Effective cybersecurity is more than just the sum of its parts. Any complex organization is best protected by a system of interconnected security controls, including visibility and monitoring at every level. This is true for government agencies, corporations, and large entities of all types.
The Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) was established in November 2018 with this ethos at the core of its mission: to protect America’s infrastructure through “effective coordination and collaboration among a broad spectrum of government and private sector organizations.” Key to this mission is a robust cybersecurity posture incorporating not only DHS, but the entire federal civilian government.
To that end, CISA’s Continuous Diagnostics and Mitigation (CDM) program was created to significantly improve the security posture of .gov networks with cutting-edge cyber tools and capabilities. The CDM Dashboard Ecosystem is a key program asset, which provides federal agencies with insight into the security postures of their networks, empowering technical managers to prioritize and mitigate cyber risks.
Building the system
As the prime contractor overseeing the CDM Dashboard program, ECS is working to realize CISA’s goal of a just such a cybersecurity system. The CDM Dashboard Ecosystem is an extensible platform that provides real-time cyber situational awareness to all federal civilian agencies—from individual assets all the way up to the organization, itself—while summarizing government-wide risk exposure at the federal level for DHS.
The first step towards achieving this situational awareness is the creating the ability to monitor all assets across an agency. As Joanna Dempsey, Program Manager of the CDM Dashboard Ecosystem said, “Right now, we’re focused on asset management—aggregating and visualizing data on all devices, including vulnerability, software, and configuration status. When you put these together, you have a pretty complete picture of the security state of any particular asset.” Leveraging CDM data, DHS personnel use an algorithm to score individual assets and aggregate that score up to an organizational level. By introducing criticality—the ability to designate high-value assets and systems—and threat vectors into the CDM equation, ECS will further empower decision makers at DHS and across the federal civilian government with better, more reliable data.
Designing the Future
Of the 23 federal civilian agencies, only 20 percent have an internal system like the CDM Dashboard within their organization. The innovative aspect of CDM is its broadscale approach—delivering these capabilities to all civilian agencies, not just those that have prioritized cybersecurity awareness in the past. Introducing a government-wide system also allows DHS to share data with individual agency dashboards, enabling cyber officials across the government to benefit from CISA’s insight into threats and vulnerabilities. As the program matures, the capabilities of the CDM Dashboard will continue to evolve and ultimately surpass the systems currently used by some agencies. Through the use of machine learning, the CDM Dashboard will ultimately move from risk analysis to risk prediction, providing these agencies with greater degrees of cybersecurity protection.
ECS facilitates this evolution by prioritizing and facilitating collaboration between the CDM Dashboard Ecosystem’s many partners and stakeholders, including DHS and other agencies, as well as integrators and engineers from the private sector. Because CDM serves such a broad range of government agencies, it is all the more critical that the program’s design and production embrace a strong spirit of collaboration and cooperation, which ECS achieves by translating stakeholder needs into actionable goals and tangible components of the CDM platform.
The CDM Dashboard Ecosystem contract is delivered on the GSA Alliant 2 Governmentwide Acquisition Contract (GWAC). Find out more about our cybersecurity solutions offered through the ECS Cyber Center of Excellence.