The Government Model

The State Department has pioneered an approach to network security that makes it easier for managers in large organizations to identify trouble spots, prioritize them and get them fixed fast. The program's effectiveness, in fact, has made it an unexpected model for big firms looking to bolster computer security.

Responsible for protecting computer networks for 400 U.S. embassies and offices across 24 time zones, State faces a cybersecurity challenge that in many ways mirrors that of a multinational company. Its program scans computers throughout the department every three to four days to detect security vulnerabilities, compiles the data in one place and provides grades to each office. The program differs from commercially available network-monitoring programs in that it uses a market-based approach to create incentives to fix security gaps. It quantifies a range of security risks and "monetizes" them into a "common currency" that assigns the most points to the highest-priority security gaps to be fixed, says John Streufert, State's chief information-security officer and one of the program's four creators. Those points are factored into a site's grade daily, so the security officials can repair the biggest gaps first, he says.