Still early days for federal cybersecurity?
Connecting state and local government leaders
While Congress seems to understand the urgency of implementing cybersecurity solutions, critical technology that was recognized as essential years ago still isn’t fully deployed.
Government gets it in the neck frequently when it comes to cybersecurity, usually along the lines of it being too dense or too slow to react when problems arise. Some of that criticism is warranted, some not, but let’s give credit where credit is due.
House lawmakers were quick to jump on the revelation that Juniper Networks, which sells its popular NetScreen firewalls to many government agencies, had found flaws in the operating system that runs those firewalls. This defect would allow someone to remotely access a device through SSH protocols or telnet and then monitor and decrypt VPN traffic.
On Jan. 21, the House Committee on Oversight and Government Reform sent letters to the heads of major agencies asking them to audit their use of Juniper’s firewalls and report by Feb. 4 on how they might have been affected by the ScreenOS flaws and what corrective measures they took prior to Juniper releasing a software patch on Dec. 20.
The committee’s fast action follows the devastating breach at the Office of Personnel Management last year, which went undetected for several months. A year earlier, major problems were found with the widely used OpenSSL protocol, which may still be affecting systems around the world today.
It will be interesting to see what the House committee finds. Any agency that is on top of its security game should already have done that Juniper audit and should have no problem providing the information requested. Those that haven’t may have to scramble, and any committee report should show the extent of that.
Other elements of the government’s security status aren’t developing so quickly. Last year, the Government Accountability Office gave its regular report on the status of government cybersecurity, giving a lukewarm review of the Department of Homeland Security’s EINSTEIN program, more formerly known as the National Cybersecurity Protection System (NCPS).
EINSTEIN was designed some years ago to be a central plank in the government’s overall cybersecurity posture, aimed at providing agencies with intrusion detection, intrusion prevention, analytics and information sharing technologies. If those tools were fully in place across agencies, breaches such as those at the OPM and other agencies may have been prevented, or at least noticed and mitigated much sooner than they were.
Getting EINSTEIN in place governmentwide has been frustratingly slow, however, and according to the latest GAO report on the system, that sluggish pace continues. The DHS program is still only partially meeting its objectives, GAO said, and is deficient in all four areas examined.
With intrusion detection, for example, it can only compare network traffic to known signatures of malware, which covers maybe 80 percent of the bad stuff. The other malicious activity, which contains the advanced persistent threats that do most of the damage these days, requires more sophisticated detection.
Likewise, EINSTEIN now only prevents intrusion of particular kinds of malicious data, but it can’t block the kind that’s hidden inside the web traffic itself. DHS says it plans to deliver that capability sometime this year.
Overall, the uptake of EINSTEIN has been spotty, because of deficiencies at the agencies or the DHS itself. All of the 23 agencies required to implement intrusion detection capabilities had routed at least some of their traffic through the NCPS sensors, the GAO said, but only five were receiving intrusion prevention services. Agencies had not taken all of the technical steps needed to implement the system, in part because the DHS had not yet provided them with the necessary guidance.
It’s all an example of the strange and often puzzling disparities in the government’s approach to security. On the one hand, at least some parts of Congress seem to understand the urgency and are prepared to pressure agencies to move faster. On the other, critical technology that was recognized as essential years ago still isn’t fully deployed.
NEXT STORY: How local government can manage technology risk