“It’s not a matter of if you’re going to get compromised, it’s when, and it’s all about protecting the blast zone and how you are going to respond to it,” said Federal Executive Forum Host, Luke McCormack in a recent webinar as a response to issues stemming from cybersecurity. As more services go online and more data is stored in the cloud, agencies must be even more vigilant in protecting against cyber attacks.
Remote work has increased the average cost of a data breach by $137,000. Over the past year, because of the telework environment, agencies have had to reassess their security across all vectors and provide tools to defend against attackers. Ron Pontius, Deputy to the Commander, U.S. Army Cyber Command, Hemant Baidwan, Department of Homeland Security’s Acting Deputy Chief Information Security Officer, Freddy Mercado, Deputy Chief Information Security Officer at Defense Intelligence Agency, Martin Kessler, Verizon Business Group’s Chief Information Security Officer, Jim Richberg, Field Chief Information Security Officer at Fortinet, and Matthew Glenn, Senior Vice President of Product Management at Illumio recently met to discuss the ways in which federal agencies have increased cybersecurity capabilities.
Kessler stated that the idea of “embedding cyber into culture and in the processes was really put to the test during [the transition to remote working], because of the scale and the speed that it happened last year. The workforce shift also accelerated the adoption of cloud-based productivity tools and the migration of applications from on-prem to the cloud.” By thinking cyber first, workers can be proactive in their security approach. A “real priority is to improve our ability to detect and respond to malicious cyber activity. We all strive to put our posture as best we can. That reality is an adversary, if they work hard enough, can get into anything,” commented Pontius. “It’s a matter of how you deal with it, the speed of which you respond, and how you detect.”
At the Defense Intelligence Agency, “most of our work that we do is on a top secret network. When the pandemic happened, we had to go ahead and go into the unclassified world and establish VPNs so that we can collaborate. We’re actually going to stay with telework capability for the workforce. The pandemic showed us that we need to have something else in order to be able to operate,” commented Mercado. By increasing cybersecurity capabilities, workers will be able to access sensitive information on the network, while remaining at home.
On the Department of Homeland Security side, Baidwan stated that the NOSC initiative is helping to “mitigate the current cybersecurity challenges by providing real-time operational and security situational awareness. This model is also helping us in identifying potential issues with preventing outages and defending assets from hostile threats. One of the main things we are doing is really aggressively moving from on premise to hybrid cloud computing throughout the enterprise.”
Government agencies implement these initiatives in order to fortify their cybersecurity. In addition to these approaches, the people aspect of cybersecurity is just as important. Kessler commented that, “it is actually most impactful to double down on the people side of cyber. Cyber should be a part of governing councils, part of IT transformation plans, part of the product development lifecycle, and every single person in the company or in the agency should know beyond the shadow of a doubt that cyber is their responsibility.”
Through the collaborative work between cybersecurity plans, government agencies, and workers, agencies will be better protected against malicious attacks. “Cyber is an ecosystem issue. The only way that we will truly get out in front is if we collectively raise the bar across governments and other public sector organizations and companies around the world,” stated Kessler.
Since the beginning of the COVID-19 pandemic, agencies had to switch to telework platforms that further expand the attack surface. To continue to mitigate attacks federal agencies have had to reevaluate their offensive and defensive cyber postures as the threat landscape continues to evolve.
Interested in hearing more of this cybersecurity panel? Click here.
