Login | Register

• Print this |
• Email this
• Digg
• De.licio.us
• Slashdot
• Technorati

More on this topic

Good security depends on people and as technology

Establishing a cybersecurity management operation requires more than just having the right tools in place. You also need the support of those above and below you in the chain of command. The Federal Aviation Administration’s Cyber Security Incident Response Center grew from a small operation with limited capabilities into a departmentwide security management center because of the support the center received and the technology it uses.

“We’ve gotten buy-in from the senior leadership,” said Mike Brown, FAA director of information systems security.

The technology is important, too. Having a good security management tool to correlate the growing volume of information from network sensors is critical if an incident response center is to be useful to its customers, said Ron Maree, Northrop Grumman program manager for FAA’s CSIRC.

“If it takes you 12 hours to get to something, you’re too late,” Maree said. The task also requires cooperation with other organizations working in the same space, such as the U.S. Computer Emergency Readiness Team. “Don’t try to do it by yourself and be a lone ranger.”

Once these pieces are in place, the most important thing is to provide value to the customers depending on your services. Security is not an end in itself, but an enabler for those who are running and using the network.

It should protect them without unduly restricting them, and it doesn’t hurt to let them know when they have dodged a bullet. Go for some low-hanging fruit to show some return on investment.

“We work to gain constituent trust,” said Christopher Garcia, FAA program director for CSIRC. “And once we get it we have to keep it.”

William Jackson

Project at a Glance

WHAT: Federal Aviation Administration Cyber Security Incident Response Center

MISSION: Provide the ability to protect FAA networks, detect intrusions and security incidents, respond to those incidents, and recover from them. CHALLENGE: CSIRC began as a small team with few tools and responsibility for monitoring only the FAA administrative network. The evolution of air traffic control and other FAA operational networks away from stand-alone systems made them more vulnerable to network threats. The FAA CSIRC set out to provide more protection and to become a federal Center of Excellence for cybersecurity, providing services to other agencies.

SOLUTION: Beginning in 2001 with the arrival of Mike Brown as FAA director of information systems security, support from top-level management at FAA enabled CSIRC to build its resources and expand its capabilities with the addition of professional analysts, standardized intrusion-detection tools and a security information management system to provide analysis of data from the sensors.

IMPACT: Response time to security incidents has been reduced from hours to minutes, and CSIRC has become the Transportation Department’s Cyber Security Management Center. It provides early warning and response to security problems for the department’s networks and assists with vulnerability and configuration management.

COST: This is an ongoing multiyear program that is part of the cybersecurity budgets of multiple agencies in DOT.