A sampling of many of the most important private-sector players supplying technology and services through the Continuous Diagnostics and Mitigation (CDM) Program reveals optimism about the pace of Federal agency implementation of the program.
Industry comments also show readiness to meet demand for more advanced CDM capabilities, and certainty that persistent security threats will drive agency deployment rates higher in the near term.
Across the responses of nine industry players – Tenable, Zscaler, Splunk, Forcepoint, Forescout, Broadcom, ManTech, RedSeal, and Trustwave – to a MeriTalk inquiry about the state of the CDM Program seven years after the program’s launch, several forward-looking themes emerged:
- Agency demand for CDM products and services is strong;
- The ever-increasing cybersecurity threat continues to drive CDM deployment urgency at DHS and the agency level;
- DEFEND and RFS processes are helping to speed deployments;
- Agency migrations to cloud services are changing program dynamics, and the program needs to evolve in step with technological advancements;
- Agency progress past asset and user identification capabilities is key to the next big pay-off in program effectiveness; and
- Having the right workforce is as important as having the right security tools in place.
These and similar themes will be touchpoints for expert discussion at MeriTalk’s CDM Central
Conference on October 10, followed by MeriTalk’s Cyber Smoke Federal IT networking event.
We asked the industry players: “The CDM program has a long arc – began in 2012, and with current contracts extending out at least six years – that’s a 13-year journey at a minimum. How is the state of the market, and agency demand for the industry’s services looking at the seven-year mark?”
To which the industry responded (subject to editing for length):
Bill Rucker, President of Trustwave Government Solutions: “The state of the market and the program has never been better. The demand for capabilities to enhance cyber security posture has never been stronger. The solutions available to solve these problems have never be more accessible. Now it’s all about execution with the right partners that have proven success from the inception of the program. Many who began this journey are no longer present, I am exceptionally proud that Trustwave has been embraced by our government partners to reflect nearly 100% retention and 1,000%+ expansion.”
Seana McMoil, Senior Executive Director & Branch Manager, National Cybersecurity Programs, at ManTech: “The agencies are at various maturity levels in terms of their CDM capabilities. Ideally, everyone wants to expand their security capabilities at a rapid pace, but practically, we know that agencies are juggling several priorities at the same time. ManTech’s approach is to equip our customers with a strong CDM foundation that will adapt to the dynamic and evolving threat landscape over time. We focus on how our clients are executing their mission, and how they can leverage the CDM program to enhance and better secure that execution. The key thing is that it’s not just about deploying tools, it’s the people and the process that determine success and ensure that agencies get the maximum use out of those tools and capabilities.”
Stephen Kovac, Vice President of Global Government and Compliance at Zscaler: “This is such a transitional time with the mega-shift to cloud-based solutions. CDM’s approach will need to change to meet the realities of a Cloud Smart government and the needs of federal agencies’ now willing to move quickly to the cloud.”
Chris Jensen, Public Sector Business Development Manager at Tenable: “The CDM program is on a strong and consistent upward trajectory. The early focus on Phase 1 tools and sensors was a great way to get those capabilities disbursed, but the deployment and integration of those tools into an effective security environment was a longer-term undertaking that could not be completed in the lifespan of the original BPA-based task orders. In addition, the initial program focus was more on compliance than security. While this was a necessary ‘walk before you run’ process, the recent shift in program focus from compliance to risk-based security is an important step for the program. The past year has been a watershed period for CDM, as the DEFEND task orders and the new APL and GSA CDM SIN processes have been put into practice. The increased flexibility and responsiveness of DEFEND and its RFS process have put the agencies squarely in charge of their CDM implementations, and have laid a foundation for long-term program success.”
Eric Trexler, Vice President, Global Governments and Critical Infrastructure, at Forcepoint: “A 2018 Forcepoint survey on the state of CDM found many fundamental challenges were slowing agencies’ progress in meeting CDM goals and these still hold true today despite the CDM Programs best efforts. While progress is happening; Group F agencies are entering the program and funding requests for CDM continue to rise, many agencies are moving forward too slowly with methodical planning of next steps for their agency. Adversaries are outpacing agency’s best efforts to keep up, a new security approach is required.”
Erik Floden, Director of Global Strategic Alliances at Forescout: “Federal government agencies were doing cybersecurity long before CDM came along, yet they still struggle with the basics, like identifying and assessing all of the assets connected to their network. Demand for industry cyber security tools that achieve strong cyber hygiene remains high because it is common and recurring vulnerabilities that result in the vast majority of the compromises making headlines.”
Jodi Kohut, Director of Partners and Programs at Broadcom: “The program is slowly building momentum. Agency executives are realizing the power of having funding, support, and oversight of their security posture available. This creates a shared responsibility for implementing and monitoring critical security controls. We’ve especially seen agencies adopt solutions for identity management, privileged user management, and securing API communications. They have come to appreciate these tools as vital to securing our Government systems.”
Adilson Jardim, AVP of Sales Engineering, Public Sector, at Splunk: “Earlier this month, I spoke on a MeriTalk panel of CDM experts at 2019 Cybersecurity Brainstorm. During the event, I commented on how the CDM timeline is not really that long. The industry and our constituent agencies are better off adopting a perspective of permanence – CDM should continue to evolve into the delivery of security and information systems assurance for the Federal government. Considering the persistent security threats and ever increasing attack surface, our agency partners will need all the help they can take from industry. CDM happens to be a venue to absorb many security best practices – threat information sharing, incident response support, analysis, orchestration and response. These are all practices that will continue to evolve in tandem with agency resources and systems.”
Christine Carberry, Vice President-Federal Business Unit at RedSeal: “Phase 1 and Phase 2 are still in process, and there’s been a lot of accomplishments with the program. However, from where RedSeal sits, the first two phases just really were not our sweet spot. Our sweet spot now is Phase 3, with network visibility, modeling and mapping, as well as incident response and vulnerability management. We are poised beautifully for the progression to network modeling, and we fit very well into the dashboard infrastructure and workflows. And then on to cloud security, I think there are some things in there down the road with Phase 3 and Phase 4 that speak more to some of the things where RedSeal is strong.”
Next: In Part 2 of our CDM Industry Survey series set to run on MeriTalk next week, the same private-sector executives will look out to the coming seven years and predict how the CDM program – and implementation by agencies – will evolve by the time the CDM program celebrates its 14th birthday.
