One of the most important aspects of the Continuous Diagnostics and Mitigation Program (CDM) is making sure that the dashboard is flexible and able to display metrics that the specific agencies want to track.
Aubrey Merchant-Dest, Federal chief technology officer at Symantec, said that in order to travel to MeriTalk’s Cybersecurity Brainstorm in Washington, D.C., on Sept. 20, he used Google Maps to determine how long it would take to get from his house to the Newseum. He said that if he’d relied on that application alone he would not have made it on time, because he was able to use his own knowledge of the route to factor in potential problems like school bus routes.
“How do we adapt the CDM dashboard to something like that?” Merchant-Dest said.
Merchant-Dest said that CDM dashboards should give agencies the ability to integrate knowledge of their own systems in order to provide more accurate data, which would give the government a better understanding of the threat landscape.
Another problem is how quickly the government can deploy a new technology once it becomes available. Department of Homeland Security (DHS) CISO Jeffrey Eisensmith said that the process to deploy a new technology used to be a lot more difficult and require a lot more heavy lifting with a “cornucopia” of technologies to deal with.
“Now if one tool is starting to lag and there’s a new one out there, I now have a clean path to insertion,” Eisensmith said.
Ralph Kahn, vice president of Federal at Tanium, said that the CDM program leaders could be looking back at Phase 1 of CDM to update the standards to become more agile for the agencies that are still working in Phase 1. Kahn said that it’s preferable to have a 30-day acquisition process.
CDM’s current phase, Phase 3, measures each agency’s time to breach and time to remediation.
“Let’s keep reducing the time it takes to find them and the time it takes to get them out,” Kahn said.
Milo Speranzo, director of strategy and compliance at Tech Data Government Solutions, said that the acquisition piece needs to become more flexible in Phase 3 of CDM.
“There has to be a shared services model,” Speranzo said. “That’s the only way to move forward.”
The White House’s IT Modernization Report, which was released Aug. 30, calls for the use of shared services in areas such as cloud and cybersecurity.
Speranzo said that he’s experienced an accountability problem within agencies dealing with CDM. Speranzo would approach agencies with the technology needed to meet the CDM deadlines and agency employees have said that “it’s a soft deadline.”
“We disagree, but we never tell them that,” Speranzo that. “We’d like to harden those deadlines in the future.”
