What is federal government endpoint security? What should it prioritize?
We here at Solutions Review tend to focus on for-profit organizations and enterprises when discussing endpoint security. Granted, enterprises absolutely need this kind of cybersecurity; approximately 60% of small-to-medium-sized businesses (SMBs) go out of business within 6 months of a data breach.
Additionally, the average data breach costs close to $4 million—well beyond what most businesses can afford. In fact, even a globally recognized enterprise can suffer in the aftermath of a data breach; consumers tend to abandon or avoid businesses after the public disclosure of a cyber attack, causing long-term profit loss.
Yet we rarely discuss another frequent victim of digital threat actors: the federal government. Indeed, federal agencies face unique and increasingly dangerous cyber risks unlike those of any for-profit enterprise. Moreover, failures of federal government endpoint security can cause crises with far-reaching consequences for enterprises and consumers alike.
Why does endpoint security matter for federal agencies? What solutions and best practices can improve federal government endpoint security?
We read through the Carbon Black white paper “Improving Threat Hunting with Big Data,” which focuses on federal government endpoint security and threat hunting. Armed with its knowledge, we answer these questions and more!
Threats to Federal Government Endpoint Security
According to the Carbon Black Global Threat Report January 2019, nearly half of all incident response investigations link to nation-state actors such as Russia or China. Cyber attacks now serve as an extension of political will, almost acting as another arm of the military. As a result, nation-state based threats tend to take different forms than those of unaffiliated hackers.
Carbon Black, an endpoint security solution provider, also found 32% of nation-state caused incidents which classify as destructive attacks. Destructive attacks aim not for monetary gain but to simply destroy the network outright; these can cause major downtime and service outages for civilians on a mass scale.
Additionally, 51% of attacks on federal government endpoint security feature counter-incident response. These attacks use evasion techniques or other subversive tactics to circumvent containment and remediation efforts—creating new challenges for both.
Challenges to Federal Government Endpoint Security
While for-profit enterprises do encounter counter-incident response and destructive attacks, they tend to face those digital threats far less than federal agencies. Usually, enterprises face for-profit cyber attacks—attacks which seek financial gain.
Instead, federal agencies must typically face with cybersecurity attacks engaging in espionage. In these cases, hackers—which can include other governments as well as hacktivists and industrial spies—dwell on the network to acquire valuable secrets or communications. Given the nature of federal agency communications, your federal secrets could be worth far more than any monetary gain.
However, the federal government often has few resources to respond to hackers and external threat actors. Nation-state actors often subcontract their hacking to different groups, creating a layer of separation for plausible deniability. Even when the federal government can confirm the true culprit behind a cybersecurity incident, they can’t always respond; “hacking back” can create a cycle of digital violence which puts more users and assets at risk.
Finally, the federal government only prosecutes 5% of hackers. Instead, agencies engage in a “naming and shaming” procedure which can severely backfire.
Therefore, your cybersecurity for the federal government must emphasize prevention as much as detection and response. Deterring as many attacks as possible benefits your agency in the long term.
How to Improve Federal Government Endpoint Security
Of course, we can’t list all of the ways your federal agency could strengthen its cybersecurity. Carbon Black’s “Improving Threat Hunting with Big Data” goes into far more detail than we can.
However, we can provide a few guidelines and best practices for improving your federal government endpoint security to help get the process started.
Secure the IoT
The Internet of Things (IoT) constitutes a serious risk to digital perimeters, both to the federal government and to enterprises overall. IoT devices usually ship without any endpoint security whatsoever. Those devices possessing some kind of cybersecurity often lacks proper or consistent upgrade protocols, eventually creating more security vulnerabilities.
Frequently, hackers use IoT devices as part of their island hopping attacks and as part of other lateral movements. After all, IoT provides “dark” areas of the network to give their attacks a foothold to more easily reach their desired targets.
Your federal government endpoint security must protect IoT devices from infiltration to best strengthen their digital perimeter. Of course, deploying a next-gen endpoint security solution should help improve your endpoint visibility overall.
Deploy a Strong Security Operations Center
A Security Operations Center (SOC) leads your federal agency’s threat hunting efforts, analyzes and incorporates threat intelligence, and coordinates your incident response efforts. While all members of each federal agency must participate in the fulfillment of cybersecurity goals, your SOC should serve as the nucleus of these efforts.
To bolster your federal government endpoint security, your agency should facilitate and support their SOC to the best of their abilities. This involves acquiring as many talented and dedicated cybersecurity professionals, assigning them clear roles in the SOC, and providing access to high-level threat intelligence feeds.
Your SOC should also help design a strong incident response plan which the entire federal government agency knows and practices; ideally, this plan should also have contingency plans for counter-incident response attacks.
Improving Federal Employee Education
Your federal government endpoint security hinges, just like for-profit enterprises, on your employees. Their knowledge of cybersecurity best practices determines the effectiveness of your overall endpoint protection platform.
Indeed, digital accidents by insiders can cause as much damage as any nation-state actor. Without proper cybersecurity training, conducted regularly to maximize absorption, your employees could wreak unintentional yet catastrophic damage.
Don’t let this befall your federal agency. Use your cybersecurity professionals to conduct consistent training sessions. These don’t have to be long sessions; in fact, a thirty-minute session once every few weeks might prove enough to improve retention. However, each session should cover how to recognize potential threats and how to alert your SOC at the first signs of a cyber attack.
Further, you need to back up this training with consequences for failure and rewards for success. Employees respond more to tasks and processes with clear stakes; making federal government endpoint security a priority in employee reviews should provide sufficient motivation.
Of course, this list doesn’t dive into other necessary capabilities for federal government endpoint security such as EDR, threat hunting, and SOC design. For that information and more, we recommend downloading the full Carbon Black “Improving Threat Hunting with Big Data” white paper.
Latest posts by Ben Canner (see all)
- Endpoint Protection Capabilities You Need for the Cloud - April 18, 2019
- Endpoint Monitoring, EDR, and Endpoint Security: What Do You Need? - April 17, 2019
- Opinion: Can Your Cybersecurity Be a Competitive Advantage? - April 12, 2019