The president’s budget proposal for 2017 included a number of initiatives and goals to bolster the nation’s cybersecurity, including the appointment of a new federal chief information security officer to lead the policy discussion around securing federal networks. What has yet to be determined is\u00a0whether the federal CISO is an impetus for change or just another head to roll when things go wrong.<\/p>\n\n\n\n
Consider this: After the massive breach of Office of Personnel Management networks last year, agency officials were pulled in front of Congress for multiple marathon hearings while legislators tried to figure out where to place the blame.\u00a0Then-Director Katherine Archuleta stepped down a month after the news broke and former CIO Donna Seymour made it eight months before resigning just prior to what was sure to be another scathing committee hearing.<\/p>\n\n\n\n\n\n
At the time, OPM did not have a dedicated CISO managing cybersecurity for the department, putting the responsibility on the shoulders of the department head and lead technologist. If OPM had a CISO, that person likely would have been the first to go.<\/p>\n\n\n\n
Ensuring this new position, expected to be named as early as May, isn’t just a scapegoat when something goes wrong will be difficult, according to Stan Dolberg, chief research officer at the Institute for Applied Network Security (IANS).<\/p>\n\n\n\n
“In general, whenever an organization creates a new position of this type \u2014\u00a0or any type \u2014\u00a0the first person to occupy it is by definition a sacrificial lamb,” he said. “They’re going into an environment that isn’t organized to support them \u2026 They will probably fall short in the time allotted to them to make the difference they’re expected to make.”<\/p>\n\n\n\n
But that certainly isn’t the goal here.<\/p>\n\n\n\n
Phil Gardner, IANS CEO, framed the issue with a series of questions:\u00a0Is this position more about policy\u00a0or technical prowess? How does the individual\u00a0deal with some of the power players on the block like the National Security Agency, the CIA, the intelligence community and the Department of Defense?<\/p>\n\n\n\n
The most important measure as to whether this person will be successful is the person themselves, according to experts. If the Office of Management and Budget \u2014\u00a0where this position will reside \u2014\u00a0finds the right person with the right mix of skills, they can be successful.<\/p>\n\n\n\n
So what are those skills?<\/p>\n\n\n\n
Understands the technology<\/strong><\/p>\n\n\n\n First and foremost, this person will have to understand the technology: both the innate security problems created by connecting everything to the network and the technical solutions available to keep information secure.<\/p>\n\n\n\n Cybersecurity is a swift-moving sector attempting to adapt and react as quickly as the adversary, whose primary advantage is agility.\u00a0A qualified CISO will have a strong command of the technology and the issues involved and will be able to keep up with changes in the marketplace and the threat space. Moreover, they will be able to apply that knowledge to setting policies that will help agencies at the operational level.<\/p>\n\n\n\n “A CISO, in general, is much more operational than policy oriented,” said Ari Schwartz, managing director of cybersecurity services at Venable, a D.C. law firm, and former White House adviser and senior director for cybersecurity with the National Security Council. “It’s important that this person have operational expertise, even if the role is just overseeing other operational people.”<\/p>\n\n\n\n While the position will be stationed at OMB, that agency already has a cybersecurity division handling internal security issues. Instead, the federal CISO will be focused on governmentwide policy that will affect everyone, not the day to day.<\/p>\n\n\n\n That said, if the person doesn’t have the technical chops, they won’t get the respect and won’t be effective.<\/p>\n\n\n\n Schwartz noted there are a lot of policies that come out of OMB, many of them around IT. However, if an agency doesn’t want to follow those policies, they have ways of “dragging their feet” and otherwise stalling with the expectation that another, more favorable policy will eventually come about.<\/p>\n\n\n\n “It’s just not acceptable to do that with security,” he said.<\/p>\n\n\n\n The federal CISO will have to be a technologist but they will also have to be a leader of people.<\/p>\n\n\n\n Understands the problem <\/strong><\/p>\n\n\n\n The cybersecurity “problem” generally has less to do with technology than with the people and processes around the tech. The best security posture in the world is useless if a user with poor cyber hygiene gives away the keys to the network.<\/p>\n\n\n\n To be successful, a CISO must have “two strong muscles,” Dolberg said. “One is technical but the other is organizational.”<\/p>\n\n\n\n “Organizationally, they have to influence the behavior of everybody in the organization. Everyone sitting at a computer with an Internet connection, their behavior has to be influenced by the CISO,” he said.<\/p>\n\n\n\n Getting that full organizational buy-in will require\u00a0enough authority and influence to make real change, according to Robert Shea, a principal at Grant Thorton Global Public Sector and former OMB associate director for administration and government performance.<\/p>\n\n\n\n Having “a governance structure that will provide some wisdom as to where those investments are going to go \u2026 A clear point of contact, someone who can lead this group is a good idea,” he said, and having say over funding is one clear way to ensure the federal CISO has influence.<\/p>\n\n\n\n “Cash is important \u2014\u00a0it’s not to be underrated as a source of authority,” Shea said.<\/p>\n\n\n\n In that same vein, the federal CISO will also have to practice what they preach.<\/p>\n\n\n\n The CISO needs to take the lead by “taking the budget that you’re given and showing that you are accountable for your spend,” Dolberg said. “In terms of how you’re budgeting, how you’re spending, how you’re resourcing, how you’re managing all your projects. Have a high level of transparency and set the example.”<\/p>\n\n\n\n Understands the government<\/strong><\/p>\n\n\n\n While there are far more experienced CISOs in the private sector to choose from, Schwartz said that might be the only benefit of looking outward.<\/p>\n\n\n\n “It could be someone from the private sector, if they get a good, qualified person,” Schwartz said. “It could also be someone who has really good experience inside the government, who has been a CISO or a CIO in the government and had a lot of security expertise and management expertise within the government. There’s something to be said for understanding how FISMA works and how the structure of the government works. If you’ve only been in the private sector, that’s hard to know and learning that is a heavy hill” to climb.<\/p>\n\n\n\n Ideally, this person will make the transition to the next administration. But if they don’t \u2014\u00a0or even if they do, really \u2014\u00a0time is short to make a difference before the next president’s team starts measuring cubicles. Tapping a career bureaucrat with an intimate knowledge of federal politicking could make a big difference.<\/p>\n\n\n\n\n\n “I think they need someone who can bridge that span into the next administration,” Schwartz said, noting a political appointment likely won’t survive the transition, even to another Democratic White House. Choosing an established bureaucrat will ensure this person “has the confidence of whoever comes in for the next administration that they weren’t put in there to be someone who is sticking around from the last administration \u2014\u00a0that they are someone who is competent to run security.”<\/p>\n\n\n\n To be successful, the CISO needs to view cybersecurity as more than just “a project they started. They really need to see it as an ongoing program,” Schwartz said. “If it’s just someone who’s looking to start up new events and roll out new policies that they can say happened under their watch, they’re not going to be seen as long-term successful.”<\/p>\n\n\n\n Rather, the person should be focused on bringing in a strong team and building relationships with agencies to figure out the best ways to solve the cybersecurity challenge.<\/p>\n\n\n\n “That’s going to be far more successful,” he said. Though, “It’s harder to do, too.”<\/p>\n\n\n\n If done right \u2014 the right person with the right authority \u2014 the position could be a force for change.<\/p>\n\n\n\n As Shea put it:\u00a0“This could be Superman.”<\/p>\n","protected":false},"excerpt":{"rendered":" Ensuring the new federal cybersecurity lead is effective will require finding the right person and giving them the right authority.<\/p>\n","protected":false},"author":7,"featured_media":46171,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[15],"tags":[],"coauthors":[2349],"class_list":["post-15739","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-management"],"acf":{"subheadline":"","legacy_arc_id":"JHMPGK6C5JEYFHUGMJRUY5DUAM","arc_canonical_url":"\/2016\/03\/21\/making-the-federal-ciso-more-than-just-a-head-to-roll\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n