Experts: US needs a federal CISO

Last week, the Trump administration announced the appointment of a White House cybersecurity coordinator. That’s a good first step, security experts say, but the government also needs to have a federal CISO.

“It’s a big leadership vacancy,” said Sanjay Beri, CEO and co-founder at cloud security vendor Netskope.

The job of a federal CISO is very new — it was only created last year and filled in September with the appointment of retired brigadier general Gregory Touhill. He was previously the deputy assistant secretary for cybersecurity and communications at the Department of Homeland Security.

Touhill stepped down in mid-January, leaving the position vacant to this day.

Last week, President Donald Trump’s homeland security adviser, Tom Bossert, said that the administration has selected Rob Joyce, who previously headed up the National Security Agency’s office of Tailored Access Operations, to be the White House cybersecurity coordinator. There’s been no official announcement yet, however.

Neither job is particularly well-defined, but the federal CISO is a bigger, and more ambitious position.

“The federal CISO is concerned much more than the White House,” said Beri. “But with the entire federal infrastructure.”

It’s a dangerous time to leave the position unfilled, he said.

“To me, it’s an ‘Oh my God, what’s going on’ thing,” he said. “I think Trump realizes the importance of it, but it’s a question of organization.”

Appointing Joyce is a positive step, he said. “He has a great track record — he was the head of the hacking unit of the NSA. But I don’t think it replaces a federal CISO role.”

The new administration should address all aspects of security, said Danielle Jackson, CISO at authentication vendor SecureAuth.

“Appointing a CISO will ensure that the increase in risk of cyber threats to our nation is appropriately addressed, monitored and combated,” she said. “It certainly doesn’t hurt to have an extra set of experienced eyes focused on our nation whose president has frequent cyber communications — social media included — and engagement with other nations.”

There are other federal agencies that work on cybersecurity issues.

For example, both the Government Accountability Office and National Institute of Standards and Technology play key roles, said Jeff Williams, CTO and cofounder at application security vendor Contrast Security.

“The GAO has been auditing agencies using the NIST Cybersecurity Framework for several years, and the results have not been stellar,” he said. “The GAO review isn’t a deep review, just a high-level overview.”

Someone has to step up and start doing the hard work.

“A federal CISO is what’s needed to get healthy and get those grades up,” he said. “Someone has to coordinate efforts, set priorities, manage the budget, raise awareness and create a culture of cybersecurity in government. Definitely a tall order.”