For decades, the federal government has been hamstrung in its efforts to adopt new IT systems. It’s mainly due to the glacial pace of RMF accreditation and the manual processes required to secure any system connected to the outside world from security risks and inherent vulnerabilities. Streamlining this process, however, could dramatically reshape government operations and allow for shorter-duration projects that advance the cause of government IT modernization much more quickly—including moves to the cloud.
With government IT modernization initiatives stimulating new legislation and increasing funding opportunities, it’s even more critical to address a significant and continuous drag on the system: The painstaking process of securing the system to the specifications of the Defense Information Systems Agency (DISA), a support agency for the Department of Defense (DoD)
As part of this process, systems must be hardened to standard Security Technical Implementation Guide (STIG) benchmarks. The STIGs provide configuration specifications for operating systems, database management systems, web servers, and weapon systems used by government agencies.
The problem is STIGs are long and detailed. Often containing hundreds of pages, adhering to or upgrading software or systems to a particular STIG has been a highly specialized manual process that can take many months to accomplish. In addition to the significant time involved, it requires well-trained engineers that are skilled in the technical system, operating system policies, and security guidance.
This task increases implementation costs and can add years before an Authorization to Operate (ATO) is issued. The task is so tedious and painstaking, and there’s such a shortage of STIG experts, that it often prevents agencies from pursuing modernization projects.
“With modernization, the government is spending a lot of money upfront, but they don’t get any benefit until someone can actually use the new technology in production,” says Brian Hajost, president of SteelCloud and an expert in automated STIG compliance. “One of the things that must get done is the system must be ‘hardened’ and it has to be accredited through the RMF process before an ATO is possible.”
Modernizing with the Cloud
IT modernization projects for government agencies comes in many forms. Information may be consolidated into a single, shared data center or new applications moved to a different infrastructure. Increasingly, due to the government’s Cloud Smart program as well as security guidelines outlined by FedRAMP, modernization projects involve moving to the commercial cloud. Among the advantages for government is moving to a more agile and accessible system that can be accessed anywhere and doesn’t require complex on-premise networks.
According to Hajost, however, the difference between deploying an application in the cloud and a traditional data center is insignificant, at least as it relates to security hardening.
“Moving to the cloud is supposed to be relatively quick and easy, but addressing system security in the cloud is no faster or easier than it is for an on-premise environment,” explains Hajost. “In our world, it isn’t much different than if an application moved from one data center to another, or the application is moved from a data center to the Cloud.”
Hajost says that even considering the slow pace of IT, most still underestimate the expertise and time required, particularly when moving to the cloud. A shortage of trained personnel impacts the ability to modernize, a shortage that’s even more acute in classified environments.
“In a classified environment, you need to hire someone with five years of information assurance (IA) that has a TS/SCI security clearance,” says Hajost. “If you put out an ad, you wouldn’t get one person applying for that job in six months. There just aren’t many around.”
Instead, settle for staff that are multitasking from other disciplines and specialties that have little to no STIG experience.
“Even with competent, trained people, [manually handling the STIGs] is a slow process,” says Hajost. “If you use people that know nothing about the STIGs, it goes really, really slowly.”
Fortunately, new automated software tools are eliminating months from the RMF accreditation process by virtually eradicating the time of the initial hardening effort while also providing the required documentation for RMF accreditation.
“With a software tool that can automate the process, you can take someone that is competent in some other aspect of IT and re-skill them to handle the STIGs in a few weeks and shave months off your project time,” explains Hajost.
The Latest STIG Tools
Fortunately, new STIG automation tools can quickly identify any conflicts that an application will run into in a hardened environment.
Products such as ConfigOS from SteelCloud identify and harden all controls considered a potential security risk. As outlined in the STIGs, risks are categorized into three levels (1/2/3), with Category 1 being the most severe and having the highest priority.
The software then produces a domain-independent comprehensive policy “signature,” including user-defined documentation and STIG policy waivers. In this step alone, weeks or months of manual work can be completed in an hour.
The signature and documentation are included in a secure, encrypted signature that’s used to scan endpoints (laptops, desktops, physical/cloud servers) without being installed on any of them. The time it takes to remediate hundreds of STIG controls on each endpoint is typically under 90 seconds and ConfigOS executes multiple remediations at a time.
The encrypted signature can then be transported across large and small networks, classified environments, labs, disconnected networks, and tactical environments with connected and disconnected endpoints. No other changes are required to the network and security, and no software is installed on any endpoints.
To date, ConfigOS has been licensed by just about every branch of the DoD, as well as parts of DHS, HHS, and Department of Energy. The product is also used by large defense contractors and in programs for all branches of the military.
In addition to resolving issues more quickly and at less cost, the software provides the required documentation for RMF accreditation. This can eliminate months from what is typically a 6- to 12-month process.
The STIGs are updated and evolve as well. With a new update every 90 days, automated STIG remediation software accommodates for changes in the requirements. Two business days after DISA publishes a new version of the STIGs, new production signatures are tested and made available to customers.
“New security updates are introduced periodically to account for newly discovered vulnerabilities as well as changes and updates to by the vendors supplying the major operating environment components,” explains Hajost.
According to Hajost, removing this significant impediment to project completion has a greater benefit than just allowing for modernization.
“The greater benefit is the capacity to modernize is greatly expanded,” explains Hajost. “Modernization shouldn’t be once every 10 years—it should be a continual process. So, if automating security compliance allows you to move faster, you might be able to move more than a few systems to the cloud in the next year, maybe it can be seven or eight.
“Once you can modernize more, then you get to reap the benefits, which includes greater agility, more consolidated information, better access to information—with better security overall,” adds Hajost.
For more information about SteelCloud’s ConfigOS, visit www.steelcloud.com.