network defense manual that specified the need for training and certification, but it didn’t apply to all of DOD, and it was very decentralized regarding what constitutes certification,” he said.While the manual establishes a centralized structure for IA personnel and has extensive reporting requirements, Lentz said his team opted to specify a mix of commercial certifications, online learning, continuing education and hands-on experience for IA professionals.The certifications identified in the manual are provided by the Computing Technology Industry Association, the International Information Systems Security Certifications Consortium, the Information Systems Audit and Control Association, SecurityCertified.Net and the SANS Institute of Bethesda, Md.The new IA workforce structure could be the basis of a governmentwide approach to security, Lentz said. Grimes chairs the Committee for National Security Systems, an interagency group governed by the White House.“We have quarterly meetings, [and] I’ve asked that that question be raised.” Lentz said. “Let’s see what other agencies can do with our manual. We’ve done a lot of spadework.”Lentz’s team also has been talking with the Office of Management and Budget about its Lines of Business initiative and whether this approach to IA could be applicable across the board, he said.Organizations and personnel affected by this overhaul will have up to four years to make the changes. The manual calls for 10 percent of the IA workforce at all levels to meet the training requirements in the first year, with another 30 percent meeting them each year. There is some flexibility about waiving certifications, especially in combat areas, but the requirements are deferred only temporarily.The manual also sets training standards for every authorized user of Pentagon IT systems. Individuals will get instruction in recognizing both outsider threats—phishing schemes, viruses, worms, Trojan horses and so on—and such insider threats as disgruntled employees or suspicious activity.The manual is available online. In addition, the military has set up a Web portal dedicated to IA (www.gcn.com, Quickfind 531), including an FAQ for security professionals.Alan Paller, director of research at SANS, agrees with Lentz on the importance of establishing the new IA structure and training, but he is unhappy with the entry-level certification requirements.“This is probably the single most important shift in skills, the most important move to improve the skills of people who protect computers in DOD, that has ever been taken,” he said. “But right now, at the bottom, where people actually put their hands on the machines, it has nothing to do with skills. ... It’s like telling the person who has to fly the airplane that he has to get certified as an air traffic controller, but not teaching him to fly the airplane.”Paller said the problem could be corrected with a model from one of the nuclear labs, which establishes a progressive certification, requires continuous upgrading of skills and “pulls the plug” on those who don’t keep their skills current.“They’ll put $100 million in this program and snatch defeat from the jaws of victory,” he said. “That’s how much they’ll put into it over the next few years.”Lentz dismissed Paller’s criticism.“I respect Alan, but our team looked [with industry] at various options in implementing the manual,” he said. “We felt that it was better to not have a one-size-fits-all, big-daddy certification, but to establish a baseline certification that provides a mechanism for continuous learning, local training and certification. We felt, because DOD is so large and diverse, we wanted some decentralized standards. ... We may move to a more expansive certification down the road.”