Ross: Defense only goes so far, real cybersecurity is agile

Security breaches are inevitable and no agency can be fully secure in its networks, said Ron Ross, senior computer scientist and information security researcher at the National Institute of Standards and Technology.

A more realistic goal is for government information technology to be resistant; agencies should assess how they operate while under attack to minimize damage, he added while speaking June 15 at a Washington, D.C., event called the Government IT Leadership Forum.

Under the preferred strategy of agile defense, agencies should have a plan for recognizing these malware breaches, bringing back the system to a known, secure state, and quickly removing implanted malware before it is on target long enough to do significant damage, said Ross.

Continuous monitoring, while a critical part of cybersecurity, "is not a strategy, it's a tactic," said Ross. Systems will become infected, at which time, said Ross, a static list of compliance requirements will not be helpful. Ross encouraged attendees to think of cybersecurity as a moving and evolving risk management framework.

Overall, Ross says the federal enterprise architecture desperately needs improvement and overhaul has not been a priority. This is working against government IT from a security standpoint, he said. "You need [cybersecurity] to help enable the mission, not hold it back," he said.

Related Articles:
Lieberman wants to give federal government power over Internet cybersecurity
Is the threat of cyber war exaggerated?
Loose networks sink ships
Bulk power system cannot be fully protected
U.S. electrical grid probed but not yet attacked, says paper