Federal CISOs agree that investment in workforce training and education is the key to increasing incident response capabilities.
If budgets weren’t an issue, Department of Homeland Security CISO Jeffrey Eisensmith said during a panel on CISO priorities for 2018 at the Sept. 13 Billington Cybersecurity Summit in Washington, D.C., he would put a “significant investment in workforce both in training and retention” by instituting performance-based training and testing.”
Essye Miller, the Defense Department’s deputy CIO for cybersecurity, emphasized a “holistic” approach that included education of contractors and government workers.
“The investment piece in this is very important but it has to be holistic,” Miller said, adding that efforts must include the proper education of contractors, corporate managers and industry partners to develop appropriate security posture.
The panelists, who represented the intelligence community and the Departments of Treasury, Defense, Health and Human Services, and Homeland Security, agreed the president’s cybersecurity order provided the necessary framework to guide those investments.
“The executive order gave us specific direction to make those investments,” and encouraged leaders to seek out their vulnerabilities and address them, said Jack Donnelly, the Treasury Department’s CISO and associate cybersecurity CIO. “Find your greatest risk and then systematically address them.”
The DOD was already in process of implementing the requirements of the order, but Miller said its signing helped shift the agency’s internal perspective.
“We have to move from this compliance based environment to one where we’re doing real risk assessment,” she said. The cyber order’s framework directive “shifted the conversation of it to include our industry partners” and tackle the challenge of sharing information with industry and “having our industry partners bringing back information to us if they haven’t already.”
For Ret. Vice Adm. Michael McConnell, the former director of national intelligence and the NSA, incident response is a weak point that needs to be reinforced.
“I want to be really good at incident response…to respond to any kind of threat within minutes, not find out 226 days after,” he said. “I want to know when the threat is and be able to defeat it within minutes, not days, not weeks. And the only way to do that is to do information sharing at the tactical level.”
In a separate keynote address, Director of National Intelligence Dan Coats called out attacks on infrastructure — as well as on defense networks and technology companies, falsifying data and disinformation campaigns — as a primary concern.
Coats also drove home the need for the intelligence community, government at large, and private companies to maximize gathered intelligence through collaboration.