Cybersecurity
-
Cyber attacks are a growing vulnerability for our homeland security and broader national interests - and federal employees are on the front lines. In fact, Politico recently reported that Congress and other government agencies face an average of 1.8 billion cyber attacks per month. Both the number of attacks and their sophistication continue to increase at an alarming rate. In many instances, the key to successfully combating an attack is stopping it at its entry point, which is often the unsuspecting federal employee. For example, the Politico report pointed out that \"…attacks are increasingly focused on infiltrating application software on Hill staffer computers…,\"noting: In the last five months of 2009, 87 Senate offices, 13 Senate committees and seven other offices were attacked by spear-phishing attacks, which appeared as e-mail messages to staffers urging them to open infected attachments or click on bad links. It is critical that federal employees understand the possible types of cyber attacks in order to guard against them. Creating an awareness of cyber threats is only the beginning. Addressing a persistent and evolving threat requires persistent and evolving training. A number of key elements are required for any near-term or long-term cyber security training effort to succeed. Cyber security must be an agency priority. Cyber security education and training are much like any other agency initiative: if leadership indicates that something is a priority, agency employees will take action. Agency leadership must make it clear that cyber security education and training are a priority, model the behavior they ask of their employees, and dedicate resources to address the problem and its solution. If they do so, federal employees will respond accordingly. Education and training must be continuous. Hackers, terrorists, and other bad cyber actors do not wait for reporting requirements or other compelling organizational issues to decide when to attack - they just do. Education and training efforts should be ongoing, consistently updated, and test employees\' understanding of the topic on a regular basis. Agencies must be as persistent and agile in their training as cyber attackers are in their efforts to do harm. All agency employees must be included in training. All agency employees, and their contractors, are vulnerable to cyber attacks. No grade level is too high or too entry-level to be excluded from standard education and training. Reporting and accountability measures must be implemented. Accountability mechanisms should be used to not only identify those personnel who have or have not received cyber security training, but also on how well they retain the information they have learned. The use of cyber security quizzes or other mechanisms to test the workforce\'s cyber knowledge provide a quantitative measure of the effectiveness of the training program as well as targeting specific personnel or subjects for deeper training. The techniques used to attack information networks and exploit information are quickly evolving to the point where it is almost impossible to distinguish intrusion activity. The federal government must use an educated workforce on the cyber threat as a force multiplier as part of its cyber security strategy. Individual employees and agencies must share the responsibility for anticipating and preventing cyber attacks from succeeding.
March 19, 2010 -
-
Expert says the federal government has a lot of clout that it\'s not using. In its buying power, it needs to insist on safer software when they buy it ... things can move in the right direction.
March 05, 2010 -
There is a new alliance in the battle for cybersecurity. Though neither side has confirmed it, The Washington Post recently reported that Google has asked the NSA to help investigate the mid-December cyber attack against its networks \"to better defend Google - and its users - from future attack.\" This partnership demonstrates the increasing interdependencies between the public and private sector in defending against cyber threats.
February 17, 2010 -
The Air Force\'s new cyber organization received the \"ready\" sign to move to initial operating capability.
January 26, 2010 -
IDG says hackers can eavesdrop on GSM phone conversations
December 29, 2009 -
Online criminals have taken advantage of the large social media following, exploiting users\' willingness to respond to messages that are supposedly from people they know and trust.
December 11, 2009 -
Read more about that bill on the Hill.
December 07, 2009 -
The company is announcing the Cyber Security Research Consortium, in conjunction with three educational institutions.
December 01, 2009 -
Ponemon Institute study details why.
November 23, 2009 -
The councils will focus on three main areas to develop competency framework. Agencies have until Jan. 15 to submit data about how they classify cyber positions. Interagency working group also will conduct a survey of cybersecurity workforce in the spring.
November 23, 2009 -
-
We learn what\'s coming up on tomorrow\'s Federal Security Spotlight.
November 11, 2009 -
OMB has launched new tool to automate FISMA reporting. This data will help populate a new cybersecurity dashboard, federal CIO Vivek Kundra says. OMB also wants to collect more specific data around how much and where agencies are spending money on IT security.
October 30, 2009 -
One of the challenges with cyber-security is that the discussion is often about worst-case scenarios.
October 22, 2009