Cyber Talks 2023 Recap: Challenges and Solutions for Cybersecurity in the Public Sector

CyberTalks 2023 brought together experts from government, tech and academia to discuss cybersecurity and digital privacy issues. The event, hosted by CyberScoop, featured insights on how to secure critical infrastructure, fight ransomware, counter cyber threats from adversaries and protect consumer rights. Following are key takeaways on challenges and solutions for securing the public sector. 

Seeing cybersecurity from a global perspective 

As the world becomes more interconnected, cyber threats also become more widespread and diverse. 

The discussion was focused on the need to think about cybersecurity as a global issue that requires awareness and action from everyone across the organization.

• Gary Buchanan, CISO, National Geospatial-Intelligence Agency
• Russell Marsh, Director, Cybersecurity Operations, National Nuclear Security Administration
• Chris Konrad, AVP, WWT
• Billy Mitchell, Executive Editor & SVP, Scoop News Group

It is not enough to rely on technical skills or knowledge, as adversaries can use AI or other services to launch attacks. Organizations need to increase their visibility of the cyber ecosystem and protect their networks and assets as they evolve.

To achieve this, cybersecurity must be a mission-critical part of the business strategy, with leadership buy-in and support. CISOs and security leaders also have to address the challenges of staffing, communication and innovation. They need to find and retain qualified staff, communicate effectively with stakeholders about the risks and priorities, and continually upgrade and evolve their cybersecurity capabilities.

Centralizing security across government agencies

A common theme among the various federal departments and agencies (such as OMB, NGA, NNSA, U.S. Space Force, TTS, DOJ, NIST, DOL, Dept. of Commerce) is the need to align security strategies, architectures and tools under a unified framework. This would help to eliminate redundancies, improve efficiencies and enhance collaboration across the government. However, the current funding model of the government creates silos that hinder this centralization process. A possible solution is to promote the use of shared services, such as Login.gov, that can provide common security functions for multiple agencies. Moreover, the government should adopt a pragmatic approach to security tools: use what is already available, purchase what is needed and create what is essential. Finally, security tools should be accessible and usable by all relevant stakeholders, not just a few experts.

Balancing security and usability with zero trust 

Zero trust continues to be a hot topic in cybersecurity, especially for agencies like the Air Force and the Space Force that deal with sensitive information and high-security clearance. They have to implement strict access control policies that limit the exposure of data to the minimum necessary level. However, they also have to balance security with usability, ensuring that their users can perform their tasks effectively. The Department of Justice faces a similar challenge with over 160,000 users, who need to be managed by a dynamic and trackable identity and access management program running on the principle of least privileged access and zero trust. 

To achieve zero trust, it is important to have insight from both the private and public sectors, as well as learn from incidents like SolarWinds. However, no amount of money or technology can guarantee 100 percent protection from cyberattacks. The best that agencies can do is to improve their posture and be prepared for any scenario.

Managing legacy technology continues to be an obstacle 

One of the recurring challenges that many federal organizations face is the outdatedness of their cybersecurity systems, tools and infrastructure. For example, the Space Force, despite being only four years old, has inherited antiquated technology. This makes the integration of hardware and software more difficult, especially when dealing with legacy technology that is not compatible with newer standards. It is not enough to simply upgrade the technology; the policies that govern its use and management also need to be updated. IT modernization, such as moving to the cloud, can also bring additional benefits of improved security features that may not be available in older systems.

Democratizing security and collaborating across sectors

Security professionals across the government face the challenge of balancing multiple priorities and tasks in a complex and dynamic environment. They cannot do it all alone, and they need to empower others to contribute to the security posture of their organizations. One way to achieve this is to democratize security tools and practices so that other stakeholders can integrate security into their workflows and processes. This requires strong collaboration and knowledge-sharing among the public and private sectors, as well as guidance and feedback from the highest levels of government. For example, FedRamp provides a standardized approach to cloud security for federal agencies, but it also needs regular input and evaluation from the security community. To succeed in this endeavor, security leaders need to speak the language of decision makers and communicate the value and impact of security in terms that resonate with them.

Balancing security and innovation with AI 

AI is a double-edged sword in the field of security. On one hand, it can help security teams enhance their capabilities and efficiency, especially when they have limited resources. On the other hand, it can also be used by malicious actors to launch sophisticated attacks and evade detection. Therefore, it is essential that AI teams and security teams collaborate and align their goals and strategies. They also need to ensure that the data they use and generate is well-managed and secured. 

Generative AI assisted in creating this content.