Technology

Are you the weakest cybersecurity link at your agency?

Adm. Paul F. Zukunft, Commandant of the Coast Guard, released a new cyber strategy for his command. He says that the weakest link an agency faces in protecting ...

Michael O'Connell@moconnellWFED

June 16, 2015 6:05 pm

3 min read

An agency can build the strongest barriers to keep intruders out of its IT systems, but one slip by a single employee can inadvertently put the whole system at risk.

When it comes to protecting the cyber domain at his command, Adm. Paul F. Zukunft, Commandant of the Coast Guard, said that the weakest link can be the human capital resource component.

“It comes down to what I call ‘cyber hygiene,'” he said. “We see that not just with the Coast Guard, but we see that throughout every organization.”

Zukunft spoke about the Coast Guard’s newly released cyber strategy Tuesday at a presentation sponsored by the Center for Strategic & International Studies. He described a situation in which the most physically secure facility could still be infiltrated by hackers.

“Who do you have protecting your facility internally and externally against zeros and ones that may threaten to take down your facility?” he said. “It is a daily occurrence in the U.S. Coast Guard where we have an internal patch that we need to apply because somebody took a shortcut. They are smarter than the guidance that we provide them that say ‘You shall not do this.’ Folks go ahead and do that and then they compromise our entire system.”

To tackle such incidents, the Coast Guard recently stood up a 70-person cyber command to oversee its IT systems.

“It may not seem like a lot, but they can have awareness across our full operating domain cyber within the Coast Guard,” Zukunft said. “So, daily they can look at where those potential leaks are, malware that may be introduced and then go out and fix it.”

In establishing the cyber command, Zukunft told the 70 experts that they needed to specialize in this discipline into perpetuity. Rather than cycling out of the command ever two or three years, they needed to be cyber specialists.

“You really need to be specialized,” he said. “Especially in this field of work, because it changes so rapidly that you need to have folks keeping pace with the changes that take place around us.”

The Coast Guard’s cyber strategy focuses on three areas:

Defending its internal systems from attack;
Enabling Coast Guard operations within its cyber systems;
Protecting the nation’s critical infrastructure.

Good cyber hygiene across these three areas is crucial to preventing cyber intrusions.

“We need it to protect our cyber domain, we need to enable our operations and we need it to protect our critical infrastructure,” Zukunft said. “So this template, if you will, for a strategy, yes it applies, if you’re private/public sector. Unfortunately, it also applies if you’re one of our adversaries as well, who we do not want to be found in the cyber domain.”

The challenge, he said, is that no matter how diligent one is about training and screening individuals and building a secure infrastructure, there will always be single points of failure.

“You could have 99.9 percent compliance and then one individual,” Zukunft said. “Look what a Snowden did to our credibility and the level that compromised. One individual and this is malicious. So, those are the real challenges that you face. Part of that is in the screening process of who you bring into your organization. Who do you issue a CAT card to that provides them with unfettered access to our domain. So, we need to think a little bit longer and smarter about how we do that.”

U.S. Cyber Command wants DISA to take greater role in DoD cyber defense