Does Your Security Strategy Effectively Protect Your Agency?

Cloud and mobile technologies have made it easier and more cost-effective for federal agencies to quickly deliver on critical missions. Yet, because these solutions are being used with greater frequency, they are broadening the attack surface and giving adversaries more potential targets.

For example, federal agencies are increasingly being pursued by bad actors seeking to attack or exploit the valuable, sensitive data they store. In fact, in the latest M-Trends report, government is now ranked as the third most-targeted industry, up from the seventh position in 2017.

A data breach or cyber attack can have a far-reaching impact on a federal agency’s operational performance. It could affect citizen data, causing loss of public trust, and may also result in agency leaders having to testify and defend their cyber procedures to Congress. There is also the risk of poor FITARA scores, causing tarnished reputations.

The Need to Validate Security Effectiveness

The simple truth is that good cyber governance is a “must have,” and that means federal agencies need tools that can measure and validate security effectiveness to help pinpoint risks.

Measuring cyber security is difficult; IT environments have become increasingly complex. Traditional operational metrics—such as cost and ROI—don’t translate to security goals. And focusing on KPIs such as incident numbers can lead to overlooking gaps.

Federal agencies must prove that their security investments are working the way they’re supposed to, including being able to:

• Continuously monitor and measure to ensure that security tools are working
• Leverage frameworks like the NIST Cybersecurity Framework to avoid overlaps and gaps in security infrastructure
• Validate cyber resiliency with data

For instance, many organizations believe their security investments are delivering expected value by protecting critical assets, but the reality is that they have already experienced a breach without knowing it. And did you know that on average, 80% of tools are misconfigured, leaving them underutilized at default settings?

That’s why federal agencies require empiric evidence of how effective their security controls are at protecting them against an attack. And with this type of evidence, there can be better alignment between CISOs and department leaders so they can better quantify cyber risk.

The good news is that there is a path forward to optimized security effectiveness. Good cyber hygiene starts with creating more alignment between CISOs and other agency leaders, coupled with ongoing, quantified measurement and monitoring of security.

Continuous validation of security effectiveness ensures ongoing cyber resiliency, no matter how the IT environment or attack landscape changes.

Learn more about quantifying security effectiveness by downloading our 2020 Security Effectiveness Report.