Government Information Security Podcast

Think of the National Institute of Standards and Technology, and most people charged with safeguarding government IT assets think of NIST's information security guidance. But NIST's core strength lies in its long history of measurement and testing, and that should prove valuable as the federal government changes the way it evaluates IT security, from a process that focuses on agency and departmental compliance with regulations to one of measuring IT systems in real time to verify they're truly secure.

"People think of us as only the standards, but you can't really have effective standards unless you can measure that you're meeting those standards, and measurement at NIST means testing," says Cita Furlani, director of NIST's Information Technology Laboratory in an interview with GovInfoSecurity.com.

Furlani discusses not only how NIST is gearing up for changes in the way government will measure cybersecurity but the proposed reorganization of the Information Technology Laboratory that she heads. The reorganization is on hold until a new NIST director is confirmed by the Senate. President Obama said he plans to nominate Patrick Gallagher, NIST interim director, to the post.

In the interview, Furlani also addresses the struggles government IT security professionals face in complying with the Federal Information Security Management Act, and how NIST can help make that process easier through automated controls. FISMA charges NIST to develop cybersecurity standards and guidelines.

ITL, as the lab is known, formulates metrics, tests and tools for a variety of subjects, including information complexity and comprehension, high confidence software, space-time coordinated mobile and wireless computing as well as issues of information quality, integrity and usability. ITL also has been charged to lead the nation in employing existing and emerging IT to meet national priorities that reflect the country's broad based social, economic, and political values and goals. Under provisions of the USA Patriot Act and Help America Vote Act, ITL also addresses major challenges presented by homeland security and electronic voting.

Prior to being named ITL director 3½ years ago, Furlani served as NIST chief information officer, acting director of the NIST Advanced Technology Program and director of the program's Information Technology and Electronics Office. She began her career at NIST as a computer scientist and group leader in the Manufacturing Engineering Laboratory. Furlani also served as director of the White House's National Coordination Office for Networking and Information Technology Research and Development.

Eric Chabrow, GovInfoSecurity.com managing editor, interviewed Furlani.

The International Spy Museum has just celebrated its 7th year and its 5 millionth visitor, says Executive Director Peter Earnest, a former CIA officer who's run the museum since its inception. In an exclusive interview, Earnest discusses:

Earnest is a 35-year veteran of the Central Intelligence Agency (CIA). He served 25 years as a case officer in its Clandestine Service, primarily in Europe and the Middle East. He ran intelligence collection and covert action operations against a range of targets including Soviet Bloc representatives and Communist front organizations.

As Museum director, he has played a leading role in its extraordinary success as a Washington attraction. He edits the Museum's book ventures and has frequently been interviewed by the major media in radio, TV, and the press on current intelligence issues.

American combat forces deployed in Afghanistan and Iraq employ biometrics to tell our friends from insurgents and terrorists. Back home, the Defense Department uses similar fingerprint, iris and facial recognition tools to manage access to military bases and IT systems.

Coordinating Defense Department efforts to find new uses of biometrics on the battlefield and back home is the Army's Biometrics Task Force, which leads Defense Department efforts to program, integrate and synchronize biometric technologies and capabilities. The task force also operates DoD's biometrics database that supports the nation's security strategy.

In an interview with GovInfoSecurity.com's Eric Chabrow, Deputy Director Lisa Swan discusses the:

Swan began her government service 20 years ago. Prior to her current assignment, she served as director of the task force's Biometrics Integration Directorate, overseeing the integration, coordination, and synchronization of biometric technologies and capabilities across the Department of Defense. She holds a BS in material engineering from North Carolina State University and two MS degrees, one in systems engineering from Virginia Tech and the other in national resource management from the National Defense University.

Army Lt. Col. Gregory Conti is a man on a mission, not only to educate the next generation of Army officers on cybersecurity, but to change the culture of the military to put cybersecurity on the same footing as an Air Force pilot, a Navy ship officer or an Army combat leader in career advancement.

In an interview with GovInfoSecurity.com, Conti, an academy professor of computer science at West Point who coordinates the United States Military Academy's cyber warfare curiccula, discusses the:

Conti earned a bachelor degree in computer science at West Point in 1989, a year before laptops became standard issue to all cadets. Since then, Conti has earned a master and doctorate in computer science from Johns Hopkins University and George Institute of Technology, respectively. He also has written two books on cybersecurity, Googling Security (Addison Wesley, November 2008) and Security Data Visualization (No Starch Press, September 2007) as well as co-authoring with Army Col. Col John "Buck" Surdu an article proposing a fourth, coequal military branch focused on cybersecurity.

Determining how best to secure the nation's critical IT infrastructure must be a collaborative effort by the federal government and the private sector, says Charles Croom, vice president of cybersecurity solutions at defense contractor and IT integrator Lockheed Martin.

A retired Air Force lieutenant general, Croom is an astute observer of government-private sector cooperation, having served as director of the Defense Information Systems Agency and commander of the Joint Task Force for Global Network operations.

In an interview, Croom discussed the:

Croom spoke with Eric Chabrow, managing editor of GovInfoSecurity.com.

What do these events mean for the financial regulatory agencies - especially in terms of securing access to sensitive data?

John Bordwine, Public Sector CTO at Symantec, tackles this question, discussing:

As the Symantec Public Sector CTO, Bordwine currently serves as a trusted advisor, providing guidance on the development of products and solutions that meet government requirements and certifications specifically focused on the Public Sector markets. His responsibilities also include all technical activities related to Public Sector customers, which includes federal, state, and local government agencies, and education industries. In addition to these responsibilities, he also provides guidance to other Symantec business units around specific requirements to the Public Sector industry.

Previously, Bordwine spent over five years with McAfee as the Public Sector CTO and Senior Director of Security Engineering.

He has spoken at numerous highly-acclaimed security events, including SANS Institute events, FOSE, AFITC, and US Government agency-specific functions. Bordwine holds a Top Secret clearance and served in the US Army Signal Corps where his last assignment was with the White House Communications Agency.

This is the key takeaway - and to some extent the surprise - of the new Top Cybersecurity Risks report released on Sept. 15 by TippingPoint, Qualys, the Internet Storm Center and SANS Institute.

In an exclusive interview about the report, Alan Paller, Director of Research at SANS, discusses:

Paller founded SANS in 1989 to provide graduate-level education to cybersecurity professionals. In the intervening years, more than 80,000 people have learned their technical security skills - from forensics to penetration testing to intrusion detection, in SANS courses.

Today he focuses on identifying the tipping points that can turn the tide against the growing wave of cyber crime and cyber espionage. He has testified several times before the US House and Senate, and the President named him to the National Infrastructure Assurance Council. His degrees are from Cornell and MIT.

Your organization has been breached - how should you immediately respond? How should you not respond?

Alysa Hutnik, attorney with Kelley Drye in Washington, D.C., specializes in information security and privacy, counseling clients on what to do after a security breach. In an exclusive interview, Hutnik discusses:

Hutnik is an Associate with Kelley Drye whose practice includes representing clients in all forms of consumer protection matters. In particular, she specializes in advertising, privacy, and data security law. She frequently conducts workshops and gives speeches on advertising, privacy, and data security compliance. She is often quoted on these issues in major business and law journals and newsletters, and has authored numerous advertising, privacy, and data security articles. Ms. Hutnik was recently nationally recognized as a leading practitioner in the area of Privacy & Data Security by Chambers USA.

So, how should businesses and government agencies prepare for the expected widespread return of the H1N1 virus?

Regina Phelps, a noted expert in pandemic preparedness, updates us on H1N1, discussing:

Phelps is an internationally recognized expert in the field of emergency management and continuity planning. With over 26 years of experience, she has provided consultation and educational speaking services to clients in four continents. She is founder of Emergency Management & Safety Solutions, a consulting company specializing in emergency management, continuity planning and safety.

David Matthews, like other government information security officials, knows the security problems social networks present. And like his cohorts in municipal, state and federal governments across the nation, Matthews - deputy chief information security officer of the city of Seattle -has little choice but to support social networks, especially considering the city's top elected officials use them.

"The first thing we had to admit was that the horse is long gone out of the barn and there's really nothing we can do about it at this point," Matthews says in an interview with GovInfoSecurity.com. "Users including council members, the mayor, everybody else are using social network, either personally or for city business. There are a few of them that have bothered to ask about what we thought about it on the security side of things, but the vast majority has just gone ahead and done it."

Social networks is one of the challenges Matthews discussed in this first of a two-part interview with Eric Chabrow, managing editor of GovInfoSecurity.com. In the first part, Matthews describes:

In the second part of the interview, which will be posted presently, Matthews discusses IT e-discovery and the IT security office relationship with the city's legal department.