Industry Report Warns: Federal CISO Could Be ‘Disruptive’

deepadesigns/Shutterstock.com

The new federal IT security chief needs clearly defined job responsibilities and “top-down” support to be effective.

The Obama administration’s move to hire the first-ever federal chief information security officer in the wake of wide-scale hacking of government computer systems is a positive step, according to a group of industry executives that advises the president.

But adding the new role could be “disruptive,” the execs warn and the CISO needs clearly defined job responsibilities and “top-down support” to be effective.  

That’s one of the recommendations from the National Security Telecommunications Advisory Committee, a group of 30 industry executives who advise President Barack Obama on technology and national security.

The group presented the recommendations in a March 10 letter to Obama.

Earlier this year, the committee was tasked with weighing in on the administration’s Cybersecurity National Action Plan, released last month in connection with the president’s fiscal 2017 budget request. Along with hiring a CISO, the plan also called for upping annual spending on information security by more than 35 percent and establishing a federal commission on cybersecurity.

CISO Needs Top-Down Support

The committee recommended the CISO have the authority to assess risks across agencies, establish baseline security requirements and measure compliance.

In addition, the committee recommended the CISO play a key role in setting and approving IT security-spending priorities.

“In industry’s experience, CISOs must have the authority to approve or escalate inquiries about the development of appropriate technologies and processes being considered for deployment,” the letter stated.

Still, the committee cautioned, carving out a new IT security chief can be “disruptive,” especially if the new position’s authority overlaps with or overshadows the work of existing officials, such as agency CISOs.

“Clearly designating a CISO’s responsibilities is key, and empowering a new CISO with top-down support and engagement is essential to minimize disruption,” the letter stated. “In industry’s experience, a one-off announcement is not sufficient; companies that have successfully integrated CISOs as empowered enterprise risk managers have done so over a period of time.”

Administration officials say they hope to hire and onboard the new CISO by May. The IT security chief will work out of the Office of Management and Budget under U.S. Chief Information Officer Tony Scott.

More ‘Red Team’ Penetration Testing

The committee also recommended the federal government identify and tighten security on high-value assets -- computer systems essential to national security or that contain personally identifiable information. As part of the 30-day “cybersecurity sprint” initiated last summer in the wake of the Office of Personnel Management breach, agencies were already directed to identify potential hacker targets.

The industry group suggested simply implementing basic cybersecurity hygiene would go a long way in plugging some of agencies’ vulnerabilities.

In addition, the group recommended the feds beef up their cyber intrusion and detection capabilities, including deploying “red teams” to try hacking into government networks.

“Industry has moved toward the use of ‘hunt’ teams to detect adversaries that have already established a foothold in their organizations’ systems,” the report stated. “The use of such teams is consistent with the assume-breach mentality and takes important steps toward learning more about adversaries, reducing the immediate and future impacts of an incident, and preventing incidents.”

In the 2017 budget, the Department of Homeland Security proposed increasing the number of federal civilian cyber defense teams, which proactively search for intruders on government networks, from 10 to 48.

(Image via /Shutterstock.com)

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.