MeriTalk recently spoke with Bobby McLernon, vice president of Federal sales at Axonius, on how Federal agencies can ensure employees will transition smoothly back to in-person working environments, while maintaining proper cybersecurity practices.
MeriTalk: Many agencies will begin sending employees back to the office this year. What implications does this have for cybersecurity?
McLernon: The cybersecurity implications are substantial. Last March, overnight, the Federal government went from roughly 20 percent of their workforce approved for telework to over 75 percent working from home. That’s over a million employees who used to work in an environment controlled and protected by IT and security teams, now working from kitchens, spare bedrooms, basements, and so on.
Assuming each Federal employee uses at least two devices, a minimum of 2 million government-issued devices have not been in the office for almost a year. That’s 2 million devices handling a variety of government data, all from home. At the direction of management, employees even invested in personal devices to ensure business continuity. All of this raises cybersecurity flags for government agencies.
Another implication is at the policy level. For example, agencies may choose to implement new health and safety measures because of COVID-19, such as temperature checks. This introduces two major complications: a new set of devices and additional regulations. The data from these devices is considered protected health information, and use of it must adhere to HIPAA regulations.
MeriTalk: What steps should cybersecurity teams prioritize before the Federal workforce returns to the office?
McLernon: The most important thing for cybersecurity teams to do is to align with agency leadership and agency mission. This not only gives teams a leg up in predicting how they can support the agency, but also helps with understanding the agency’s plan to return to work. Will the entire staff return at once or in a phased approach? Will some teams remain remote or go hybrid? Understanding the plan will help ensure a smooth and secure return to work.
Another important step before returning to the office is to run an asset inventory. It’s critical to determine what devices employees will be bringing back and establish if those devices are compliant.
MeriTalk: How can asset inventories provide a strong foundation for cybersecurity teams preparing for changes in the new year?
McLernon: A comprehensive inventory of all assets that connect to agency networks, including issued devices, cloud instances, virtual machines, and personal devices, enables cybersecurity teams to develop a punch list of how to close security gaps and ensure compliance. This is more important than ever as Federal employees return to the office with devices that are new to the agency network and potentially unsecured.
MeriTalk: Why is it important for agencies to take on a mission-focused approach, rather than a technology-focused approach, as cyber teams define their key initiatives for 2021?
McLernon: Once again, staying aligned with the leadership and mission of the agency is essential. Improving communication between cybersecurity teams and agency leadership has many benefits, including being able to better predict what will be needed. Is your agency expanding into new areas? Adding or reducing headcount? Undertaking new initiatives?
The change in administration makes this even more significant. With every new administration comes a new agenda. The cybersecurity leader who understands those goals will be in a better position to rise to the challenges of 2021. Cyber teams will then have a contextual baseline to guide their technology and staffing decisions.
MeriTalk: What are your recommendations for agencies shifting to hybrid working environments?
McLernon: Federal cybersecurity teams should review the latest guidance on remote and hybrid work. CISA released a draft Trusted Internet Connections use case last December, which lays out the network security patterns to secure remote user access to agency campuses, agency-sanctioned cloud service providers, and the web. Updating agency policies around remote access and BYOD to comply with this guidance ensures that staff have the same secure access when they transition to hybrid or in-person environments.
Also, NIST announced in September last year that it’s working on updating its teleworking guide (SP 800-46, last revised in 2016). It’s important to keep up with current guidance to ensure you’re able to maintain compliance.
MeriTalk: What cybersecurity tools or strategies do you consider vital for adapting to rapid shifts in work policies and practices?
McLernon: We’ve worked with a number of agencies that have seen significant ROI from investing in cybersecurity asset management. Many common challenges facing cybersecurity teams can be addressed with improved asset management, including:
- Finding unmanaged devices
- Identifying devices that are missing agents
- Seeing which devices have malfunctioning agents
- Discovering cloud instances not being scanned for vulnerabilities
- Finding cloud instances that are misconfigured or not in compliance
- Accessing contextual information about an alert
- Identifying software that is not allowed on government networks
Cybersecurity asset management brings together data from many different sources to help give cybersecurity teams easy answers to these challenges.
MeriTalk: What are some best practices that can help agencies ensure continuous security interrogation continues after employees return to the workplace?
McLernon: IT infrastructure barely resembles what it looked like just five years ago. A recent survey that we commissioned found that 52 percent of virtual machines (VMs) now reside in the cloud, and 55 percent of organizations have active Internet of Things projects. The survey also found that security teams use an average of 108 security tools.
The changes in IT infrastructure place enormous pressure on IT and security teams, which are already struggling to find new management and security tools that can keep up. VMs, new devices, and new device types are driving complexity. Cybersecurity teams that stay nimble will better adapt to changing environments.
Aggregation of data from multiple security tools is becoming a key component of ongoing asset management. No single tool can provide a complete answer to the most important questions cybersecurity teams ask on a daily basis. Organizations using more than 100 security tools still report visibility gaps. Security complexity – driven by evolving threats and new regulations – drives more siloed investment in tools, which further compounds the visibility problem. The answer is aggregation of the data from all of those tools, so that agencies have an accurate picture of their security posture.
MeriTalk: How can agencies best invest in cybersecurity to support future modernization efforts?
McLernon: It’s clear that the new administration wants to prioritize Federal IT security initiatives. Every agency will have a tremendous opportunity to improve their security posture in 2021. Having a thorough understanding of your current environment will help you decide where to focus improvement efforts. Cybersecurity teams should ask:
- Do we know what is on the network?
- Can we see who is on the network?
- What is happening on the network?
- How is our data protected?
MeriTalk: What’s your final piece of advice to Federal agencies in planning a return to the workplace from a cybersecurity and asset management standpoint?
McLernon: Think about where we were on day zero of this effort. The government must have all of its resources, HR management, and law enforcement available on day one when everyone returns to the building. The IT professionals need to be ramped and staffed appropriately for reclamation efforts. It is critical that agencies have a plan to keep them security-compliant and moving forward in the eyes of the Office of Management and Budget, as well as taxpayers.
In regards to telework, government agencies have undergone a huge transition. IT leaders will face many challenges as the workplace adjusts and continues to evolve daily, from technical issues to worker accommodations. For example, leaders must be ready to continue to support hybrid and remote work for employees who may not be able to return to the office full time in the short term.
Finally, it comes down to the basics – identify gaps, mitigate threats, and invest in automation when you can. As a nation, we managed a transition to remote work overnight last March. Agencies that embrace lessons learned will surmount the challenges of transitioning back onsite as well.
Axonius is the cybersecurity asset management platform that gives Federal agencies a comprehensive asset inventory, uncovers security solution coverage gaps, and automatically validates and enforces security policies. To learn more about why asset management matters for Federal cybersecurity, read this complimentary ebook.
