Risk
2/24/2009
11:31 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%
Repost This

IT Security Remains Top Government CIO Priority

Those surveyed by TechAmerica say they'd also put IT infrastructure and management at the top of the list, including improvements in governance and standardization.

Cybersecurity remains the top priority of IT leaders in federal government, according to a wide-ranging survey of federal IT leadership and interviews with 53 government CIOs.

The interviews, sponsored by information technology trade organization TechAmerica, found that CIOs believe progress has been made over the past several years, but the government still needs a broad, inclusive security strategy that can adapt to meet evolving threats. Gary Galloway, deputy director of the Office of Information Assurance for the Department of State, said during a panel discussion that though the State Department has made progress with metrics for meeting security demands, government security measures are sometimes too blunt.

For example, the Office of Management and Budget requires that the State Department train all of its 40,000 or so employees in IT security.

"If you think about the way any embassy operates, a good deal of those people are security guards, gardeners, cooks, and maids," he said. "How exactly do we go about training them? Some of these people never even use a computer, so it becomes difficult to think those folks should be trained in some aspect of IT security."

Other major areas of focus TechAmerica found in interviews include IT infrastructure and management, including improvements in governance, standardization, and development of enterprise architectures. While one size won't always fit all in the federal government or even within government agencies, government CIOs told TechAmerica they are looking for better enterprise IT infrastructure across the government.

The National Institute of Standards and Technology, for example, has established an IT planning board within the last few years to gather information about what priorities should be as supported by NIST employees' and managers' needs. Last year, NIST expected a budget shortfall and was able to plan for that by using the IT planning board to prioritize projects. NIST also is consolidating and centralizing its IT organization, including developing a technical reference architecture to help guide investments for the overall organization.

A new government process called IT Infrastructure Line of Business should push agencies to meet cost and performance objectives with new projects, but CIOs said it started far too late in President Bush's final term -- within the last 18 months of the administration -- to be effective.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-0360
Published: 2014-04-23
Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376.

CVE-2012-1317
Published: 2014-04-23
The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by sending packets at a high rate, aka Bug ID CSCts37717.

CVE-2012-1366
Published: 2014-04-23
Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.

CVE-2012-3062
Published: 2014-04-23
Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains many IPv6 hosts, aka Bug ID CSCtr88193.

CVE-2012-3918
Published: 2014-04-23
Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to cause a denial of service (serial-interface outage) via certain Frame Relay traffic, aka Bug ID CSCub13317.

Best of the Web