The final results of the 30-day cybersecurity sprint will be more than just some quick improvements to agencies’ IT security. By the end of the summer, the Office of Management and Budget will issue the Federal Civilian Cybersecurity Strategy, the culmination of work done by various interagency cyber sprint teams.
While agencies rushed to shore up their own systems over the last 30 days, cybersecurity professionals from OMB E-Gov, the National Security Council Cybersecurity Directorate, Department of Homeland Security and Department of Defense were working on a plan to make sure a breach like the one at Office of Personnel Management doesn’t happen again.
OPM Data Breach: What You Need to Know
The teams have been reviewing the official cybersecurity policies at each agency and across the federal government as a whole to determine which agencies are on track and where there are major holes.
The effort has been focused on eight areas:
- Protecting Data: Better protect data at rest and in transit;
- Improving Situational Awareness: Improve detection and warning;
- Increasing Cybersecurity Proficiency: Ensure a robust capacity to recruit and retain cybersecurity personnel;
- Increase Awareness: Improve overall risk awareness by all users;
- Standardizing and Automating Processes: Decrease time needed to manage configurations and patch vulnerabilities;
- Controlling, Containing and Recovering from Incidents: Contain malware proliferation, privilege escalation and lateral movement. Quickly identify and resolve events and incidents;
- Strengthening Systems Lifecycle Security: Increase inherent security of platforms by buying more secure systems and retiring legacy systems in a timely manner; and
- Reducing Attack Surfaces: Decrease complexity and number of things defenders need to protect.
The final strategy document will take the lessons learned from these reviews, as well as known best practices to produce a guidebook to help agencies be more secure.
Federal CIO Tony Scott is coordinating this effort and will be releasing the Cybersecurity Strategy later this summer.
