Unpacking the President’s Cybersecurity Executive Order

Unpacking the President’s Cybersecurity Executive Order How the EO Impacts You and Your Agency

Table of Contents 24 · What the EO Means for the Cloud Cybersecurity and the Cloud Details

3 · Executive Summary

4 · At a Glance: Government Cybersecurity Nationwide

27 · How to Innovate in Cybersecurity

(or Anything Else)

7 · The Zero Trust Security Capabilities Your Agency Needs

28 · What the EO Means for Zero

Trust Cybersecurity Cybersecurity and Zero Trust

11 · 3 First Steps Towards Adopting Zero Trust

31 · Simplifying Your Agency’s

Cybersecurity in 3 Steps

12 · The Cybersecurity Executive

Order: Your Questions Answered

32 · How CISA is Leading the Way

on the Cybersecurity EO

13 · What the EO Means for People Cybersecurity and Workforce Details

35 · How to Mature Your Agency’s Cybersecurity

15 · 3 Reasons to Leverage LiFi at

Your Agency

36 · How the EO Could Mature State

and Local Cybersecurity

16 · What the EO Means for Processes

Cybersecurity and Workflow Details

39 · How to Climb Your Agency’s

Cybersecurity Mountain

19 · How to Create a Zero Trust

Security Culture

40 · EO-Ready Best Practices for Cybersecurity

20 · What the EO Means for Data Cybersecurity and Information Details

45 · Securing Your Agency’s Future

With Zero Trust Security

23 · 3 Ways to Continuously Progress

on Security

2

Security Posture Details

46 · Conclusion

A GovLoop Guide

Executive Summary Like no time before, cybersecurity is a national

incidents. Lastly, these agencies will modernize

In 2021 alone, America has suffered massive

using tools such as cloud computing, data

problem demanding a national response. disruptions to some of its gas pipelines, meatpacking plants and more.

Now, constituents nationwide wonder which

their operational and informational technology encryption and zero trust cybersecurity.

Collectively, these actions can make any

agency more resilient against cyberthreats.

part of their lives may be disrupted next.

If your agency needs help unpacking the EO

cyberthreats interrupting their business.

best practices, statistics and thought leader

Private-sector companies are worried about Perhaps worst of all, agencies at every level

are unsure they can protect sensitive data and serve the public effectively. Across the United States, the time is ripe for a cybersecurity transformation.

Enter America’s most sweeping cybersecurity policy yet. In May 2021, President Joe Biden issued an executive order (EO) aimed

at strengthening every part of national

cybersecurity. Federal agencies will lead the

charge, changing their people, processes and technology in ways that their state and local peers will likely replicate.

and what it means, this guide can help. The interviews we share can quickly align your agency with Biden’s cybersecurity EO. This resource will:

• Explore the latest anecdotes, data,

developments and quotes to understand government cybersecurity nationwide

• Analyze the EO’s impact on five key areas: the cloud, data, people, processes and zero trust cybersecurity

• Share insights from major federal, state and local thought leaders that can improve your agency’s cybersecurity

Although rank-and-file employees may not

feel the impact of these changes immediately

or have a direct role in carrying out all the EO’s

• Provide tips for making your agency’s

mission closely fit the cybersecurity EO

requirements, there are trickle-down effects. No

The old way of practicing cybersecurity is not

EO pushes for stronger individual and collective

their cyberdefenses. Here is how the new EO

matter your role or your agency’s mission, the

working, so agencies should rapidly modernize

cybersecurity overall.

brings government cybersecurity into the future.

For instance, federal employees will strive to

share more information about cybersecurity risks, threat intelligence and mitigation

with their public-and private-sector peers.

Federal agencies will also try to improve

their processes for detecting, preventing,

responding to and logging cybersecurity Unpacking the President’s Cybersecurity Executive Order

3

At a Glance: Government Cybersecurity Nationwide 7 Cybersecurity Terms to Know The following terms are vital to understanding today’s public-sector cybersecurity landscape.

1. Advanced persistent threats (APTs): APTs

from email to social media. Although

unauthorized access to computer networks

people by using realistic deceptions.

are cyberthreats that allow bad actors to gain and then avoid detection for long periods of time using stealth. While typically linked to

nation-states, APTs can be any cybercriminals who conduct large-scale intrusions. APTs can

cause serious economic, political and national security damage, making them one of today’s biggest cyberthreats.

2. Endpoints: Endpoints are the various devices — such as laptops and mobile phones — that can connect to IT networks. As the number of

endpoints increases, cybersecurity becomes more difficult for agencies. Endpoint

cybersecurity will only grow more important as remote work’s popularity explodes.

3. Malware: Malware refers to any malicious

software that is created for purposely harming computers, networks and IT. Any software that unintentionally damages these technologies is usually called a bug, glitch or vulnerability.

Malware also comes in many forms, ranging from computer viruses to ransomware.

common, phishing works because it victimizes

5. Ransomware: Ransomware threatens to block access to or leak a victim’s sensitive

data unless a ransom is paid. Increasingly prevalent, this malware can also upend

agencies’ operations. Experts often caution

against paying ransomware ransoms, as this money can fund additional cybercrime.

6. Social engineering: Social engineering

occurs when cybercriminals psychologically manipulate people into performing actions such as revealing confidential information.

At agencies, social engineering can interrupt operations, damage public trust or cost

money. Social engineering can come from

any hostile source inside or outside an agency.

7. Zero trust: Zero trust is a cybersecurity

model designed to automatically distrust every device, user or other entity on an IT network. These entities can access

agencies’ resources only after having their identities verified. Zero trust cybersecurity

4. Phishing: Phishing involves attackers

thus covers everything inside and outside

sending fake messages that trick victims into

a network’s perimeter; this philosophy also

malware on their computers. In recent years,

systems and assets.

revealing sensitive information or installing

helps agencies continuously monitor their IT

cybercriminals have phished using everything

4

A GovLoop Guide

Federal Cybersecurity Spending The Biden administration’s federal budget for fiscal 2022 contained many items suggesting cybersecurity may become a bigger national priority going forward.

$9.8 billion

the projected amount of funding for securing federal civilian networks, protecting national infrastructure and supporting information-sharing efforts. The money would also fund

related standards and best practices between the federal government, critical infrastructure partners and American businesses in fiscal 2022.

Source: The White House

$750 million

the projected amount of funding for agencies affected by recent significant cybersecurity incidents to address exigent gaps in their security capabilities in fiscal 2022.

Source: The White House

Federal IT Spending IT spending relates to cybersecurity as it illustrates the scope of the networks that agencies might have to defend.

$97.1 billion

the projected amount of total federal IT spending in fiscal 2022, up from $92.9 billion in

fiscal 2021.

Source: Federal IT Dashboard

$25.6 billion

the projected amount of the above total that will go toward major IT investments, vs $71.5 billion that will go toward minor IT investments.

Source: Federal IT Dashboard

Unpacking the President’s Cybersecurity Executive Order

Accelerate Transformation To meet the variety of missions you encounter every day, you need responsive IT. Dell Technologies offers federal agencies the technology expertise, end-to-end solutions and world-class service you need to be prepared for what comes next.

DellTechnologies.com/Federal

6

A GovLoop Guide

Industry Perspective

The Zero Trust Security Capabilities Your Agency Needs An interview with Cameron Chehreh, Chief Technology Officer and Vice President, Presales Engineering, Dell Technologies

As good as it sounds, zero trust security will be too big a lift if agencies rely on manual processes.

The federal government’s latest cybersecurity

executive order (EO) pushes agencies to adopt this strategy, which requires them to apply security

controls every time users or devices attempt to

access resources, not just at network perimeters.

But how can agencies from the top down wield

zero trust security without being weighed down by manual workflows?

One potential answer is by provisioning and

managing IT infrastructure through software — an approach known as infrastructure as code (IaC).

“We firmly believe that infrastructure as code is

the most powerful thing you can leverage to get a zero trust reality in today’s world,” said Cameron Chehreh, Chief Technology Officer and Vice

President, Presales Engineering at Dell Technologies, a computer hardware and software provider.

Chehreh shared three zero trust security capabilities that IaC can unlock for agencies:

1. Analytical visibility

2. Automated security Automation happens when machines perform

simple, manual tasks with little to no human input.

When security basics like patching software are

automated, the result is budgetary and labor savings for agencies. Freed from such routines, public-sector employees can pursue more complicated — and

fulfilling — tasks for their agencies. The outcome is a win for everyone involved.

“Automation is critical for staying ahead of the adversary,” Chehreh said.

3. Orchestration Why is automation so powerful? Ultimately, the

reason is orchestration. Orchestration automates computer system and software configuration,

coordination and management, making it crucial for applying zero trust security principles quickly and easily.

Take least-privilege access, a zero-trust security tenet that states that people need only the bare

minimum of assets to accomplish their jobs. Through orchestration, agencies can rapidly apply this

Analytics involves systematically studying data and

statistics with computers. Without this, agencies may

remain in the dark about their security. Subsequently, visualizing their security analytics can help agencies properly understand and address the risks facing their sensitive assets.

For example, analytics can help agencies see where

cyberattacks are happening so their employees can

monitor potential threats in those areas more closely.

“We can make better-informed decisions about how to protect our data and applications,” Chehreh said.

strategy agencywide.

“Orchestration allows you to make these kinds of decisions so you can do the most with the finite resources you have,” Chehreh said.

Effortlessly applying traits such as analytical visibility, automation and orchestration to zero trust security may seem impossible, but IaC can make the

intangible tangible. Using IaC platforms like the one

Dell Technologies provides, agencies can accomplish all their zero trust security goals in one place.

“I can use a simple suite of tools for my entire zero trust security posture,” Chehreh said.

Unpacking the President’s Cybersecurity Executive Order

7

The Technology Modernization Fund The Technology Modernization Fund (TMF) is a pool of funding loaned in installments to federal agencies for technology modernization projects like cybersecurity initiatives.

$1 billion

the funds Congress provided to the TMF for modernization efforts — including cybersecurity — as part of the American Rescue Plan. Signed into law on March 11, 2021, the $1.9 trillion bill aims to stimulate the economy in response to the COVID-19 pandemic.

Source: General Services Administration (GSA)

4

the number of top priority categories available for potential TMF proposals. In May 2021, cybersecurity was listed alongside modernizing high-priority systems, public-facing

digital services, and cross-government services and infrastructure as top priority proposal categories.

Source: GSA

State Government Cybersecurity State agencies often have more budget dollars and employees than their local peers, but fewer of these resources than their federal equivalents.

No. 1

the ranking state chief information officers (CIOs) assigned to cybersecurity and risk management when asked to rate their top 10 priorities for 2021.

Source: National Association of State Chief Information Officers (NASCIO)

8

the number of consecutive years state CIOs ranked cybersecurity and risk management first among their top 10 priorities as of January 2021.

Source: NASCIO

8

A GovLoop Guide

StateRAMP StateRAMP is a nonprofit organization that certifies cloud solutions that meet basic cybersecurity standards for holding state and local data. The group is modeled after the Federal Risk and

Authorization Management Program (FedRAMP), which determines if cloud solutions meet certain security requirements for storing federal data.

January 2021

StateRAMP launched after being conceived in February 2020.

Source: StateRAMP

April 2021

StateRAMP membership officially opened to state and local government officials and cloud providers.

Source: StateRAMP

State Cybersecurity and IT Modernization Rankings The Internet Association’s (IA) State, Local, Tribal, and Territorial Information Technology Advancing Reform Achievements (SITARA) scorecard rates states’ cybersecurity preparedness and IT modernization strategies.

0

states achieved “exceptional” or “excellent” ratings for either their cybersecurity preparedness or IT modernization plans in 2020. The SITARA scorecard’s other rankings are “very good,” “good,” “baseline,” “getting started” and “needs help.”

Source: IA

3

states scored “very good” on their cybersecurity preparedness and IT modernization plans in 2020: California, Florida and Minnesota.

Source: IA

Unpacking the President’s Cybersecurity Executive Order

9

CYBER THREATS DON’T REST, AND NEITHER DO WE. With over 20 years of experience working in the most secure government and corporate environments, Sterling’s highly certified security and network engineers are your go-to experts for cyber readiness.

Protect, prepare, recover.

Take our Cyber Security Assessment Today at:

STERLING.COM/CYBERSECURITY/

connect@sterling.com

10

877.242.4074

www.sterling.com A GovLoop Guide

Industry Perspective

3 First Steps Toward Adopting Zero Trust An interview with Michael Phetteplace, Director of Cybersecurity, Sterling

The Biden administration’s recent executive order

(EO) on cybersecurity has put zero trust security at the top of the agenda.

By directing federal agencies to develop plans for adopting zero trust security for network

architectures, the EO makes a strong case for why state and local agencies should follow suit.

“Zero trust security is about eliminating our bad habit of allowing implicit trust in our

systems,” said Michael Phetteplace, Director of

Cybersecurity at Sterling, an IT solutions provider.

“In the past, everyone took for granted that

perimeters were secure and wouldn’t be breached.

Now, everyone needs to understand that breaches

can improve IT systems’ overall security by dividing them into sections based on security needs.

“Agencies need to take a fresh look at their

environments,” Phetteplace said. “Assets that don’t need to communicate with one another shouldn’t be granted the ability to do so.”

Network segmentation can also keep cybersecurity incidents from paralyzing agencies. Take data breaches. During security incidents, network

segmentation can keep cybercriminals from venturing deeper into agencies’ data.

3. Encrypt data Data encryption is the act of converting information

are inevitable and plan accordingly.”

into a format that, ideally, only authorized parties can

Phetteplace shared three important steps that can

information, such as Social Security numbers, about

help agencies start implementing the directive to adopt zero trust security:

1. Adopt multi-factor authentication Multifactor authentication (MFA) improves

the security of the user verification and login

process. The traditional username and password

combination is augmented with additional factors that are not as easily compromised, such as

hardware or software tokens, SMS passcodes

or fingerprints. Once verified, users can access resources like data or networks.

“Multifactor authentication has become a

fundamental security requirement,” Phetteplace

said. “It is the first line of defense against credential compromise.”

Using MFA, agencies can increase the likelihood

decipher. Government employees protect sensitive the public they serve so data encryption can help prevent painful cybersecurity incidents.

“If attackers get access to data, it is of little use

to them if it is properly encrypted,” Phetteplace

said. “Also, have we secured encryption keys and

mechanisms properly? We need to ensure we don’t

provide bad actors the capability to decrypt our data.”

Companies like Sterling can give agencies the

building blocks they need to implement zero trust security agencywide – whether it is from users to networks to data centers or to the cloud. In

addition, Sterling provides solutions that automate

cybersecurity processes for agencies using artificial intelligence (AI) and machine learning, gathering and processing threat intelligence from multiple sources at machine speed.

that their users are who they say they are. After all,

Over time, the more that agencies embrace the EO’s

evidence factors.

focus on scoring mission wins.

it is harder for cybercriminals to obtain multiple

message, the more public-sector employees can

2. Segment networks Network segmentation is another cornerstone of zero trust security. Using network segmentation, agencies

Unpacking the President’s Cybersecurity Executive Order

11

The Cybersecurity Executive Order: Your Questions Answered

Securing technology is not only crucial for governments – it is equally imperative for the private sector and the public. Cybersecurity is now a concern that affects every aspect of our lives.

Currently, the United States faces a continuously evolving landscape of persistent and increasingly sophisticated threats. Lone cybercriminals can cause as much damage as hostile nations. The resulting minefield has too many hazards for agencies to defuse all at once.

But the Biden administration’s EO could mark a turning point in government cybersecurity. In years past, agencies from the top down would often make incremental cybersecurity improvements at

best. Going forward, federal agencies may instead make significant investments based on the EO. Gradually, these upgrades could inspire similar moves at state and local agencies.

Ultimately, Biden’s EO could transform how the public sector’s people, processes and technology strengthen cybersecurity. With people, the emphasis will be on information-

sharing, risk management and threat intelligence. For processes, tomorrow’s strategies will gravitate toward capabilities sush as cybersecurity response and recovery. And with technology, agencies will likely use tools such as the cloud more often.

The five breakdowns below dissect the cybersecurity EO’s main components. Each section answers four questions to gauge the impact on federal, state and local agencies.

12

A GovLoop Guide

What the EO Means for People Cybersecurity and Workforce Details Cybersecurity is a team sport, and the best

sector cybersecurity and software suppliers.

information with one another. For instance,

accurately reflect the national identity.

defense occurs when the players all share America’s cybersecurity depends on

This diversity ensures the board’s suggestions

constituents, government employees and

2. How will the EO change how agencies buy software?

this unity, the United States is vulnerable to any

For too long, agencies have relied on software

private-sector workers cooperating. Without cyberthreat.

that reached the market with serious

The EO strives to connect communities across all walks of life. Though the focus is on federal employees, the EO may eventually reach

businesses, state and local agencies and

their respective customers too. The goal is an

America where the public and private sectors

actively trade knowledge about cybersecurity risks, threat intelligence and mitigation.

1. Who will help agencies after future cyberattacks?

The EO marks the debut of the Cyber

Safety Review Board. Much like the National

Transportation Safety Board analyzes airplane crashes and other transit mishaps, the

Cyber Safety Review Board will investigate cybersecurity incidents after they occur.

After each examination, the board will

recommend potential improvements to national

vulnerabilities. Fixing these flaws is expensive and time-consuming, and many products present

agencies with hidden security risks. Using these

weaknesses, cybercriminals can penetrate both public-and private-sector IT networks.

The new cybersecurity EO takes several steps to correct this problem. First, it establishes baseline security standards – such as

making security data publicly available – for developing federal software. Second, the EO

creates a public-private process for developing innovative approaches to secure software

development. Lastly, it launches a pilot program to label software that was developed securely.

The program’s “Energy Star” labels will assist agencies, businesses and the public with

quickly gauging which software best meets their cybersecurity needs.

cybersecurity. Over time, the group hopes to

3. How will the EO alter public-private partnerships?

from past mistakes.

When it comes to threat intelligence, many

enhance the nation’s cyberdefenses by learning How will the board work? The answer is pairing federal and private-sector co-chairs. The

Homeland Security Department secretary will convene the Board after significant incidents.

Federal representatives will include civilian,

military and intelligence agencies. The secretary will also select representatives from private-

barriers exist between public-and private-sector

workforces. After cyberattacks, many IT providers are reluctant to reveal embarrassing details

about their security practices; these companies

may also have contractual obligations with their clients that prevent them from disclosing details about a cybersecurity incident.

Unpacking the President’s Cybersecurity Executive Order

13

We Petal Technology.

Technology solutions you’re going to be

Wild about!

Wildflower is honored to serve the United States Federal Government, including its National Laboratories, doing so for three decades. We have long-term experience delivering complex technologies and services with a proven record of consistent, successful accomplishments. Our program and supply chain methodologies are a commitment to delivering the highest quality products, service, and support for customers in the public sector.

Contracts We Serve:

Solutions:

Services:

Certifications:

Army ITES SEWP-V SCMC GSA DOE-Motorola-ICPT First Source II

Data Centers Communications Security & Cyber Security Cloud Solutions IT Hardware Unmanned Aerial System

Artificial Intelligence Cloud Managed Services Warehouse & Logistics VAR

FAA 107 Pilots ISO 9001:2015 FOCI Q Clearance L Clearance HubZone Small Business Woman Owned Minority Owned

First Source II

wildflowerintl.com / (505) 466-9111 / information@wildflowerintl.com 14

A GovLoop Guide

Industry Perspective

3 Reasons to Leverage LiFi at Your Agency

An interview with Fernando DeLosReyes, Solutions Architect Manager, Wildflower International Sometimes, too many people want the same thing.

“Setting LiFi up is incredibly easy,” DeLosReyes

wireless networking technology – which uses radio

this technology.”

Take WiFi. For years, agencies have relied on this

waves – to exchange data between digital devices.

But now, the radio frequency (RF) spectrum is

getting crowded. And although new parts of the RF spectrum, such as the 6 GHz spectrum, are becoming available, every day more devices

connect to the network and add to the congestion.

For agencies, the result can be slower and less

said. “We can go anywhere in the world and use

2. Reduce interference Radio waves are vulnerable to interference from common devices such as baby monitors, cell phones and microwaves. Furthermore, WiFi is

often unreliable in areas like airports and hospitals because of RF congestion.

reliable communications. Even worse, the data

LiFi avoids these pitfalls because fewer devices rely

from security threats like signal jamming.

boasts the potential for higher connectivity than

involved in these communications faces more risk Enter LiFi. LiFi is a wireless technology that uses

cones of light to exchange data rather than radio waves. With LiFi, agencies can communicate

not only faster and more consistently, but more securely, too.

“There is a limit to the RF spectrum,” said Fernando DeLosReyes, Solutions Architect Manager at

Wildflower International, an IT solutions provider.

“LiFi can reduce the RF footprint.”

DeLosReyes discussed three benefits that adopting

on light waves. Even better, LiFi’s lighting not only

WiFi’s radio waves, but provides higher security, too.

That’s because cones of light are easier to contain in enclosed spaces than radio waves.

3. Strengthen security Speaking of security, LiFi is free of many of the

potential vulnerabilities plaguing WiFi. For instance,

data transfers involving WiFi are easier to detect and

interfere with than their LiFi counterparts. All agencies

handle sensitive citizen data, so this reality can cause major security problems for their workforces.

LiFi can provide to agencies:

“Security is paramount to agencies’ security and

1. Lighten workloads

emerged as a very compelling wireless technology.”

our national security,” DeLosReyes said. “LiFi has

WiFi requires antennas, access points and receivers to operate, so installing access points can become difficult and time-consuming for agencies. For

instance, establishing WiFi in a tactical environment involving tents for a military unit may take many labor hours and running networking cables.

Ultimately, LiFi solutions like those Wildflower

provides can help agencies see their data exchange and security in a new light.

“We’re bringing what is coming around the corner to our customers,” DeLosReyes said.

Additionally, mounting, securing and managing

these WiFi networks can become more complicated as the number of access points grows.

LiFi can reduce most of this clutter. Typically, LiFi installations require only one cable for both the

technology’s light and networking capabilities. As a

result, agencies spend less energy, money and time establishing LiFi than they would WiFi.

Unpacking the President’s Cybersecurity Executive Order

15

The cybersecurity EO strives to remove many of these obstacles. It eliminates many of

the contractual restraints that businesses

currently have when reporting incident and

threat intelligence to agencies such as the FBI

What the EO Means for Processes Cybersecurity and Workflow Details

that investigate and remediate cybersecurity problems. The EO additionally requires IT

providers to share details about breaches that could affect government networks.

Together, these actions streamline the

communication among everyone involved in national cybersecurity.

4. What does the EO mean for state and local agencies?

The EO could give state and local agencies

more cybersecurity resources. Take the Cyber

Agencies should not overlook the benefits of

modernizing their cybersecurity processes. Take automation, which can perform simple, manual tasks with little to no human input. Automating tasks like patching software vulnerabilities

reduces workloads for government employees while performing some of their responsibilities

faster. At their best, quality workflows like these can make agencies more capable of serving the public and earning mission wins.

Safety Review Board. After noteworthy attacks,

Take the advantages healthy cybersecurity

safer from cyberthreats.

these workflows can make employees more

A nationwide labeling system could also make

disaster strikes, these workers have processes

the board could make state and local agencies

state and local agencies more informed about the security of the software products and

services they purchase. By procuring higher-

rated tools, agencies of every stripe may reduce or even avoid painful cybersecurity experiences.

Potentially, the EO’s largest benefit is connecting the private sector and state and local agencies.

Private-sector insights could help state and local agencies find, stop and recover from

potential threats. For instance, companies could notify state and local governments when they have suffered a breach that may harm their constituents and employees.

processes offer agencies’ workforces. Internally, prepared for cybersecurity incidents. When that are faster, more flexible and more

collaborative. As a result teams are not only

more capable of handling cyberattacks, they are more resilient too.

Robust cybersecurity processes can also

benefit the public. Once implemented, clear

workflows can provide more accountability and

transparency about cybersecurity to constituents.

1. Is there a standard response for cyberattacks?

Agencies cannot wait until their technology is compromised to decide how their workforces

will respond. Recently, countless cyberattacks

have demonstrated that cybersecurity maturity varies wildly across every category of agency.

The cybersecurity EO will help overcome these pitfalls by creating a standard playbook for responding to cybersecurity incidents. This

playbook will provide agencies with a common 16

set of cybersecurity terms. The document

EDR programs strive to make organizations

should take when identifying and stopping

cybersecurity. The goal is to construct processes

also recommends concrete steps agencies cybersecurity threats. The playbook will declare which National Institute of Standards and

Technology (NIST) cybersecurity standards agencies must follow. Once all the federal

proactive, rather than reactive, about

for active cyberthreat hunting, containment,

remediation and incident response at federal agencies.

agencies are on the same page about

4. How will the EO touch state and local cybersecurity processes?

and the private sector follow suit.

Frequently, starting from scratch is the hardest

cybersecurity, the hope is that other agencies

2. How does the EO change how agencies log cybersecurity events?

The information from network and system logs can assist agencies with investigating and

remediating cybersecurity incidents. But some agencies do not properly log this information, making it more difficult to detect intrusions,

mitigate ongoing breaches and determine the

damage from an attack. Without these insights,

agencies may not know the security of the data they are storing on premises or with third-party vendors like cloud providers.

To tackle this challenge, the cybersecurity EO

will set requirements for logging and protecting incident details. These policies will cover

everything from how long to retain logs to how to

safekeep the information they contain. Eventually, the EO’s policies will ensure that security teams

part of establishing routines. Fortunately, the

EO explains how federal agencies will set the

standard that state and local agencies can use for their own cybersecurity processes.

Consider the federal playbook for engaging

with cybersecurity events. By giving state and local agencies an example to emulate, the

playbook reduces the amount of time they

might spend drafting their own documents.

State and local agencies typically have smaller budgets and workforces than their federal

counterparts, so any advantage counts when dealing with cyberthreats.

The same principle applies to other

cybersecurity processes such as event-logging

and EDR guidelines. By standardizing the tactics federal agencies use, the EO may prompt

similar activities at state and local agencies.

have centralized access and visibility into every cybersecurity incident log at their agencies.

3. How should agencies approach cybersecurity next?

Contact sports need rules, and cybersecurity is

no exception. To that end, Biden’s EO will outline the federal government’s Endpoint Detection and Response (EDR) initiative. Like other EDR

strategies, the federal version will continually monitor endpoint data to find and stop the cyberthreats menacing these devices.

17

Innovate, Grow, Know with ThunderCat Technology and Dell Technologies

CLOUD ANALYTICS SECURITY INFRASTRUCTURE 18

Guide T H U N DAEGovLoop R C AT TECH.COM

Industry Perspective

How to Create a Zero Trust Security Culture

An interview with Justin Robinson, Chief Technology Officer of Cyber and Analytics, ThunderCat Technology Government cybersecurity is like dieting. Publicsector employees know that protecting their

agency’s data and other assets is healthy but

making strong cyber hygiene stick agencywide is easier said than done.

After all, many agencies could improve how their

teams collaborate on cybersecurity. More importantly, these agencies could phase out perimeter-based

security. Too often, threats have emerged from both

inside and outside agencies’ perimeters, proving that this is not the optimal approach.

Enter zero trust security. Unlike perimeter-based security, zero trust automatically assumes that

every entity on agencies’ networks is untrustworthy.

By continuously monitoring risks in this way,

2. Start small Robinson also cautioned agencies against

immediately implementing zero trust security

agencywide. Instead, he urges them to apply zero

trust principles to narrow parts of their operations.

“Don’t roll out new applications or services and give

them authority to operate without first running them through a zero-trust exercise,” Robinson said.

For instance, least-privilege access is the idea

that employees should receive only the minimum amount of access to the resources their roles

require. To try zero trust security, an agency could

practice least-privilege access with one application rather than the entire organization.

agencies can cultivate a thriving security culture.

3. Boost teamwork

“Zero trust is not a tool or product,” said Justin

For too long, many network and security teams

and Analytics at ThunderCat Technology, an IT

security. To succeed, zero trust security needs to

Robinson, Chief Technology Officer (CTO) at Cyber solutions provider. “It is something that has to be inherent in day-to-day IT operations.”

have worked alone while defending their agencies’ upend this model.

“Zero trust security requires a culture within the

Robinson listed three steps agencies can take to make

organization where the collaboration is open,”

zero trust security habitual within their workforces:

Robinson said.

1. Take stock of current security tools

Beyond people and processes, zero trust security

Different agencies have different needs and

different security stacks. Security stacks contain

all the tools in an agency’s security inventory, so

accurately understanding these toolsets is crucial for zero trust security.

“Every organization has gaps based on their maturity level,” Robinson said of security stack assessments.

Once an agency understands its stacks, employees can add features like continuous monitoring that

anchor zero trust security. Continuous monitoring constantly evaluates agencies’ resources for potential security risks in real time.

additionally demands that agencies change their technology. Fortunately, IT solutions like those

ThunderCat Technology provides can give agencies

capabilities like real-time situational awareness that altering their workforces and workflows cannot. With guidance from ThunderCat Technology, agencies can create zero trust security architectures that

optimize the capabilities they have while plugging their gaps.

“It’s not about starting with your entire environment, every application you’re running, the network and

workloads,” Robinson said. “You can start to move

towards zero trust instead of boiling the entire ocean.”

Unpacking the President’s Cybersecurity Executive Order

19

What the EO Means for Data Cybersecurity and Information Details

Agencies must walk a delicate tightrope when

past, unencrypted data facilitated many

sensitive information like health care details

for cybercriminals. With the federal government

handling data. On the one hand, data contains that constituents expect agencies to keep

private. On the other hand, securing this data cannot be so complicated that it slows down government employees.

balancing both concerns hard for agencies.

Data attracts cybercriminals, as they can often

profit off personally identifiable information (PII) such as Social Security numbers quickly and

easily. Nation-states are even more concerning:

The data hostile governments steal can hurt U.S. national security.

these fears by mixing modern tools with fresh perspectives on handling data. Implemented correctly, Biden’s cybersecurity EO can assist agencies with guarding one of their most

Agencies should make accessing their data as hard as possible, and encryption helps them

do exactly that. Encryption translates data into another form that can be unlocked only with a decryption key such as a password. Because

encrypted data can be deciphered only with the right tools, only the correct people can typically

20

Much like encryption, multifactor authentication (MFA) can make a difference with data security.

MFA grants users access to resources such as

data only after they have presented two or more pieces of evidence verifying their identities.

These identity factors include something only individual knows (their address) or something unique to the individual (their fingerprint).

The EO stipulates that all federal agencies must deploy MFA. From the top down, this

preventing unauthorized access to their data

1. How will agencies need to protect their data differently?

for their resting and in-transit data. In the

they have not already.

cybersecurity tool can assist agencies with

precious resources.

all federal agencies embrace encryption

agencies may also adopt encryption soon, if

the individual has (a key), something only the

The federal government hopes to soothe

Biden’s cybersecurity EO mandates that

leading by example, scores of state and local

2. How will government employees need to handle data differently?

The reality is that cybercriminals make

access this information.

cyberattacks, so this rule could erase this option

and other assets.

3. How will agencies need to rethink their data practices?

Biden’s EO demands that federal civilian

executive branch (FCEB) agencies understand their high-value data assets. Rather than treat all their data the same, the EO tasks

these agencies with evaluating which types of unclassified data they have and how sensitive each type is.

These evaluations will help FCEB agencies

identify which unclassified data types are the most sensitive, and which varieties are under A GovLoop Guide

the greatest threat from cybercriminals. More importantly, these analyses will decide the most appropriate processing and storage solutions for each FCEB agency’s information.

Although the EO’s details about unclassified data apply only to FCEB agencies, this data security philosophy can benefit any agency.

4. How can the EO assist state and local agencies with data security?

The best federal data security practices can also pay off for state and local agencies. Although the

latest cybersecurity EO does not require state and local governments to implement its data security policies, these that do will benefit.

Look at encryption. Encryption is a simple step any agency can take to make its data harder for cybercriminals to exploit. MFA, meanwhile, can put guardrails between sensitive information and the people who are not supposed to interact with it. Additionally, determining how sensitive their data is — and what risks it faces — can make cybersecurity easier for any government.

The quest to protect your organization requires always-on full content indexing and rapid recovery.

With machine learning capabilities and more, the Dell Technologies Cyber Recovery solution is able to act quickly to recover important data.

Post-attack forensic are also able to quickly identify the attack vector.

22

A GovLoop Guide

Industry Perspective

3 Ways to Continuously Progress on Security

An interview with Tad Northcott, Plan Executive, Navy and Marine Corps; Dave Deppisch, Market Leader, Navy, Marine Corps, Air Force and the Defense Information Systems Agency; and Glenn Jensen, Software Account Executive, Insight Public Sector When it comes to security, agencies are used to doing more with less. Not only can budget

constraints limit options, but priorities can shift and talent can grow scarce. No matter the obstacle, even one roadblock can impede meaningful security advancements.

But what happens when today’s cyberthreats evolve

and agencies cannot keep up? Too often, the result is a costly and humiliating security incident. To prevent this, agencies need the ability to continuously refine their security capabilities and defenses.

“The bad guys never stop,” said Glenn Jensen, Software Account Executive at Insight Public

2. Leverage continuous monitoring Continuous monitoring is a vital component of

zero trust security because it detects changes to

agencies’ IT environments in real time. Whether it

is an emerging threat, vulnerability or compliance

issue, continuous monitoring makes sure agencies

are always informed about their security landscapes.

“Annually, lots of agencies scramble to prepare for

cybersecurity inspections,” said Tad Northcott, Plan

Executive, Navy and Marine Corps. “With continuous monitoring, they’d know where they are before an annual review.”

Sector, a business-to-business and IT solutions

3. Add multifactor authentication

progress and improve.”

that agencies are increasingly leaning on for their

provider. “Cybersecurity requires us to continually The Insight Public Sector team shared three steps agencies can take to keep their security ready for anything:

1. Assess security capabilities Agencies frequently do not know the state of their

security personnel, processes and tools. By having

a trusted vendor assess their capabilities, agencies can pursue goals that elevate their overall security agencywide.

Multifactor authentication (MFA) is another tool

security needs. When users approach agencies’ sensitive data and other assets, MFA asks them for at least two pieces of proof to confirm their identities, such as a birthplace, fingerprint or something else.

All agencies have unique goals, but IT providers like

Insight can assist them by identifying their potential

security gaps. Insight can then provide agencies with specific tools — such as continuous monitoring and

MFA solutions — that can meet their mission demands.

“You can evaluate your current state and then move up the stairs to the state you want to get to,” said

Dave Deppisch, Market Leader, Navy, Marine Corps, Air Force and the Defense Information Systems

“What agencies have told us is that they want to leverage private-sector best practices,” Jensen said. “Our goal is to help them meet that need.”

Agency (DISA).

For instance, a vendor assessment can tell agencies how prepared their operations are for zero trust

security. Zero trust security involves distrusting all

computing entities, so agencies may need to ready

their devices, users and other assets before adopting such a dramatic shift in security strategies.

Unpacking the President’s Cybersecurity Executive Order

23

What the EO Means for the Cloud

Cybersecurity and the Cloud Details

Presently, cutting-edge cybersecurity often

Regardless of the cloud model involved, the EO

and securing legacy IT can prove costly, difficult

technology in its agencies’ futures.

features IT modernization because maintaining and risky.

reveals that the federal government sees the

2. How will future cloud adoptions work for agencies?

Yet that does not mean every agency

has adopted cloud computing. The cloud

Since 2011, the Federal Risk and Authorization

decentralizes IT infrastructure to deliver

computer resources such as data storage ondemand. Although this format gives agencies unparalleled flexibility and scalability, cloud

migrations can take more effort than agencies initially realize.

Management Program (FedRAMP) has authorized which cloud products and

services can host federal data. By leveraging

FedRAMP’s cloud security standards, the Biden administration made the program one of its cybersecurity EO’s biggest stars.

Recognizing this, Biden’s EO prods agencies to

use the cloud while acknowledging some may

do so partially or not at all. While the EO hopes to

accelerate public-sector cloud use, it also covers securing computer systems on premises, in the cloud or a hybrid of both models.

No. 1 among the EO’s FedRAMP priorities is

leveraging a governmentwide strategy for

federal cloud security. This strategy will try to

ensure that agencies broadly understand the risks from cloud-based services and how to effectively address them.

1. Will all agencies have to use the cloud?

According to the cybersecurity EO, different

A technical reference documenting secure cloud architecture is another goal. Once

agencies are at different stages of cloud

implementation. Consequently, the document’s various cybersecurity details can apply to onpremises, cloud-based or hybrid IT.

released, this resource will illustrate

recommended approaches to cloud migration

and collecting, protecting and reporting on data for agencies.

But the EO is also clear that the federal

Lastly, the order tasks FedRAMP with identifying

adoption. The EO not only calls for faster federal

to agencies based on incident severity. This

government wants to speed up its overall cloud cloud migrations, it even lists three potential models for agencies.

the cloud services and protections available

framework will also list the data and processing activities associated with these services

First up are Software-as-a-Service (SaaS) clouds,

and protections.

which license centrally hosted software on a

Together, these steps ensure that agencies can

(IaaS) clouds decentralize IT infrastructure, while

with FedRAMP’s expertise.

subscription basis. Infrastructure-as-a-Service Platform-as-a-Service (PaaS) clouds do the

adopt cloud quickly, securely and intelligently

same for computing platforms hosting agencies’ desired applications.

24

A GovLoop Guide

3. How might the EO’s cloud details transform federal agencies’ work?

4. How could the EO morph state and local cloud security?

The better people understand the cloud, the

Where federal agencies go, state and local

to the cloud’s rising prominence within the

different, and many state and local governments

better the technology will benefit them. Due federal government, the new cybersecurity

EO takes steps to inform agencies’ employees about FedRAMP.

Chief among the cybersecurity EO’s FedRAMP education opportunities is a new federal

agencies will likely follow. The cloud is no

may copy their federal companions once they realize the technology’s benefits. Similarly,

the way federal agencies secure their cloud

products and services may become equally successful for state and local workforces.

training program. Once established, this

Beyond simply adopting cloud, state and local

trained and equipped to manage FedRAMP

data. But to host this desirable commodity,

initiative will ensure that federal employees are authorization requests. This learning opportunity will also include training materials and on-

demand videos that inform federal workers about FedRAMP’s role in securing cloud products and services.

agencies may also crave access to federal

state and local cloud environments may have

to comply with FedRAMP’s security benchmarks.

Ultimately, the state and local agencies that

do not follow FedRAMP’s standards may miss powerful federal insights.

Someday, introducing FedRAMP tutorials to the

federal talent pool could prompt state and local agencies to craft their own versions.

25

LET’S MAKE

IMPOSSIBLE REAL Every business is at the edge of a new digital frontier.

At Dell Technologies, we’re building the technology solutions to transform the impossible into reality.

So you can go further than you ever imagined.

26 26DellTechnologies.com

A GovLoop Guide A GovLoop Guide

Industry Perspective

How to Innovate in Cybersecurity (or Anything Else) 5 Tips for Agile Operations Provided by Technology Integration Group

Nowadays, it is no secret the public sector needs more cybersecurity innovation. From the top

level down, agencies nationwide are endlessly

defending their resources from cyberthreats — and

cyberthreats are constantly reinventing themselves, so agencies must keep up.

Yet innovation is difficult without resilience.

Resilience is the ability to respond to, recover from and continuously function during disruptions;

without resilience, agencies may find innovation hard to reach.

Thankfully, agencies can rapidly acquire both

attributes by imitating the private sector. Take

2. Conduct analyses agencywide Innovation also requires gathering as much

information as possible about potential next steps.

Understanding their current operations, architecture life cycles and frameworks can not only assist

agencies with refining their business needs but help them model their future routines.

For instance, look at data storage. Currently, many agencies have legacy IT that they cannot easily

restore after cyberattacks. However, using cloud

computing, agencies can store backup copies of their data and become more resilient.

Technology Integration Group (TIG), an IT solutions

3. Build blueprints

methodology that can make agencies more

need roadmaps. For the best results, agencies should

provider. TIG’s “Start Right” philosophy is a business

All innovations, including the cybersecurity variety,

innovative and resilient.

measure how innovations might transform their

Here are five ways agencies can become resilient innovators, according to TIG:

financial impact of any changes, agencies can craft

1. Engage with challenges Before agencies innovate, they must clearly

understand their business needs. First, they must

decide how and what innovations may elevate their credibility and work. Next, these agencies must

determine which of their existing capabilities already contribute toward the potential innovations. Finally,

these agencies should craft proposals that capture each innovation’s impact.

Take data encryption, which converts data into

a form that, ideally, only authorized parties can

decipher. Agencies handle sensitive data about

citizens, so protecting this information is vital for preserving public trust. Agencies without data

encryption can start applying it by determining

which information is most critical and may need encryption first.

operations. By predicting the potential benefits and the best possible solutions for their workforces.

4. Make the case Innovators must articulate how the changes they

are proposing can take root at agencies and what investments they need to enact them. Without

these details, agencies may lack lasting innovation and resilience.

5. Implement effectively To optimize the benefits they reap from innovations, agencies must first determine the best way to

implement them. Ideally, implementations unfold

using roadmaps tailored to produce the maximum

number of advantages from the solutions involved.

Innovation may seem difficult on paper, but

partners like TIG can demonstrate what consistent, simple innovation looks like. Over time, innovative agencies have the agility to stay resilient when cyberthreats come calling.

Unpacking the President’s Cybersecurity Executive Order

27

What the EO Means for Zero Trust Cybersecurity Cybersecurity and Zero Trust Security Posture Details

Biden’s cybersecurity EO may pinpoint the

For any government, this mentality hinges on the

a public-sector routine. The EO’s stipulation

to the newest intern — is instantly capable of

moment zero trust cybersecurity becomes

idea that no one – from the highest executive

that federal agencies construct zero-trust

cybersecurity architectures hints that state and local agencies will probably follow suit.

This posture nonetheless requires a radical

can remain static in an endlessly changing

agency. Unlike traditional cybersecurity, this

threat environment. Amid this chaos, the best

philosophy acknowledges that cyberthreats

can emerge either inside or outside a network’s perimeters. To deal with this paradigm, zero trust cybersecurity demands that agencies

continuously monitor their entire IT ecosystems for danger in real time. Most importantly, this

mindset assumes that every entity — whether it is a device, a user or something else — is

untrustworthy until its identity has been verified.

with the flow when it comes to new pitfalls.

What makes zero trust cybersecurity so

dynamic? Continuously monitored data that

comes from multiple sources in real time. Zero trust cybersecurity involves constant scans of every piece of agencies’ IT infrastructure

to ensure that no strange activity slips past Zero trust cybersecurity can be rigorous work,

Zero trust cybersecurity erases automatic trust in computing entities. Whether these elements are applications, devices, services, users or

other options, nothing immediately receives the keys to an agency’s kingdom.

This mindset may seem unusual to government employees who are not familiar with least-

so agencies should consider automation a

part of their implementation process. This frees

humans for more complicated work by reducing their initial workloads.

3. Why does zero trust cybersecurity work if practiced properly?

For decades, organizations assumed walling off

privilege access. Least-privilege access

permits access to only the bare minimum of the resources someone’s job requires. Zero

trust cybersecurity can thus prevent anyone from overstepping their bounds and causing

28

approach is dynamic cybersecurity that can go

undetected.

1. How could zero trust cybersecurity change employees’ routines?

security incidents.

2. How can zero trust upgrade how agencies perform cybersecurity?

Zero trust ends the notion that cybersecurity

shift in security thinking for every type of

inside or outside a network’s perimeters

engaging with the organization’s assets.

their networks would be enough to halt potential cyberattacks. While useful, this approach didn’t account for cyberthreats that could bypass network perimeters or come from inside organizations themselves.

Zero trust cybersecurity views breaches as

inevitable, so it restricts computing entities A GovLoop Guide

from touching resources they do not need when possible. Gradually, this format allows agencies to

contain the damage from a compromise. This approach also establishes normal security patterns, forcing suspicious behavior to bubble up so agencies can block it sooner.

Zero trust cybersecurity can answer who, what, where, when, why and how agencies’ computing capabilities are being used.

4. Why should state and local agencies follow federal agencies’ lead on zero trust cybersecurity?

State and local agencies often have fewer cyber defenses at their disposal than federal agencies.

Many state and local agencies must do more with less on cybersecurity because of their smaller budgets and workforces.

Used correctly, zero trust cybersecurity can make many of these hurdles disappear. With the right training, any employee can practice zero trust cybersecurity effectively. Its status as a state of mind also makes

practicing it often cheaper than buying more cyber defenses.

Fed Tech

without the Friction Federal IT leaders are laser focused on the mission, and the technology needed to advance it.

Procurement complexity, however, can slow progress to a crawl.

Future Tech clears a path to faster innovation with its commitment to “Frictionless Procurement.”

Offering IT solutions from more than 700 OEMs, including Dell Technologies, we’re a single source for your mission-critical technology requirements.

We speed access through the latest GWAC contracts—including SEWP V and GSA. And, our ace Federal Acquisitions team is with you every step of

Learn more about how Future Tech and Dell Technologies can accelerate innovation in your agency.

Contact: Govops@ftei.com

the way, taking on the heavy lifting and executing flawlessly so you can focus on what matters most – the mission.

30

A GovLoop Guide

Industry Perspective

Simplifying Your Agency’s Cybersecurity in 3 Steps

An interview with Fred Hoffmann, Chief Information Officer, Future Tech Enterprise, Inc. The longer that agencies have depended on their

“When organizations do not have a comprehensive

these tools behind. The reason is simple: the more

silos, we see trouble,” Hoffmann said.

legacy technology, the harder it is for them to leave time that agencies invest in legacy technology, the more energy and money they spend on it, too.

But legacy technology is gradually making publicsector cybersecurity more challenging. Like walls that have weathered away, legacy technology is increasingly leaving agencies exposed to cyberthreats.

“When organizations have older versions of

software and databases and are relying on legacy solutions, the level of vulnerabilities is far more

view of their IT infrastructure, or make decisions in So, how can agencies reduce their cybersecurity silos? One option is making IT infrastructure evaluation and upgrade management comprehensive and holistic.

“This is the best way to minimize risk, optimize the value of your IT investments and facilitate any technology changes across an organization,” Hoffmann said.

3. Adopt artificial intelligence

extensive,” said Fred Hoffmann, Chief Information

Cloud computing’s decentralized infrastructure

solutions provider.

like data storage on demand. As such, modernizing

Officer (CIO) at Future Tech Enterprise, Inc., an IT

Hoffmann shared three moves agencies can make to help their people, processes and tools leave legacy

allows agencies to leverage computing resources IT often involves cloud adoption because of the technology’s flexibility.

technology in the past.

But securing clouds can prove difficult when

1. Act agencywide

IT, off-premise IT or a hybrid of both. Take cloud-

agencies construct environments using on-premise

When it comes to cybersecurity, Hoffmann

recommended that agencies start by making the topic a constant concern agencywide.

“Cybersecurity is not just an IT issue,” he said. “It is a

legal, human resources and risk management issue.”

Take cybersecurity training. By consistently training

based data. The different IT systems involved with this information can make protecting it difficult.

Enter artificial intelligence (AI). AI mimics human

cognitive abilities such as reasoning, so it can lend agencies’ employees a hand with cybersecurity issues like defending cloud-based resources.

employees on cybersecurity agencywide, agencies

“Optimizing cloud security starts with heavy and

computing to their unique roles.

solutions, which are designed to provide rapid

can show workers how to apply modern IT like cloud

targeted investments in the latest AI-powered

detection and response to threats,” Hoffmann said.

2. Scrap silos Agencywide cybersecurity is important for another

reason – eliminating silos among teams. Not only are siloed agencies less prepared for cyberthreats, but

these agencies may also struggle with modernizing technology quickly, affordably and efficiently.

Providers like FTEI can help agencies map out

agencywide modernization journeys involving cutting-edge tools like AI.

“We always strive to be the easiest and most flexible partner for agencies to work with,” Hoffmann said.

Unpacking the President’s Cybersecurity Executive Order

31

How CISA is Leading the Way on the Cybersecurity EO Because cybersecurity is a team sport, the Cybersecurity and Infrastructure Security Agency (CISA) may be America’s coach. CISA is a federal agency responsible for elevating government cybersecurity nationwide. Whether the threat is a

cybercriminal or a hostile nation, CISA helps protect its federal, state and local

partners by improving cybersecurity coordination and defenses.

Naturally, Biden’s recent cybersecurity EO closely fits CISA’s mission. From sharing threat

intelligence to practicing zero trust cybersecurity, the EO outlines several key strategies CISA urges agencies to follow going forward.

GovLoop discussed CISA’s role in implementing the new cybersecurity EO with Deputy Executive Assistant Director for Cybersecurity Matt Hartman.

This interview has been lightly edited for brevity and clarity.

GOVLOOP: How is U.S. cybersecurity doing?

need to be in terms of cybersecurity, our

country needs sustained investments in both

HARTMAN: In terms of where we’re doing

well, the first thing that comes to mind is that

many, many, many years.

we are making our adversaries work harder

Recent events have again highlighted the

doing debasement, particularly in the

or solution can prevent an attack from a

MFA, encrypting data and rapidly patching

multiple layers of defense and security

by more consistently and more thoroughly

truth that no one security control, vendor

federal space. It is things like implementing

nation-state adversary. It is going to take

vulnerable systems.

measures to protect an organization. And

The challenge is that while we continue to

continue to represent a great challenge to

improve our defenses, shore up our cyber

hygiene and take advantage of some lowhanging fruit as a federal enterprise, our adversaries are becoming increasingly

even with all that in place, it is going to

keep sophisticated adversaries from gaining access to networks that represent strategic

interest to them, which is why one of the first

sophisticated and brazen. To get where we

32

cybersecurity and IT modernization over

principles of zero trust cybersecurity is to assume breach.

A GovLoop Guide

This is the reason the EO sets out these

tangible actions to raise the bar on the

federal government’s ability to detect and respond to cybersecurity incidents. The

shared end goal is to ensure that our critical infrastructure – which keeps our global

community working through thick and thin –

is a hard target for those who seek to disrupt it. And when that critical infrastructure is

disrupted, we are collectively able to limit the

impact to the functions that we as Americans rely on every day.

What cybersecurity best practices do you recommend for aligning with the EO? On the federal front, recent cyberthreat

campaigns continue to highlight that our federal networks are on the frontlines of

cyberattacks against our nation. This reality

makes it essential that we think of the federal government more as an enterprise. As part of this enterprise mentality, we can better

manage our collective risk. There is a need for greater visibility, increased shared services

How would you like to see the public and private sectors share threat intelligence based on the EO?

and more cost-effective capabilities.

For state and local governments, recent events have forced us as an entire U.S.

The private sector is increasingly uniquely

government to focus a tremendous amount

threats and vulnerabilities to our federal

ransomware attacks. To that end – and to

One of our primary roles at CISA – and the

cyberattacks – CISA recommends following

positioned to domestically identify key

of effort on combating the recent rise in

infrastructure and our nation’s infrastructure.

minimize the risk of ransomware and all

one we take most seriously – is to serve

three cybersecurity best practices.

as the hub for public-private informationsharing in a cybersecurity incident report.

In this past year’s National Defense

Authorization Act, CISA was provided the authority and resources to stand up a

joint cybersecurity planning office to lead the development of and to coordinate

the execution of a whole-of-government – and whole-of-nation – cyber defense plan. It is integrating the capabilities of the U.S. government, the private sector

and our state, local, tribal, territorial and

international partners with the sole focus of

defensive cybersecurity planning. It is going to be extremely beneficial in enhancing

our ability to quickly develop a common

One, report your incident to CISA and law

enforcement. We are here to help, and if you call one of us, you call all of us.

Two, ensure your business operations can

remain operable in the event of a large-scale IT disruption. It is not only important to have business continuity and incident response plans in place, it is imperative to test your plans regularly.

Third, remember that almost all intrusions stem from weaknesses in internet-facing systems. If you can do one thing, assess

your posture and fix these external-facing vulnerabilities.

operating picture and provide rapid

assistance to both federal and non-federal organizations that have or may have been targeted by adversaries.

Unpacking the President’s Cybersecurity Executive Order

33

Equity Drives Impactful Technology Transformation Both technology and equity are centered around change. So what if technologists and the mission teams they support considered how a cloud solution or IT service enabled them to serve a diverse public equitably?

Embrace change to get the best of what cloud and equity have to offer.

Read the article to learn how Red River’s Chief Technology Officer and Design Engineering Manager explain how they oversee Red River’s technology strategy through an equity lens.

READ THE ARTICLE

TECHNOLOGY DECISIONS AREN’T BLACK AND WHITE. THINK RED. 34

A GovLoop Guide

REDRIVER.COM

Industry Perspective

How to Mature Your Agency’s Cybersecurity

An interview with Kevin Steeprow, Senior Vice President, Engineering, Red River Recently, most of the public sector has realized that

their cybersecurity practices have some growing up to do.

The COVID-19 pandemic prompted more

governments to work remotely than before, but

many found that they were not equipped to defend networks extending beyond their office walls.

Thankfully, there is an answer for agencies.

Cybersecurity maturity measures how ready and

able agencies are to address their risks. During crises like viral pandemics, cybersecurity maturity can help agencies avoid painful disruptions.

But maturing agencies’ cybersecurity is easier said

than done. To reach maturity, today’s agencies must assess how their cybersecurity risks affect their people, processes and technology.

“Everyone knows what the end state is,” Kevin Steeprow, Senior Vice President, Engineering at Red River, a software provider, said about

cybersecurity maturity. “Unfortunately, there is no silver bullet or magic wand to get them there.”

Steeprow suggested three steps that agencies can

these discoveries can help agencies gradually strengthen their cybersecurity.

2. Start SOCs Security operations centers (SOCs) are centralized

units that handle organizational and technical issues.

For cybersecurity, SOCs typically analyze, monitor and defend valuables like data.

“If you have a good SOC or a good partner providing SOC services, it can give you a proactive and

preventive look at what’s going on,” Steeprow said.

By protecting cybersecurity in one place, SOCs can

remove many of the silos that sometimes separate agencies’ teams.

3. Embrace zero trust security Zero trust security dictates that agencies should never automatically trust the users, devices

and other computing entities on their networks.

Ultimately, making zero trust security second nature

at agencies lets them continuously monitor for – and then mitigate – potential cybersecurity threats.

“It is understanding what information you have and

take to increase their cybersecurity maturity:

who has access to it,” Steeprow said. “Just because

1. Take stock

you get the keys to the kingdom.”

Cybersecurity touches scores of agencies’

resources. Whether it is data, networks, users or

something else, agencies at every level have lots of ground to cover.

The truth is that understanding all these concerns

can be challenging. To chart a clear path, Steeprow recommended that agencies initially assess how their cybersecurity is performing agencywide.

“It is about what you have and what is most critical for you,” he said. “You don’t take on the elephant in one fell swoop.”

you’ve passed that original boundary doesn’t mean Cybersecurity maturity requires daily

improvements. The good news is that providers like Red River provide expertise about topics including

security assessments, SOCs and zero trust security to help agencies constantly raise the bar on their cybersecurity maturity and accomplish their unique goals.

“We want to help you be a Swiss Army knife,”

Steeprow said. “Let’s find the right tool for the right job.”

Security assessments can measure things like how many software vulnerabilities agencies have, and

Unpacking the President’s Cybersecurity Executive Order

35

How the EO Could Mature State and Local Cybersecurity Often, the federal government can seem like an older sibling to

state and local governments. The average federal agency has a

larger budget and staff than most state and local agencies; federal

organizations are also more likely to steer state and local agencies

Doug Robinson

Meredith Ward

down the trails they blaze.

Cybersecurity is no different, and the recent EO on this topic covers many moves federal agencies

are familiar with. Although the EO does not force any state or local governments to follow suit, they may want to mirror many of the document’s minutiae.

GovLoop spoke with NASCIO Executive Director Doug Robinson and Director of Policy & Research Meredith Ward about how Biden’s cybersecurity EO could make the public sector’s overall cybersecurity more mature.

The interview below has been lightly edited for brevity and clarity.

GOVLOOP: Where are state and local agencies struggling with cybersecurity?

we have today, the fact that across the

board – from elected to appointed officials,

particularly elected officials – cybersecurity

ROBINSON: Generally, the states are not

organized to succeed around cybersecurity.

They don’t have enterprise governance

capabilities and disciplines in their

Their investments are not commensurate to

the risk. That is more problematic at the local

36

I look at this as a business problem that

needs to be articulated without this constant

organization to succeed in cybersecurity.

business risk. I think that’s part of the gap

an IT issue. “That’s the CIO’s problem – that’s now seen that come full bore.

By that I mean they don’t have the requisite

I think that cybersecurity is a significant

understood. They still want to think of this as an IT issue.” But it’s a business issue. We’ve

that’s strong.

government level.

is not embraced, cybersecurity is not well

fear. This is life in the digital age, and we need to become more mature in how we address

it. That’s the whole core of the EO, a whole set of directed actions that makes the federal

government mature and modern. State and local agencies are dealing with the same thing.

A GovLoop Guide

What effect might the EO have on state and local cybersecurity?

WARD: State and local governments take a lot of direction from the federal government. What I think the EO can do is provide a model for state and local governments without having a mandate. I think it can help state and local governments with their own best practices.

It’s always good to take an inventory of what they’re doing on a day-to-day basis and how that might improve.

Why is sharing threat intelligence important for agencies at every level?

because there’s a high degree of concern

about something like classified information.

What happens is that by the time Arizona’s chief information security officer gets the

information, for example, it is not useful to them.

It has got to be more than simple information-

sharing – it has got to be broad collaboration. It is a whole-of-government discussion.

What is the main takeaway from the EO for state and local agencies?

ROBINSON: I think the main thing is that

the EO is very comprehensive. It provides a

good roadmap for state and local leaders to look at and say, “What can we do?” The EO

WARD: As we get more connected as a

reinforces what state and local governments

thinner and thinner. To protect our federal,

modern. You must understand the risks and

society, it’s almost like our borders are getting

need to do to become more mature and

state and local government, it’s critical that

make sure you fund them.

everyone take an interest in cybersecurity.

WARD: Every government in our country

There is currently no requirement in most

understands that cybersecurity is a huge

incidents they might have. But if there’s

more everyone plays their roles, the better off

states for the private sector to report any

concern, and everyone has a role to play. The

an attack on a private-sector company or

we are going to be.

institute, it could likely affect state and local networks, higher education and things like that, too.

This goes to the concept we call “all of state.”

Everyone in a state has a role to play in

cybersecurity. It is state governments, local governments, the private sector, higher education, etc.

ROBINSON: We’ve heard for years that

actionable intelligence-sharing is an area

that needs lots of improvement. There has got to be more collaboration and less just

throwing stuff downstream to state and local agencies. Frankly, there are lots of times they do not know what to do with information

because there’s so much latency built in, or Unpacking the President’s Cybersecurity Executive Order

37

“The mission is not insurmountable,

How to Climb Your Agency's Cybersecurity Mountain An interview with Katie Hanahan, Vice President, Cybersecurity Strategy, ITsavvy

In the public sector, overthinking cybersecurity is almost as bad as not considering it enough. For many agencies, cybersecurity is like standing at the foot of a mountain without any idea how to scale it.

Yet the only way over a mountain is one step at a time, and the same is true for cybersecurity. For agencies unsure about how to approach cybersecurity, the answer is basic cyber hygiene.

38

© Copyright 2004-2021. The ITsavvy marks are trademarks of MT & Associates LLC.

A GovLoop Guide

but it can feel that way sometimes,” said Katie Hanahan, Vice President, Cybersecurity at ITsavvy, an IT solutions provider, while discussing cyber hygiene. “You can’t climb a mountain without knowing how to get to the top one step at a time.”

Email info@ITsavvy.com to start.

IT Products. Technology Solutions. Peace of Mind.

Industry Perspective

How to Climb Your Agency’s Cybersecurity Mountain An interview with Katie Hanahan, Vice President, Cybersecurity, ITsavvy In the public sector, overthinking cybersecurity is almost as bad as not considering it enough. For

many agencies, cybersecurity is like standing at the foot of a mountain without any idea how to scale it.

But the only way over a peak is one step at a time,

and the same is true for cybersecurity. For agencies

unsure about how to approach it, the answer is basic cyber hygiene.

Cyber hygiene covers the steps that computer users

can take to protect their organization’s online security and system health. By mastering fundamental cyber hygiene, agencies can enable their employees to defend resources like data.

2. Avoid alert fatigue Alert fatigue is when the amount of cybersecurity alerts exhausts the people addressing them.

At agencies, alert fatigue can overwhelm

cybersecurity teams that may already have small budgets or workforces.

Fortunately, agencies can reduce alert fatigue

using security operation centers (SOCs). SOCs are centralized units that deal with security issues like cybersecurity on organizational and technical levels. After partnering with an external SOC

or starting their own, agencies can shift some cybersecurity burdens away from their staff.

“The mission is not insurmountable, but it can

“The benefit is that you’re outsourcing this piece

President, Cybersecurity at ITsavvy, an IT solutions

your organization can focus on the work at hand,”

feel that way sometimes,” Katie Hanahan, Vice provider, said of cyber hygiene.

Hanahan shared three ways that agencies

can elevate their cybersecurity by refining their cyber hygiene:

to someone else so that the IT people you have in Hanahan said.

3. Test cyberdefenses The best armor is battle-tested often, and

cyberdefenses are no exception. To avoid painful

1. Transform training

cybersecurity incidents, agencies can perform tests

Too often, agencies treat cybersecurity training as check-the-box training. When it comes to

cybersecurity, however, the more practice workers

have, the better. For example, agencies can conduct agencywide lessons quarterly rather than annually.

“We have to make sure we are doing this training with every level of employee,” Hanahan said.

Take email security. Hanahan recommended

that agencies instruct everyone from leaders to HR employees about why suspicious email

attachments should be avoided. The reason? Some suspicious email attachments may download malicious software onto agencies’ networks.

that detect security gaps without any lasting damage.

Take penetration tests evaluate IT security by

letting researchers safely expose vulnerabilities.

Another option is simulated cyberattacks, which let agencies practice how they might respond to real security incidents.

Although cybersecurity might seem daunting,

providers like ITsavvy can give agencies the security assessments, assistance and training they need for mission wins.

“We have the right ecosystem of partnerships to help them achieve their goals,” Hanahan said of ITsavvy.

“We can get through this and do this together.”

Unpacking the President’s Cybersecurity Executive Order

39

EO-Ready Best Practices for Cybersecurity The Biden administration’s EO on cybersecurity may become a before-and-after moment in the history of government cybersecurity.

That does not mean the EO will not matter to everyday Americans. Across every layer of the

nation’s public sector, government employees can make a difference in cybersecurity—that does not just benefit their agencies. Someday their cybersecurity contributions may aid the private sector and constituents, too.

The main takeaway governments should have from the new EO is that all their employees can

play their part in safeguarding national cybersecurity. Whether an entry-level hire or an agency leader, no role is too small to lend a hand.

Here are eight ways — two for each category of government employee discussed here — to

bolster U.S. cybersecurity from coast to coast. These tips are inspired by the federal, state and local thought leaders in this guide.

Rank-and-File Personnel

2. Stay informed.

Cybersecurity never stops morphing.

1. Embody skepticism.

With cybersecurity, every government employee can approach their work with more caution. No one wants to make their agency a cyberattack statistic, but the truth is even small security

informed about this critical topic should consider every training available to them. Even basic

lessons about topics the EO covers — like cloud security — can prevent painful experiences.

missteps can become big incidents.

As a result, all government workers should be wary of potential cybersecurity traps such as

suspicious emails. Another place for constant

vigilance is possible technology vulnerabilities.

Whether these potential flaws reside in

applications, IT networks or elsewhere, spotting them early can avoid costly security incidents.

Ultimately, any employee can contribute toward

better cybersecurity by avoiding suspicious links, email attachments and other possible pitfalls.

40

Government employees who want to stay

Although such cybersecurity education is

useful, not every government employee has the energy, money or time for classes. One alternative is following cybersecurity news

such as relevant EOs when the opportunity

presents itself. Another solution is getting the

gist of subjects like the latest cybersecurity EO

from trusted coworkers. Ultimately, even novice

cybersecurity knowledge is better than nothing at all.

A GovLoop Guide

Agency Management and Leadership

4. Think enterprisewide.

3. Promote cybersecurity learning.

a business risk that endangers their entire

Speaking of the macroscopic, many

organizations do not consider cybersecurity

Knowledge is power, but no cybersecurity

enterprise. At these places, organizational

that remain unaware of them. Consequently,

leaving other teams out of the loop about this

insights can reach government workforces

leaders may treat cybersecurity as an IT issue,

those in leadership positions should encourage

pivotal topic.

cybersecurity learning options whenever possible.

Agency leaders and managers can avoid this

Picture the supervisor of a close-knit team

shortcoming by erasing the silos that exist

individual could enroll in cybersecurity training

communication and information-sharing

cybersecurity EO and urge their teammates to

cybersecurity EO recommends, it reminds

at an agency. Leading by example, this

among their teams. Not only does this improve

related to acts like the Biden administration’s

about threat intelligence, as like the recent

do the same. Afterward, this leader can explain

everyone that they are in the same boat.

the training’s message to others who missed the event.

Positivity is another essential element. Federal,

state or local, every agency’s leaders hold sway

At a more macroscopic level, an agency’s

over a workforce’s morale. Praising successes,

their mission. The people with leadership

can all keep an agency’s talent optimistic about

leaders prioritize the way their talent pursues

encouraging progress and avoiding negativity

abilities should remember they can help steer

their enterprisewide cybersecurity.

their agency’s cybersecurity posture toward goals outlined in directives like EOs.

Unpacking the President’s Cybersecurity Executive Order

41

IT Personnel

6. Remember no one is safe.

Recall the new cybersecurity EO’s emphasis

5. Show others the ropes.

on zero trust cybersecurity. One of zero

Tools such as encryption and MFA may be

commonplace across the private sector, but that does not mean these capabilities are

equally widespread across the public sector. more collaboration between IT personnel and

their peers. By instructing their coworkers about how to use tools like encryption, IT personnel

can ensure these security practices become entrenched agencywide.

government IT personnel, internalizing this

principle can drastically improve the quality of Let us start with preparedness. By assuming

cyberattacks are a given, no agency’s IT talent

will ever stop looking for them. This quality does not mean government IT teams expect failure;

rather, it means they are always trying their best to prevent it.

This attitude could align agencies with the

recent cybersecurity EO’s technological details. become second nature if no one understands how to use them.

that security incidents are inevitable. For

their work.

How can agencies change this? One idea is

Ultimately, EO mandates such as MFA cannot

trust cybersecurity’s foundational tenets is

Next, ponder responding to and remediating

cybersecurity incidents. IT employees who expect successful attacks against their agencies also

know how to respond while they are happening and how to recover from the fallout.

42

A GovLoop Guide

Procurement Officials 7. Bake security into the process.

The Biden administration’s recent EO covers

everything from software supply chain security to cloud adoption. Procurement is one avenue

any agency hoping to meet the EO’s standards can use to do so more quickly and easily.

Think about secure cloud adoption. By

demanding that cloud vendors abide by

FedRAMP’s security requirements, procurement officers can ensure their agency aligns with

the EO. The same thinking can mold contracts related to the EO’s other details, like zero trust cybersecurity architectures.

8. Shop around.

Return to the national system for ranking

software security that the Biden administration’s EO will create. Once fully realized, this system

will become a detailed roadmap for evaluating, rating and purchasing secure software.

When this apparatus becomes operational, procurement personnel should make

referencing its rankings second nature.

Until then, there are several ways procurement teams can improve their agency’s security during contracting. Evaluating how well products and services comply with all

applicable global, federal, state and local

cybersecurity regulations is a sound first step.

The agencies that consider how the products and services they acquire will follow the EO’s

guidelines will have a head start on living the

Another idea is avoiding long contracts that lock agencies into partnerships with vendors that do not meet their needs.

document’s full intent every day.

Unpacking the President’s Cybersecurity Executive Order

43

44

A GovLoop Guide

Industry Perspective

Securing Your Agency’s Future With Zero Trust Security An interview with David Pipes, Senior Solutions Architect, Affigent

The recent cybersecurity executive order (EO) has a clear message – zero trust security is coming soon.

Starting with federal agencies, the public sector is now racing toward this new security strategy.

But implementing zero trust security can be long, difficult and costly without forethought. How can

agencies avoid getting bogged down by their zero trust security journeys?

2. Leverage productization Productization is the process of developing or

changing workflows, ideas, skills and services so

they can be marketed and sold to buyers. In terms of zero trust security, productization can help

agencies leverage products and services for their unique concerns, rather than creating their own solutions and workflows from scratch.

The answer is carefully considering how

automation, effort, investments and processes fit

zero trust security. Without this roadmap, agencies

may struggle to adopt zero trust security efficiently and affordably.

Take an agency that handles classified data.

By obtaining zero trust security products for this

information, it can save energy, time and budget

dollars its workers might have spent addressing the same need.

“The idea of going all out for a full solution is one only extremely knowledgeable and well-funded organizations can consider today,” said David

Pipes, Senior Solutions Architect at Affigent, an IT solutions provider.

Pipes detailed three steps agencies must take

before zero trust security becomes second nature:

1. Learn the basics

“Primarily, it helps by reducing the cost and complexity of implementation,” Pipes said of productization.

3. Avoid vendor lock-in Vendor lock-in happens when switching solution providers for capabilities like zero trust becomes

so cost-prohibitive agencies cannot do so easily.

Pipes recommended that agencies avoid this

pitfall by exercising caution until zero trust security

Before agencies can embrace zero trust security,

their employees must grasp how it works. After all, much of the zero-trust mindset marks a radical departure from traditional security.

For instance, traditional security had perimeters

around agencies’ IT networks to keep threats out. In contrast, zero trust security assumes cybersecurity breaches are inevitable because threats can

emerge either inside or outside such perimeters. To prevent as many incidents as possible, zero trust

security continuously monitors data, networks and systems in real time for threats.

tools are standardized.

“Don’t get swept up by early adopter product hype,”

Pipes said. “Custom implementations are expensive and hobbled by the lack of standards.”

Affigent can assist agencies with adopting zero trust security by offering the tools that make

the most sense for their workforces. These tools

automate parts of zero trust security, like continuous monitoring, so they happen with little to no human input. Ultimately, this helps agencies reap the best returns from zero trust security based on their specific efforts, investments and processes.

“My advice at this point is to let your staff learn about zero trust and perhaps try some small implementations,” Pipes said.

Unpacking the President’s Cybersecurity Executive Order

45

Conclusion The past two years have witnessed a troubling rise in the frequency and severity of cyberattacks. No matter where these security incidents occur, even the smallest one jeopardizes national normalcy.

The Biden administration’s cybersecurity EO suggests Americans are stronger together than apart when it comes to cybersecurity. Although cybersecurity is a constant concern, the EO equips the United States to weather this storm by bringing the public and private sectors closer together on topics such as threat intelligence.

Beginning with the federal government, the EO modernizes cybersecurity in ways that will strengthen state and local agencies, too. From there, this document unites the public, private and constituent sectors against global cyberthreats. Although nothing is certain with cybersecurity, the EO dramatically improves America’s cybersecurity odds.

About GovLoop

Thank You

GovLoop’s mission is to inspire public-sector

Thank you to Dell Technologies and its partners:

network for government. GovLoop connects

Red River, Sterling, Technology Integration

professionals by serving as the knowledge

more than 300,000 members, fostering crossgovernment collaboration, solving common

problems and advancing government careers.

GovLoop is headquartered in Washington, D.C.,

Affigent, Future Tech Enterprise, Insight, ITsavvy, Group, ThunderCat, and Wildflower for their support of this valuable resource for public sector professionals.

with a team of dedicated professionals who

Author

For more information about this report, please

Designers

share a commitment to the public sector. reach out to info@govloop.com.

Mark Hensch, Senior Staff Writer

Nicole Cox, Junior Graphic Designer

govloop.com | @govloop

46

A GovLoop Guide

1152 15th St. NW Suite 800 Washington, DC 20005 P: (202) 407-7421 | F: (202) 407-7501 www.govloop.com @GovLoop

Unpacking the President’s Cybersecurity Executive Order

47