The Federal Information Security Management Act (FISMA), as represented in the report by the CSIS Commission on Cyber Security for the 44th Presidency, was noted as needing an overhaul; however the report only considered a limited scope in evaluating the purpose and role FISMA plays in securing federal government information systems. Notwithstanding the discussion of making progressive updates to FISMA, in fairness with the intent of FISMA, the report fails to present many of the improvements already made as a result of the initial implementation of FISMA. A key point this section of the report focuses on, is integrating performance-based measures of security in FISMA. This ideal concept of a performance-based system only expands upon the current scorecard approach that seemingly puts agencies into a false sense of security if they achieve a higher score. Performance as a measure for security only causes an undue burden on agencies to try to improve a score (or a performance metric), rather than improve security as a function of the operational environment that must have a direct relationship with mission assurance.
The report does indicate an active role of the government in conducting cyber assessments to assess the cyber infrastructure, but again the report does not consider the larger picture of security. The importance in having external entities evaluate agency policies and procedures to identify weaknesses in the organization structure is key to ensure the agency can effectively deliver a mature security program. How the agency integrates security into budgetary decision-making process is also important to ensure security is adequately funded (with a directly relationship in the financial reports to security costs). Additionally, it is important to ensure agencies do not isolate security in the IT organization, thereby making the security managers work extra hard to demonstrate to the business-side the value security provides as a cost-savings. Rather security should be integrated as a cross-cutting component that is necessary for protecting the overall mission.
The report lacked significant substance regarding any currently ongoing activities to revamp the Federal Information Security Management Act by the amendment of the original law through the adoption (in whole or part), the Federal Information Security Management Act of 2008 (S.3474) that recently received approval by the Senate Homeland Security and Governmental Affairs. The bill, in its current state, takes some aggressive steps to achieve a more proactive role by the federal agencies to demonstrate their security posture to Congress, hopefully giving the American public more confidence in the security of their federal government.
Some points really not emphasized in the report that would improve the discussion of FISMA as part of the overall advice to “Modernize authorities”, should have considered organizational improvement in information security. FISMA it a good framework, however it lacks in necessary authorities and should emphasize the realistic nature of the operations of the federal government (a diverse and decentralized infrastructure) and the challenges for implementing government policy, that do not always provide the flexibility to balance security with mission constraints. The report should have added substance that reflects the role security plays in the overall strategy presented by the executive leadership. Agencies should adopt leadership roles that place information security at the executive level with a decision-making authority that enables security to be part of the business, rather than represented as a “compliance arm” or “cyber cop” of the organization.
bigfatcc unicc-bazarcm
