Risk
2/24/2009
11:31 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

IT Security Remains Top Government CIO Priority

Those surveyed by TechAmerica say they'd also put IT infrastructure and management at the top of the list, including improvements in governance and standardization.

Cybersecurity remains the top priority of IT leaders in federal government, according to a wide-ranging survey of federal IT leadership and interviews with 53 government CIOs.

The interviews, sponsored by information technology trade organization TechAmerica, found that CIOs believe progress has been made over the past several years, but the government still needs a broad, inclusive security strategy that can adapt to meet evolving threats. Gary Galloway, deputy director of the Office of Information Assurance for the Department of State, said during a panel discussion that though the State Department has made progress with metrics for meeting security demands, government security measures are sometimes too blunt.

For example, the Office of Management and Budget requires that the State Department train all of its 40,000 or so employees in IT security.

"If you think about the way any embassy operates, a good deal of those people are security guards, gardeners, cooks, and maids," he said. "How exactly do we go about training them? Some of these people never even use a computer, so it becomes difficult to think those folks should be trained in some aspect of IT security."

Other major areas of focus TechAmerica found in interviews include IT infrastructure and management, including improvements in governance, standardization, and development of enterprise architectures. While one size won't always fit all in the federal government or even within government agencies, government CIOs told TechAmerica they are looking for better enterprise IT infrastructure across the government.

The National Institute of Standards and Technology, for example, has established an IT planning board within the last few years to gather information about what priorities should be as supported by NIST employees' and managers' needs. Last year, NIST expected a budget shortfall and was able to plan for that by using the IT planning board to prioritize projects. NIST also is consolidating and centralizing its IT organization, including developing a technical reference architecture to help guide investments for the overall organization.

A new government process called IT Infrastructure Line of Business should push agencies to meet cost and performance objectives with new projects, but CIOs said it started far too late in President Bush's final term -- within the last 18 months of the administration -- to be effective.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3594
Published: 2014-08-22
Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.