Risk
2/24/2009
11:31 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

IT Security Remains Top Government CIO Priority

Those surveyed by TechAmerica say they'd also put IT infrastructure and management at the top of the list, including improvements in governance and standardization.

Cybersecurity remains the top priority of IT leaders in federal government, according to a wide-ranging survey of federal IT leadership and interviews with 53 government CIOs.

The interviews, sponsored by information technology trade organization TechAmerica, found that CIOs believe progress has been made over the past several years, but the government still needs a broad, inclusive security strategy that can adapt to meet evolving threats. Gary Galloway, deputy director of the Office of Information Assurance for the Department of State, said during a panel discussion that though the State Department has made progress with metrics for meeting security demands, government security measures are sometimes too blunt.

For example, the Office of Management and Budget requires that the State Department train all of its 40,000 or so employees in IT security.

"If you think about the way any embassy operates, a good deal of those people are security guards, gardeners, cooks, and maids," he said. "How exactly do we go about training them? Some of these people never even use a computer, so it becomes difficult to think those folks should be trained in some aspect of IT security."

Other major areas of focus TechAmerica found in interviews include IT infrastructure and management, including improvements in governance, standardization, and development of enterprise architectures. While one size won't always fit all in the federal government or even within government agencies, government CIOs told TechAmerica they are looking for better enterprise IT infrastructure across the government.

The National Institute of Standards and Technology, for example, has established an IT planning board within the last few years to gather information about what priorities should be as supported by NIST employees' and managers' needs. Last year, NIST expected a budget shortfall and was able to plan for that by using the IT planning board to prioritize projects. NIST also is consolidating and centralizing its IT organization, including developing a technical reference architecture to help guide investments for the overall organization.

A new government process called IT Infrastructure Line of Business should push agencies to meet cost and performance objectives with new projects, but CIOs said it started far too late in President Bush's final term -- within the last 18 months of the administration -- to be effective.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
121 Pieces of Malware Flagged on NSA Employee's Home Computer
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/16/2017
Mobile Malware Incidents Hit 100% of Businesses
Dawn Kawamoto, Associate Editor, Dark Reading,  11/17/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.