Career development can boost incident response
- By Lauren C. Williams
Investing in workforce training and education is essential to improving the government's ability to respond to cyber incidents, according to federal chief information security officers.
Department of Homeland Security CISO Jeffrey Eisensmith said that if budgets weren't an issue, he would put a significant investment into workforce retention by instituting performance-based training and testing. He made the comments during a panel discussion on CISO priorities for 2018 at the Sept. 13 Billington Cybersecurity Summit in Washington.
Essye Miller, the Defense Department's deputy CIO for cybersecurity, said, "The investment piece in this is very important, but it has to be holistic." The efforts must also include the proper education of contractors and other industry partners.
The panelists, who represented the intelligence community and the departments of Treasury, Defense, Health and Human Services, and Homeland Security, agreed that President Donald Trump's cybersecurity order provided the necessary framework to guide those investments.
"The executive order gave us specific direction to make those investments," and encouraged leaders to seek out their vulnerabilities and address them, said Jack Donnelly, the Treasury Department's CISO and associate cybersecurity CIO. "Find your greatest risk and then systematically address them."
The DOD was already in process of implementing the requirements of the order, but Miller said its signing helped shift the agency's internal perspective.
"We have to move from this compliance based environment to one where we're doing real risk assessment," she said. The cyber order's framework directive "shifted the conversation of it to include our industry partners" and tackle the challenge of sharing information with industry and "having our industry partners bringing back information to us if they haven't already."
For Ret. Vice Adm. Michael McConnell, the former director of national intelligence and the NSA, incident response is a weak point that needs to be reinforced.
"I want to be really good at incident response…to respond to any kind of threat within minutes, not find out 226 days after," he said. "I want to know when the threat is and be able to defeat it within minutes, not days, not weeks. And the only way to do that is to do information sharing at the tactical level."
In a separate keynote address, Director of National Intelligence Dan Coats called out attacks on infrastructure -- as well as on defense networks and technology companies, falsifying data and disinformation campaigns -- as a primary concern.
Coats also drove home the need for the intelligence community, government at large, and private companies to maximize gathered intelligence through collaboration.
"We need to find better ways to work together," by pooling resources and engaging the private sector, Coats said. "Government may have a competitive advantage in detecting malicious activity and possible understanding an actor's capabilities and intent," he added, "but this threat information, as important as it is, this information alone is not sufficient."
During the CISO panel, Donnelly said that infrastructure management should have the same element of precision as insurance actuaries when it comes to risk assessment.
"What's the risk of not replacing the infrastructure and what's the return?" he asked. "It has to be just like the insurance organizations: you're this old, you're in this health condition, we're going to charge you this much." Just as actuaries use available data and statistics to make a risk determination, Donnelly said, cyber professionals should too.