For Network Security, Age Matters Less Than Maturity
By Paul Parker, SolarWinds Federal & National Government Chief Technologist
Much has been written about aging government IT networks, but not enough attention has been paid to the maturity of those networks. While it’s important for agency IT professionals to modernize legacy networks, it is equally critical for them to ensure that their infrastructures are mature enough to handle rapidly changing security requirements. They must have faith that any potential threats or problems can be addressed and remediated quickly.
In addition to looking at various network connections, IT professionals must consider the policies and procedures they use to enforce network security. Are current practices adequate for responding to current and future threats?
A majority of respondents to a recent SolarWinds cybersecurity survey indicated they have “good” IT controls for addressing these questions. They are managing security to the expectations of their policies.
However, other respondents listed their controls as “excellent.” They are going beyond just meeting policy expectations and, as a result, are seeing greater success with risk monitoring and mitigation. They feel better equipped to handle potential threats and undoubtedly share two common understandings.
First, they recognize that network intrusions are likely to happen and are preparing accordingly. Second, they are willing to embrace change.
Those two beliefs are important for creating mature networks that are ready to handle potential threats.
The Network Will Be Hacked—It’s Just a Matter of How Badly
Our cybersecurity survey revealed increasing concerns about careless, untrained, or malicious insider threats. The latter is especially disconcerting, as malicious insiders are more likely to be aware of how to beat internal processes.
An agency-wide proactive approach to network security is helpful. IT managers should initiate comprehensive and frequent security training for all agency professionals to help them become more cognizant of the tactics used to infiltrate networks and show them how they can help prevent attacks.
Accept and Embrace Change
When the Defense Information Systems Agency introduced its Security Technical Implementation Guides and Command Cyber Readiness Inspections, there was a palpable sense of nervousness—and even paralysis—among some people in the federal IT community. Many wondered how the new guidelines would affect their ability to do their jobs. Others were concerned about how to effectively prepare their agencies to meet DISA requirements.
But change is an inherent part of an IT manager's job, and the ability to manage change is essential, particularly when dealing with today’s escalating and evolving threats. Security processes must be readily adaptable to new needs and requirements. When new security policies are issued, it is because leaders perceive a potential threat that requires a different type of reaction from agencies. IT teams must be ready to work within those new policies, even if they must modify their approaches to do so.
The government cannot afford the equivalent of what took place in Atlanta, where the SamSam ransomware attack left the city scrambling to restore critical resources. Agencies need strong, mature networks that can quickly and automatically identify and fix issues in minutes as opposed to hours or days. With the right mix of policies and tools—and the right mindsets—teams can successfully raise their networks’ maturity levels to comfortable points.
Find the full article on GCN.
The SolarWinds trademarks, service marks, and logos are the exclusive property of SolarWinds Worldwide, LLC or its affiliates. All other trademarks are the property of their respective owners.
