A senior Pentagon official responsible for data management is calling for immediate action to secure networks based on a recent assessment of threats, a call that comes as the Defense Department is moving aggressively to modernize its systems under the chief information officer’s expanded authority provided this year by Congress.
“We have to start moving faster,” said Carmen Santos-Logan from the DOD CIO’s office. “We haven’t modernized our end-user security platform. Now we have to move out and figure out where we’re going.”
Santos-Logan spoke during a three-day meeting this month hosted by the Defense Information Systems Agency on IT modernization at its headquarters at Ft. Meade, MD. The “summit” included about 250 representatives from U.S. Cyber Command, the DOD CIO and the Joint Force Headquarters, as well as system administrators, analysts and users, according to a summary statement of the meeting issued by DISA on Tuesday.
“We’ve done a lot of work at the integrated product team (IPT) level,” said Diane Phan, DISA’s Endpoint Security program manager and summit host. “This was a chance to get everyone’s input and make sure that as a community we’re moving forward,” Phan said in the DISA statement.
The Feb. 5–7 meeting was intended as a significant step for guiding DOD efforts for modernizing systems to protect data and networks, with implications across industry sectors.
“Participants used the summit as an opportunity to exchange information about their efforts and endpoint approaches; present requirements; discuss research, testing, and planning efforts; and explore the way ahead for an enterprise endpoint security solution,” according to DISA.
An “operational” working group on endpoint security, which will meet weekly, has been tasked with developing next steps based on input from the meeting. The group includes representatives from CYBERCOM, DOD CIO and Joint Force Headquarters.
“Endpoint security is a very important topic right now. At the senior levels, we recognize the value of a modernized enterprise solution,” said Navy Rear Adm. Kathleen Creighton at the meeting.
The first day of the meeting included an update of a “greenfield” analysis of threats conducted as part of the DOD Cybersecurity Architecture Review project, which guided discussions throughout the rest of the three-day meeting, according to DISA.
Participants heard about pilot projects and “endpoint security efforts” being used by the military services, combatant commands and DOD agencies. Endpoint security management is a software approach that allows network administrators to restrict access to specific users to ensure compliance with standards and operations.
“Efforts to modernize endpoint security aim to achieve a more standardized, interoperable, and secure set of capabilities that strengthen integrated threat analysis, defensive actions, and command and control across the DOD [information network] – from boundary to endpoints,” the DISA statement reads.
Under the Fiscal Year 2019 Defense Authorization Act, the DOD CIO was granted expanded authority beginning Jan. 1 to set IT security standards across the military services and to scrutinize budgets and spending for network modernization and interoperability.
DOD CIO Dana Deasy told a Senate Armed Services subcommittee on Jan. 29 the Pentagon was looking at options for certifying contractor compliance with cybersecurity requirements.
“We are just in the early discussions of how we might do this,” Deasy said.
In a series of memos issued over the past three months, DOD leaders have provided specific guidance for how acquisition personnel should apply a key contract clause requiring contractors to protect sensitive defense information and report cyber incidents.
The clause requires contractors to comply with security measures outlined in the National Institute of Standards and Technology special publication 800-171.
Interested in cybersecurity? Learn more about the 3 key trends that will change cybersecurity strategies in 2019.