One of the best moments of U.S. Citizenship and Immigration Services\u2019 Adrian Monza\u2019s career was the day the agency received a 40-pound box filled with the shredded remains of its mainframe\u2019s hard drive.<\/p>\n\n\n\n
The chopped-up pieces meant USCIS had one less piece of old technology with high security risks.<\/p>\n\n\n\n
Now, USCIS is undergoing a \u201cvery significant\u201d modernization, said Monza, USCIS\u2019 cyber defense branch chief, so system vulnerabilities are again fresh in everyone\u2019s mind.<\/p>\n\n\n\n
\u201cOne of the challenge points, just looking at what\u2019s going on in the \u2026 larger ecosystem is the susceptibility of the software supply chain,\u201d Monza said.<\/p>\n\n\n\n
He noted that right now supply-chain attacks are often focused on financial databases, but he warned that agencies need to be prepared to defend themselves against a potential attack.<\/p>\n\n\n\n
\u201cIt\u2019s only a matter of time until someone gets the bright idea and says, \u2018Hey this is a great way into government systems as well,\u2019\u201d Monza said. \u201cAnd, so, focusing on identifying that supply chain and securing it is really a focus for us.\u201d<\/p>\n\n\n\n
The modernization effort at USCIS is making its officials more aware of its risks in the system development process.<\/p>\n\n\n\n
\u201cOne of the things that we\u2019ve seen as we\u2019re trying to modernize systems is that we\u2019re pushing a lot of development and then that\u2019s training our ability to assess what\u2019s going on,\u201d Monza said.<\/p>\n\n\n\n
On the Department of Defense side, the Air Force has done several rounds of penetration testing to identify vulnerabilities in its system over the last four years, Air Force Chief Information Security Officer Wanda Jones-Heath said.<\/p>\n\n\n\n
\u201cWe found a lot of success,\u201d Jones-Heath said. \u201cWe know that we have some issues and we\u2019ve fixed those.”<\/p>\n\n\n\n
Another aspect of agency cybersecurity is continuous monitoring of the agency\u2019s environment, which Jones-Heath said the Air Force has deployed across the service. Through the monitoring tool, she can view the Air Force\u2019s cybersecurity posture. All these tools allow Jones-Heath \u201cto be able to stay ahead of the episode,\u201d she said.<\/p>\n\n\n\n
Still, agencies must manage decades-old legacy systems that run key operations, which agencies don\u2019t always completely shut down. Jones-Heath said that, in terms of security on legacy systems, \u201cyou have to meet them where they are.\u201d<\/p>\n\n\n\n
Jones-Heath said the service layers security measures on Air Force legacy systems. In some cases, she said, nothing can be done to improve the legacy system.<\/p>\n\n\n\n
\u201cThen you go and look at the threats. If the intel threat doesn\u2019t give you a picture of \u2018is it being attacked?\u2019 or anything like that, then you just monitor it and make sure that as patches come out, you patch,\u201d Jones-Heath said.<\/p>\n\n\n\n
Monza said that USCIS has a different approach to the security of legacy systems.<\/p>\n\n\n\n
\u201cThe job\u2019s not done until the old system is unplugged,\u201d Monza said. He added, \u201cyou can\u2019t just keep having browned-out systems left on your network. There\u2019s still vulnerabilities \u2026 you have to turn the old systems off.\u201d<\/p>\n\n\n\n
Jeanette Manfra, assistant director for cybersecurity at the Cybersecurity and Infrastructure Security Agency, said the federal government needs to expand modernization beyond the legacy systems and into the entire procurement process.<\/p>\n\n\n\n
\u201cWe\u2019re trying to talk about it broader \u2014 [it\u2019s] also modernizing our policies, our acquisition system \u2026 supply chain,\u201d Manfra said. \u201cLowest price technically acceptable [is] probably not the most secure solutions that you\u2019re going to get.\u201d<\/p>\n\n\n\n
She added later, \u201cWe\u2019re trying to get everybody to think about, what do we really care about? … How do we prioritize resources to make ourselves overall more secure and how do we become more flexible and resilient as a government?\u201d Manfra said.<\/p>\n\n\n\n
As for the tiny remnants of the UCIS mainframe, Monza said it still sits in his boss\u2019 office to serve as a reminder that systems must ultimately be turned off for agencies to stop worrying about them.<\/p>\n","protected":false},"excerpt":{"rendered":"
Security must be taken into consideration during the modernization process.<\/p>\n","protected":false},"author":7,"featured_media":25417,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":{"9":{"categories":["home","daily-brief","newsletters"],"primary_category":"home"}}},"categories":[63,106,31,110,14,33],"tags":[],"coauthors":[3242],"class_list":["post-23571","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud","category-daily-brief","category-home","category-it-cloud-report","category-it-networks","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"2S6Q3PIUZZCGTE4JYU5XIRZ6QE","arc_canonical_url":"\/it-networks\/cloud\/2019\/07\/18\/is-your-agency-vulnerable-during-an-upgrade\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n