2014 Digital Yearbook of Homeland Security Awards

and legacy systems are retired, saving both time and money.
Some production clients manage over 1 million assets
and have over 10,000 daily users. Benefits are incident
reduction, 5 – 10x faster time-to-remediation, less audit
failures, and 2 – 3x operational efficiency gains.
Please describe a major federal agency
using the Agiliance RiskVision approach.
JF: The U.S. Department of Veterans Affairs (VA) is one
such example. They were experiencing major operational
efficiency issues stemming from their Assessment and
Authorization (A&A) procedures. Per FISMA law, every
online system must maintain an Authority to Operate
(ATO) certification, and FISMA subjects must renew their
ATOs for every major
system change. For the
agency, this meant manual
gathering and assessing
millions of check results
generated by third-party
security monitoring tools.
The problem with this approach
was the vast amounts of data it produced and great
difficulty understanding the real meaning of the collected
data and correlating it to the agency’s compliance posture.
And by time the data was processed and analyzed, it
was no longer actionable. All the time and money spent
collecting it, was wasted. As a result, completing each
ATO was a labor- and time-intense process, inhibiting the
agency’s ability to meet their audit deadlines.
The agency implemented RiskVision to collect data
from their IT and security tools and perform real-time
diagnostics and mitigation using NIST SP 800-137 and the
NIST IR 7756 (CEASARS) risk frameworks. The VA project
is the largest cyber security risk project in the world, conducting
daily control checks for 1+ million systems for
more than 130 technical controls at the VA centers in DC
and Austin, Texas; providing access to 4,000 workflow and
reporting users, as well as 400,000 policy attestation users.
9
Now the VA can cross-verify controls between federal regulatory
risk management frameworks such as FISMA, NIST
SP 800-53, and CyberScope. After deploying RiskVision, the
agency achieved significant cost and time saving. Rather
than collecting each bit of data generated by more than 1
million data collection points, the IT personnel now gathers
and stores highly relevant information and attends to
high-risk issues in a timely manner.
How does Agiliance see the future of Cyber
Security Operational Risk?
JF: Notwithstanding better analytics and decision-making
from use of big data technologies, cloud-managed services
is the new way to informed risk management. In
2014 alone, our clouddelivered
clients grew
over 600 percent versus
2013, led by customers in
the Financial Services and
Healthcare industries.
One of our Financial Services
customers is already
managing 200,000 critical assets with an end-to-end threat,
vulnerability, and ticketing solution delivered on the
RiskVision platform and several connected technologies,
all in the cloud. We’ve developed RiskVision’s managed
services to be cloud security hardened and ready for cloud
risk programs that are deploying in the DoD, IC, and civilian
agencies. With pioneering efforts of CSA, FedRAMP,
NIST, and others on cloud security, and the need to stand
up solutions with operational efficiency, over 70% of cyber
security operation risk management will be centered in
the cloud by 2018.
I can be reached by Twitter: @joe_fantuzzi and
by email: jfantuzzi@agiliance.com
On behalf of Agiliance and our customers, thank
you for an opportunity to share our perspectives with
your readers.