Hacking to Secure Government IT Security

But several experts question whether there are a sufficient number of properly trained IT security folks who can perform these friendly hacks. "That will be one of the challenges as we move forward," says former Air Force CIO John Gilligan, who as a consultant remains active in working to secure government IT. "We are going to have to find ways to leverage the skill base, expand the skill base that we have, to be able to deal with this."

The military and intelligence communities have employed red-team testing for years, and have developed their own teams, such as those housed at the Vulnerability Analysis and Operations Group at the National Security Agency. The group recruits about two-thirds of its red team members from the military.

"Our workforce is a mix of military and civilian, all government employees; we do have some contract help in some of the infrastructure and pool development" says Tony Sager, the group's chief. "That makes us an anomaly in the DOD and the intelligence community, that we are entirely government employee and military, uniformed or civilian."

But as FISMA reform moves through Congress and President Obama builds his new White House cybersecurity team, and the demand for better ways to judge IT security safeguards, the government will need to establish stopgap approaches if it wants to begin widespread red-team testing in civilian agencies.

In the short term, Gilligan says, civilian agencies may seek advice and perhaps some manpower from the NSA, Defense Department and the few civilian departments that maintain red teams as well as retain the services of the handful of IT security contractors that offer this service. And, if contractors are employed, vet them closely, Gilligan says. "Not all of the people's qualifications are equal," he says. "I think a mix of leveraging the current capabilities we have in DOD and other federal agencies like the Department of Energy, Department of Justice and DHS, and perhaps using those organizations to help bring in and augment with some contractors, carefully selected makes perfect sense."

We have posted our separate interviews with Sager and Gilligan. You have the option of listening to the podcast recordings or read the transcripts.

The Good Hacker
Tony Sager, chief a National Security Agency group that conducts red-team assaults, explains the complexities of conducting friendly attacks on government IT systems.

From Audit Guidelines to Red Team Attacks
Retired Air Force CIO John Gilligan explains how the Consensus Audit Guidelines and red-team assaults work well together to safeguard government IT systems.

Little Known Red-Team Facts
The amount of preparation to conduct a red-team assault could boggle the mind.