• Complications stall DoD’s Cyber Command

    Learn more in today’s cybersecurity update.

  • GAO: Cybersecurity weak at all federal agencies

    Bill would make cybersecurity diplomatic priority, NSA on the Flash-Media Hunt, Senate stalls cyber commander to probe digital war

  • Federal CIO Vivek Kundra pushing agencies harder toward the cloud

    The move to the cloud in the Federal government is happening, but not as fast as Kundra would like.

  • Harris changing the IT tone at Dept. of Education

    The CIO at the Department of Education says his goal is to make the application of technology more efficient. April 15, 2010

  • Cybercriminals prey on the unemployed

    Income tax season spawns Internet spammer scams

  • Federal News Countdown for April 9nd

    My guest panel includes veteran OMB official Frank Reeder & former USPS CIO Bob Otto

  • Department of Energy reveals $100 million Smart Grid training program

    Learn more in today’s cybersecurity update.

  • DISA’s Stempfley heading to DHS’s cybersecurity division

    DHS also will make Randy Vickers the permanent head of U.S. CERT. Stempfley would become the first permanent NCSD director since 2007. The division’s oversight of federal civilian networks is growing more important with Einstein and TIC initiative.

  • ‘TigerText’ app seen as national security threat

    Microsoft slates 25-patch Windows update for next week, many PCs still vulnerable to Conficker worm, Chinese ISP momentarily hijacks the Internet

  • Former FBI CIO Zal Azmi forsees better cyber days ahead

    CACI International VP believes agencies are making progress on security

  • GAO applauds DHS critical infrastructure protection plan

    Some ex-employees turn to cybercrime

  • Industry Chatter: Lumension’s Pat Clawson

    Company’s Chairman and CEO warns that intellectual property loss could be one of biggest consequences of cyber shortcomings.

  • More federal cybersecurity fighters needed

    Learn all about it in today’s cybersecurity update.

  • Federal Cyber Security Education and Training

    Cyber attacks are a growing vulnerability for our homeland security and broader national interests – and federal employees are on the front lines. In fact, Politico recently reported that Congress and other government agencies face an average of 1.8 billion cyber attacks per month. Both the number of attacks and their sophistication continue to increase at an alarming rate.

    In many instances, the key to successfully combating an attack is stopping it at its entry point, which is often the unsuspecting federal employee. For example, the Politico report pointed out that ”…attacks are increasingly focused on infiltrating application software on Hill staffer computers…,”noting:

    In the last five months of 2009, 87 Senate offices, 13 Senate committees and seven other offices were attacked by spear-phishing attacks, which appeared as e-mail messages to staffers urging them to open infected attachments or click on bad links.

    It is critical that federal employees understand the possible types of cyber attacks in order to guard against them. Creating an awareness of cyber threats is only the beginning. Addressing a persistent and evolving threat requires persistent and evolving training. A number of key elements are required for any near-term or long-term cyber security training effort to succeed. Cyber security must be an agency priority. Cyber security education and training are much like any other agency initiative: if leadership indicates that something is a priority, agency employees will take action. Agency leadership must make it clear that cyber security education and training are a priority, model the behavior they ask of their employees, and dedicate resources to address the problem and its solution. If they do so, federal employees will respond accordingly.

    Education and training must be continuous. Hackers, terrorists, and other bad cyber actors do not wait for reporting requirements or other compelling organizational issues to decide when to attack – they just do. Education and training efforts should be ongoing, consistently updated, and test employees’ understanding of the topic on a regular basis. Agencies must be as persistent and agile in their training as cyber attackers are in their efforts to do harm.

    All agency employees must be included in training. All agency employees, and their contractors, are vulnerable to cyber attacks. No grade level is too high or too entry-level to be excluded from standard education and training. Reporting and accountability measures must be implemented. Accountability mechanisms should be used to not only identify those personnel who have or have not received cyber security training, but also on how well they retain the information they have learned. The use of cyber security quizzes or other mechanisms to test the workforce’s cyber knowledge provide a quantitative measure of the effectiveness of the training program as well as targeting specific personnel or subjects for deeper training.

    The techniques used to attack information networks and exploit information are quickly evolving to the point where it is almost impossible to distinguish intrusion activity. The federal government must use an educated workforce on the cyber threat as a force multiplier as part of its cyber security strategy. Individual employees and agencies must share the responsibility for anticipating and preventing cyber attacks from succeeding.