Six federal security programs that are making a difference

Computerworld - When it comes to information security issues, the stories that get the most ink are usually the ones about massive data breaches and other foul-ups, especially if they occur within government.

That's one of the reasons why the Bethesda, Md.-based SANS Institute has decided to come out with a list that focuses on what it considers to be some of the more successful security efforts within the federal government. "It gets old if all you ever do is take potshots" at entities that suffer breaches, said Alan Paller, SANS' director of research.

The six initiatives in the SANS list were selected based on actual evidence of having made substantial and measurable improvements in one or more of three areas, according to Paller. Those three areas are the ability to prevent cyber attacks against critical infrastructure targets, reducing national vulnerability to cyber attacks, and minimizing damage and recovery time from attacks that do occur.

Among the six in the SANS list, which was released Monday, are the following:

The Federal Desktop Core Configuration (FDCC) initiative

The FDCC effort helps government agencies reduce procurement costs and bolster security of their desktop environments by requiring agencies to implement standard baseline security configurations on all their Windows XP and Vista desktops. The configurations were originally developed and used by the U.S. Air Force with help from the National Security Agency, Defense Information Systems Agency and the National Institute of Standards and Technology (NIST). The move helped the USAF reduce patching time from 57 days to less than 72 hours and helped reduce desktop procurement costs by over $100 million for the USAF, the SANS report noted.

The USAF's success has prompted an effort to implement similar baseline standards on millions of desktops across the government in the form of the FDCC. "The most important success in federal government cybersecurity to date is the Federal Desktop Core Configuration (FDCC) and its predecessor proof-of-concept project in the U.S. Air Force," the SANS report said.

The US-CERT Einstein program

The Einstein Program is an initiative to improve cybersecurity-related situational awareness across the civilian federal government. The program enables full-time monitoring, sharing and analysis of network traffic data across federal agencies to help them more quickly detect and respond to cyberattacks. So far, 14 federal agencies have deployed Einstein monitors on their network gateways to capture network traffic information and feed it to an analysis program run by the US-CERT on behalf of the U.S. Department of Homeland Security.

This technology demonstrated its promise when it helped the Department of Agriculture quickly identify a system penetration based on an analysis of network packets that had been transmitted from its network to the Department of Transportation. The Einstein program is especially important "in an age of botnets where increasing numbers of federal systems are infected through spear phishing and then used to attack other organizations or to steal sensitive information," SANS noted.