Federal agencies need to implement the strongest cybersecurity tools available but with so many competing mission priorities, departments rarely have enough funding to secure their systems. To make sure no agency is breached for lack of funding, the president’s 2017 budget proposal includes a $3.1 billion revolving fund to secure the most high-risk networks.
The IT Modernization Fund will work much like an energy savings loan, enabling agencies to upgrade their legacy systems — and security — now and repay the balance with the money saved by not having to maintain aging infrastructure. As the fund replenishes, more loans are issued.
The fund will be administered by the General Services Administration, which will rank prospective projects on several factors.
“We’re going to prioritize applications and federal agencies that have high cybersecurity challenges,” Federal CIO Tony Scott told reporters on Feb. 8, offering a preview of the cybersecurity initiatives in the budget proposal. “We’re going to look for applications that can utilize shared services, the cloud and other more modern architectures and we’re also going to focus on those applications that are high-cost to operate.”
Programs that receive funding will get it in incremental payments to “encourage incremental development.” Adhering to an incremental process will help agencies get simple tasks off the ground quickly and limit the fund’s exposure to massive projects with high failure rates.
“We have a broad surface area of old, outdated technology that’s hard to secure and expensive to operate,” Scott said. “And, on top of all that, the skillsets needed to maintain those systems are disappearing rather rapidly.”
The fund is part of a host of cybersecurity initiatives included in President Barack Obama’s budget proposal collectively being called the Cybersecurity National Action Plan (CNAP). Along with the 2017 budget priorities, CNAP includes creation of a Commission on Enhancing National Cybersecurity, a bi-partisan think tank tasked with creating a plan of action to secure the public and private sectors for the next 10 years.
To make sure the private sector and government are staffed up to act on that plan, the administration included $62 million in the budget to promote the development of cybersecurity curriculums from grade schools to colleges.
The government plans to attract some of that talent later by offering student loan forgiveness to cybersecurity professionals who join the federal workforce.
Those who join the workforce next year might be added to one of the 48 “civilian cyber defense teams” at the Department of Homeland Security. The teams will take an active approach to cyber defense, “conducting penetration testing and proactively hunting for intruders,” according to a White House fact sheet.
The budget also includes funding to deploy DHS’s Continuous Diagnostics and Mitigation (CDM) and Einstein programs at all civilian agencies.
Overall, the budget includes some $19 billion in funding for cybersecurity programs, an increase of 35 percent over 2016 funding.
These initiatives will be shepherded by the new Federal CISO, which the administration plans to appoint within the next three months.
The IT Modernization Fund and other cybersecurity proposals still need to make it through the congressional budget cycle but federal IT leaders said they think the initiatives will survive.
“Cyber, thus far, has not been a partisan issues,” Scott said. “Certainly the people who attack us aren’t partisan and defending against cyber threats is not a partisan issue. We expect there will be broad support for these initiatives.”
