Is the job of looking after security too big for government CIOs to handle?

Sven Radavics recently agreed to help a friend of his install some new security software on a local government system. Radavics will not say which department because if he did it would seriously compromise their security. He says he has good reason for thinking that.

"I had to get the password for one of their systems," Radavics says, "so that I could install the software. I did my work and as I was walking out the door I said: 'Guys, make sure you change the password, I don't want to leave the premises knowing the password', and they turned to me and said: 'Well, we can't, it's hard-coded into our software applications.' That sort of thing is rife in smaller government departments. It's shocking and I would come across that sort of thing on a weekly basis."

Radavics knows a lot about network security. He is WatchGuard Technologies' Sales Director for Australia and NZ and has a deep technical knowledge of the security issues surrounding government, both at federal and state level. Radavics warns it is only a matter of time before an Australian government department's system is severely attacked by malicious hackers, organized criminals after personal information or even by cyberterrorists intent on bringing the system down and wreaking havoc across the government network.

Radavics is not alone in being concerned about government's action - or in some cases what he and colleagues see as inaction - on security issues.

"There's no doubt that it's politically correct to have security as a major issue," says Gartner research director Steve Bittinger. "If you went and talked to the average CEO and asked: 'What is your number one concern?', obviously there are issues around growth and downturn, but security is always going to show up there - they know that it's important. The big question is what are they really doing about it?"

Bittinger says security is increasingly a large and sometimes dangerous beast and so it needs careful handling, the sort of handling that your typical government CIO is not always capable of. "Every new technology brings new security risks along with it.

"There are some good arguments that suggest that the pace of technological change in the world today is increasing at an exponential rate. Technology is zooming along faster and faster and the reason that's happening is we use technology to invent new technology and the newer technology can invent even newer technology even faster and the problem is, each of those new technologies has security risks associated with them, every single one of them," Bittinger says.

Heading for the Trees

Bittinger says that where security is concerned, your average government CIO tends, as he puts it, to look at the trees rather than seeing the forest. "What I mean by that is they fit one piece or another piece of security hardware to try and contain specific problems, like, say, spam, but they are not always seeing the big picture and protecting their entire network and that's when problems loom.

"Security is a problem that is getting worse and worse and it shows every sign of getting worse and worse for ever. How do we deal with the complexity brought on by these exponential changes in technology? Well, we are starting to see an emergence of interest in security architecture. It's not just, well, we'll fit this security firewall or this patch, security architecture is at a much higher level; this is where we get into identity and access management, and it's not just inside our organization it's across the value chain and that's when you need to start looking at someone to handle this, aside from the CIO."

Radavics agrees. "We have to hammer home the point that security is not a product, it's a process, and it all begins and ends with the security policy. What CIOs are having to do is sell that policy and that means they're increasingly talking business or government, not technology, because the policy needs buy-in at the top; there needs to be commitment to enforcing the security policy right throughout the organization. Some CIOs are better at this than others, but not enough time has been spent on teaching CIOs how to sell this process to the hierarchy. They need to really be a manager rather than a technocrat."

Radavics says that when it comes to security it is increasingly the chief security officer (CSO) or the chief information security officer (CISO) within an organization who really runs the security show, precisely because the CIO is not fully equipped to understand all of the issues, especially when they relate to business as opposed to technology.

"The CSO in government increasingly has the portfolio of physical security, risk management and IT security under one umbrella," Radavics says. "I think that's a good move. I think we need to take security management out of the hands of the technologists."

This is a view echoed by Scott Ferguson, managing director of security specialists Check Point, who believes one of the problems is that the nature of the threat has changed. "Yes, security used to be a technology issue and the primary focus was on securing the network to ensure only authorized users could access resources and protect the environment against denial of service attacks, which could lead to a reduction in available services. CIOs were comfortable enough dealing with that. But it all changed when we saw the first attack of SQL Slammer in December 2002. The threat moved from just the network layer to the protocol, the operating system and the application.

"So the major change in landscape at a very high level is that the business of IT security has moved from being a technology one, to one that encompasses, yes, technology, but more the operational management of a company and one which requires some cultural change within the organization to address."

In common with his colleagues, Ferguson does not think that all government CIOs are up to the task of handling today's security threats, and when it comes to government he believes that could have very serious repercussions indeed.