The stories that get the most ink on information security issues are usually the ones about massive data breaches and other foul-ups – especially if they happen within government.
That’s one of the reasons why the Bethesda, Md.-based SANS Institute has decided to come out with a list that focuses on what it considers to be some of the more successful security efforts within the federal government. “It gets old if all you ever do is take potshots” at entities that suffer breaches, said Alan Paller, SANS’ director of research.
The six initiatives in the SANS list were selected based on actual evidence of having made substantial and measurable improvements in one or more of three areas, according to Paller. Those three areas are the ability to prevent cyber attacks against critical infrastructure targets, reducing national vulnerability to cyber attacks, and minimizing damage and recovery time from attacks that do occur.
Among the six in the SANS list, which was released Monday, are the following:
The Federal Desktop Core Configuration (FDCC) initiative
The FDCC effort helps government agencies reduce procurement costs and bolster security of their desktop environments by requiring agencies to implement standard baseline security configurations on all their Windows XP and Vista desktops. The configurations were originally developed and used by the U.S. Air Force with help from the National Security Agency, Defense Information Systems Agency and the National Institute of Standards and Technology (NIST). The move helped the USAF reduce patching time from 57 days to less than 72 hours and helped reduce desktop procurement costs by over US$100 million for the USAF, the SANS report noted.
The USAF’s success has prompted an effort to implement similar baseline standards on millions of desktops across the government in the form of the FDCC. “The most important success in federal government cybersecurity to date is the Federal Desktop Core Configuration (FDCC) and its predecessor proof-of-concept project in the U.S. Air Force,” the SANS report said.
The US-CERT Einstein program
The Einstein Program is an initiative to improve cybersecurity-related situational awareness across the civilian federal government. The program enables full-time monitoring, sharing and analysis of network traffic data across federal agencies to help them more quickly detect and respond to cyberattacks. So far, 14 federal agencies have deployed Einstein monitors on their network gateways to capture network traffic information and feed it to an analysis program run by the US-CERT on behalf of the U.S. Department of Homeland Security.
This technology demonstrated its promise when it helped the Department of Agriculture quickly identify a system penetration based on an analysis of network packets that had been transmitted from its network to the Department of Transportation. The Einstein program is especially important “in an age of botnets where increasing numbers of federal systems are infected through spear phishing and then used to attack other organizations or to steal sensitive information,” SANS noted.
The National SCADA Test Bed and Control Systems Security Program
This effort was spurred largely by post-9/11 fears of cyberattacks against the nation’s power utility infrastructure. The Supervisory Control and Data Acquisition (SCADA) testbed program is designed to help identify vulnerabilities in the control systems that manage power plants, electric distribution systems, oil and gas pipelines, water systems, transportation systems, and dams. Vulnerabilities, when found, are reported to the vendors for remedial action, and become part of the required procurement checklist for future purchases.
The effort is led by the U.S. Department of Energy and a group of others including DHS, the State of New York, the Idaho National Laboratory, Sandia National Laboratory, Pacific Northwest National Laboratory (PNNL), and a consortium of control system vendors.
“Many vulnerabilities in control systems have been found and corrected, and, using the new procurement specifications, buyers of SCADA and control systems can tell vendors exactly what is needed,” SANS noted in their report.
The Department of Defense’s Common Access Card (CAC) program
The two-factor authentication supported by the DoD’s common-access smart card identity credentials has greatly strengthened access controls to non-classified defence systems. The SANS report quoted a USAF officer as saying that common access cards had contributed to a 46 per cent decline in successful intrusions of defence systems in 2006. The success of the CAC program has led to a broader effort to implement similar two-factor authentication systems government-wide under Homeland Security Presidential Directive-12 (HSPD-12), the SANS report said.
The other two efforts that made the SANS list were the General Services Administration’s SmartBuy program and a joint cybercrime-fighting program from the Department of Justice and the FBI.
The SmartBuy program is designed to reduce technology procurement costs through government-wide aggregation of common-of-the-shelf software products. On the security side, the program is allowing agencies to acquire encryption software at greatly reduced costs, according to SANS. The Justice Department’s Computer Crime and Intellectual Property Section (CCIPS) and the FBI’s Cyber Security Program office work together to combat cybercrime by going after and prosecuting cyber crooks more vigorously.
Related content:
Australian agencies fail to meet security expectations