A recent risk report from the Office of Management and Budget delivered sobering cybersecurity news to federal agencies. According to the OMB, a majority of agencies with cybersecurity programs in place remain at significant risk of attack. As noted in the report, “Agencies cannot detect when large amounts of information leave their networks.”
That is a startling observation, but perhaps it should not be entirely surprising. Today’s government workers rely on a mass of cloud services, mobile devices and interagency connection points to do their jobs. Traditional security perimeters have dissolved, creating a wide attack surface that can be difficult to defend and tough to monitor.
Traditional security measures are inadequate in this amorphous environment because they simply block all events that look like exfiltration, no matter how innocuous. Blockages occur without any understanding of the context of the event in question. As a result, the simple act of copying a file for agency use may create unwanted friction between IT and agency employees. Users will want to find ways around the security measures, and IT will want enforce the restrictions, perhaps even forcing users to obtain manual permissions. This set up is time consuming for IT staff and effectively handcuffs workers trying to do their jobs.
Intersection of an agency’s two most important resources
The key to devising a better information security program lies at the intersection of government agencies’ two most important assets: people and data. Specifically, agencies should consider developing human-centric, automated and adaptive security responses based on how individual users interact with data. This approach – risk-adaptive protection – focuses on how, when and why people use and access information, placing users’ actions into a larger context based on their normal activities.
The process creates a baseline “normal” understanding of users’ typical behavioural patterns and as a result can identify, in real-time, anomalies that manifest in different ways. For example, a person may follow the same daily pattern of accessing certain types of information, and a deviation from that pattern could raise a red flag. A worker who has suddenly begun attempting to access sensitive files or uploading government information to a personal Google Drive or Dropbox accounts could indicate in real time that the employee’s credentials have been compromised and someone else is using that identity to access the network.
Better security without compromising efficiency
Focusing on individual users’ data interactions allows security managers to see, organise, manage and mitigate risk as it occurs. They can customise security responses and protocols according to the level of risk that an agency is willing to accept, and the system can automatically apply the necessary measures to relevant users on the network based on anomalous patterns and risk scores. In doing so, security managers can prevent the accidental or malicious use of agency data and better combat external threats from phishing attacks, compromised credentials and other potential vulnerabilities.