Strengthening Internet of Things Security at the Federal, Local, and Consumer Level

"Our world is more connected than ever." This phrase can be interpreted in many ways, one being the growth of Internet of Things (IoT) devices. Traditional materials and devices, including bridges, streetlights, water processing machines, home refrigerators, and even our doorbells, are now connected to the internet and to users who need to track how they are functioning. However, this cyber connection also means that these devices are open for others to access and use in ways we never envisioned.

Cybersecurity practices must now extend to non-cyber products to ensure that operational technology does not compromise information technology or the networks that connect them. In fact, 1.5 billion attacks were launched against IoT devices in a single year.

Efforts to secure IoT devices must happen across all levels of users, from the federal government through state and local agencies to even citizen consumers. Continue reading

Creating an Inventory of Tech and People for More Secure Systems

Moving to a zero-trust model for cybersecurity is dependent on understanding who and what needs access to your network. While simple to say, it is not as simple to do. Government agencies are currently focused on ensuring they have the full picture of what is on the network and who they need to support securing those assets.

Defining the Ecosystem

As agencies progress on their zero-trust journey, understanding every piece that touches networks becomes critical. These touchpoints often extend beyond traditional technology solutions. The growth of Internet of Things (IoT) devices introduces operational technology into the IT architecture.

Edge computing devices being used by field staff, sensors, and cameras all provide valuable data and efficiency, but they also provide an entry point for bad actors. Because of this, the Office of Management and Budget has tasked agencies with creating an IoT Inventory by the end of fiscal 2024. The memo details the breadth of devices to be inventoried, including building maintenance systems, environmental sensors, specialized equipment in hospitals and laboratories, and more. With this inventory in place, agencies will be able to take advantage of a new working group on the CISO Council, which will define IoT and OT security best practices.

New Approach = New Talent

With cybersecurity permeating every aspect of government operations - from traditional IT to the operational systems mentioned above - we need to take a look at how we train the federal workforce. With a recognized cybersecurity skills gap, new efforts are underway to grow a workforce trained and able to take on cybersecurity challenges.

  • The Federal Cybersecurity Workforce Expansion Act has been introduced to grow the federal cybersecurity workforce through the creation of several programs including a focus on providing cybersecurity training to veterans.
  • Keeping cyber talent in government is just as critical as training new talent. The Office of Personnel Management has created the cyber rotational program to allow federal employees to move to details at other agencies, providing the opportunity for growth within the federal government.
  • The National Geospatial-Intelligence Agency is building its cyber ranks with the next generation. It created a program to hire high school students as interns and give them top-secret security clearances to work on mission-critical work.

GovEvents and GovWhitePapers have a host of resources that detail how agencies can get a handle on the things they need to secure and the people they need to do that work.

  • Identify, Evaluate & Prioritize Industrial Cyber Risk (January 10, 2024; webcast) - Industrial control system (ICS) security represents one of the more challenging areas for security professionals. It's often a legacy system that wasn't designed with security in mind and, because it's different from traditional IT assets, it has very different security requirements. And no surprise--such systems are increasingly targeted by sophisticated cyberattackers, including ransomware gangs and nation-state actors. Learn how to harden OT assets against cyber-threats, identify critical endpoint vulnerabilities and risks, enable rapid recovery, and more.
  • Bridging the Cybersecurity Talent Gap in Government (January 11, 2024; webcast) - Navigating the unique challenges of the government and public sector demands a specialized approach to cybersecurity talent. This session will unveil groundbreaking methods, from upskilling your current team to leveraging a pre-vetted cybersecurity talent pool. It will also explore government-funded cybersecurity training programs to enhance your workforce.
  • Federal News Network's Industry Exchange Cyber (January 22, 2024; webcast) - Gain a perspective on cybersecurity issues critical to government: intelligence, endpoint management and remediation, identity security, cybersecurity asset management, and security orchestration and response.
  • CyberSmart 2024: Cybersecurity Faces a Rapidly Changing Landscape (January 25, 2024; Reston, VA) - Just as agencies are implementing zero-trust architecture to help with this wave, other IT developments are threatening to upend cybersecurity even more. Artificial intelligence is being incorporated into software, even as elected officials and regulatory agencies are trying to develop new rules of the road for its use. At the same time, historically offline operations technology is beginning to be integrated with IT systems, opening up the OT to attacks that previously weren't feasible.
  • Cybersecurity (white paper) - The increasing use of communication technologies relying on complex data, technology, communication, and interconnectivity has expanded attack surfaces and increased the potential risk of malicious exploitation. The Department of Homeland Security Science & Technology's Cybersecurity Program leverages multidisciplinary expertise to research, analyze, and develop cutting-edge cybersecurity technologies and capabilities to improve the protection and resilience of our national critical infrastructure and federal and state departments and agencies.
  • Accelerate Cybersecurity Mandate Compliance (white paper) - In the push to comply with a multitude of cybersecurity mandates, federal agencies are faced with challenges of cost, complexity, and delays to achieve full compliance. Failure to fully implement the requirements of these mandates, however, is not an option when critical infrastructure, public services, and national security are at risk from an ever-expanding threat landscape.
  • Building the Cybersecurity Workforce Pipeline (white paper) - This report analyzes the National Centers of Academic Excellence in Cyber (NCAE-C), a consortium of institutions designated as centers of excellence by the National Security Agency, to determine how NCAE-C designated institutions fare compared to other schools in graduating students with cyber-related degrees and credentials.

For more on the government's path to zero trust, explore the resources available on GovEvents and GovWhitePapers.

Staying Ahead of the Bad Guys: Investing in Cybersecurity

Agencies are challenged to move more and more services online, become more transparent, and leverage new streams of data from the Internet of Things (IoT) for better decision making, all while securing the systems and the data they hold. If that is not challenging enough, cyber threats against all of these efforts are continually evolving. A series of strategies and ongoing guidance are helping agencies prioritize work and budget requests to make the most impactful investments in their cybersecurity infrastructure.

The National Cybersecurity Strategy (NCS) provides broad guidance to help position the United States to build a digital ecosystem that is more easily and inherently defensible, resilient, and aligned with its values. Efforts to do so are organized around five pillars:

1) Defend Critical Infrastructure

2) Disrupt and Dismantle Threat Actors

3) Shape Market Forces to Drive Security and Resilience

4) Invest in a Resilient Future

5) Forge International Partnerships to Pursue Shared Goals Continue reading

Putting a Value on Trust — Introducing Zero Trust Security Approaches

With so many high-profile hacks this year, it's easy to want to throw up your hands and say, "Is there nothing that can be trusted?!" Interestingly, that lament is what is driving the latest approach to cybersecurity -- zero trust. Zero trust is what it sounds like, a security approach centered on the belief that organizations should not automatically trust anything accessing their systems either inside or outside their perimeters. Instead, all people and devices must be verified before access is granted. To the untrained eye, this seems untenable. How, in this day and age, when we depend on digital information and connection to do most anything, can we use a process where we have to constantly verify identity and access permissions? Luckily, the practice of zero trust is more sophisticated than its premise.

Continue reading

The Growing Impact of IoT

The use of Internet of Things (IoT) to manage infrastructure and services is not a new concept, but response to the new normal of pandemic life, natural disasters, and the implementation of 5G networks all could accelerate the implementation of IoT solutions.

Remote Management

Stay-at-home orders, social distancing measures, and backlogged inspection schedules all combine to make a great case for implementing sensors and other IoT devices as part of infrastructure management. With technology providing data on the status of equipment, facilities, and general infrastructure like roads and bridges, the need to deploy inspectors to the field can be minimized. In the short term, this reduces potential points of exposure for inspectors and field staff. Longer term, it adds a new "colleague" to field management teams. IoT can handle routine, low risk monitoring, freeing up humans to focus on more complex or higher priority tasks and activities.

Continue reading