Case Study: Department of Justice

Charged with improving security operations at an agency with literally hundreds of systems, DoJ CIO and acting senior IT security official Vance Hitch realized right away that he would have to pick his battles carefully.

“I had to develop a plan that would give me the most bang for my buck. That meant setting priorities,” he explains. “At certain times, I am willing to acknowledge that there may be a risk, but that risk is not high enough. For instance, if I identify 10 problems and isolate each one, I may well find that by fixing five of them, I can cover 95 percent of what I set out to do.”

One of Hitch’s first moves was to encourage each of the agency’s many organizations to incorporate more external certification and accreditation audits, and begin a course for adopting technology such as intrusion detection.

Hitch is also demanding that all agency IT procurements be primed with security provisions. “If they haven’t demonstrated security measures in the project descriptions, they will have to before I approve it,” he says.

By tying approval and funding to security, Hitch accomplishes more than oversight, since that also allows him to impose a measure of uniformity across vastly disparate DoJ systems.

One of Hitch’s more immediate goals now is to put in place a CSO equivalent to maintain the agency’s current focus on security. “I think I need a central, high-level person who is responsible to me for these issues. That will be a leader in the eyes of [DoJ’s] componentsa person who will give tough answers that agency personnel need to hear in order to devote some of their energies to this area.”