ACQ Subscribe

The massive initiative to deploy continuous monitoring at U.S. federal government agencies will be done in phases, with the initial rollout occurring over three years, the Department of Homeland Security's John Streufert says.

That initial phase is aimed to get federal civilian agencies to employ continuous diagnostic tools to improve vulnerability management, enforce strong compliance settings, manage hardware and software assets and establish white-listing of approved services and applications.

In an interview with Information Security Media Group, Streufert says adopting these continuous diagnostic tools should help organizations plug the holes in their systems to prevent unauthorized access to data.

"We know that 80 percent of the incidents ... involved some kind of problem of exfiltrating of the data that leans on cyber-flaws previous known," Streufert says. "All these capabilities in the first phase are designed in a way to see to it that the problems of those areas of civilian networks are reduced."

The DHS initiative, known as the Continuous Diagnostic and Mitigation program, offers federal, state and local government agencies the ability to purchase discounted hardware, software and services to assess cybersecurity risks and present those risks in a continuously updated dashboard. This would enhance the ability to identify and counteract day-to-day cyberthreats. The federal government has allotted up to $6 billion to be spent over the next five years for agencies to acquire goods and services for the project (see $6 Billion DHS IT Security Plan Advances).

In a later phase, which is being delayed several years, agencies will use continuous diagnostic tools to manage privileges for systems and applications access. "Historically, we found that the cybersecurity professionals working with program managers and departments and agencies require a little bit of time to get used to the tools," Streufert says.

In the interview, Streufert:

Explains why the federal government refers to continuous monitoring as "continuous diagnostics;" Discusses the goals of the Continuous Diagnostic and Mitigation program; Delineates the responsibilities of agencies and DHS in implementing the new program.

In second half of the interview, to be posted shortly, Streufert will address the challenges of managing the new program, including overseeing vendors.

Streufert serves as the director of Federal Network Resilience within the National Protection and Programs Directorate at DHS. From 2006 to 2012, he served as the State Department's chief information security officer, where he instituted a program that resulted in an 89 percent reduction in risk in 12 months.

An earlier version of this story identified Streufert as director of the National Cybersecurity Division. That was what his job was known as at the time he was hired by DHS.