The flagrant missteps that the government has taken with security make the headlines and permit us bloggers to kick back laugh at yet another example of governmental ineptitude.
Whether to mollify critics or to frustrate bloggers some in public service have actually gotten it right.
As reported by Computerworld the SANS Institute released a list of the more successful security efforts within the federal government.
The successful initiatives in the SANS list were selected based on actual evidence of having made substantial and measurable improvements in one or more of three areas. Those three areas are the ability to prevent cyber attacks against critical infrastructure targets, reducing national vulnerability to cyber attacks, and minimizing damage and recovery time from attacks that do occur.
The Federal Desktop Core Configuration (FDCC) initiative
The FDCC effort helps government agencies reduce procurement costs and bolster security of their desktop environments by requiring agencies to implement standard baseline security configurations on all their Windows XP and Vista desktops.
This program seems to save the taxpayers money; I like it.
The US-CERT Einstein program
The Einstein Program is an initiative to improve cybersecurity-related situational awareness across the civilian federal government.
This initiative promotes cross agency data sharing and is in keeping with the spirit of the 9/11 Commission. Kudos.
The National SCADA Test Bed and Control Systems Security Program
This effort was spurred largely by post-9/11 fears of cyberattacks against the nation's power utility infrastructure. This is the one that is perhaps scariest of all because it impacts the average person so immediately and seems particularly vulnerable to attack.
The Supervisory Control and Data Acquisition (SCADA) testbed program is designed to help identify vulnerabilities in the control systems that manage power plants, electric distribution systems, oil and gas pipelines, water systems, transportation systems, and dams. Vulnerabilities, when found, are reported to the vendors for remedial action, and become part of the required procurement checklist for future purchases. Cf. Computerworld.
I'd like to see this instituted on my block because my local power can not supply power on an annual basis without losing power all too often.
The Department of Defense's Common Access Card (CAC) program
The two-factor authentication supported by the DoD's common-access smart card identity credentials has greatly strengthened access controls to non-classified defense systems.
Well, that's it. I'd like to see more but at least there is progress and that is hwat we will be getting for now.
Posts
