RESEARCH

Survey: Security andFederal Government
A Survey of IT Security Stakeholders Across the Public and Private Sector
FALL 2021

FOUNDATIONAL CONTROLS FORSECURITY, COMPLIANCE & IT OPERATIONS

Research Goal
The primary research goal was to examine recent actions taken by thefederal government to improve cybersecurity.

Methodology
Independent sources of IT security professionals were invited to participate
in an online survey. A variety of questions were asked on topics related tooverall security as well as topics specific to federal government . Responses
were captured between September 20 and 27, 2021.

Participants
A total of 306 qualified individuals completed the survey including 103 thatworked for a United States federal government agency. All lived in theUnited States and had responsibility for IT security at an organization withmore than 1,000 employees.

2

COMPANIES REPRESENTEDCompany Size

Job Level

33%

24%

36%

67%

40%

1,000–5,000 employees

Executive

More than 5,000 employees

Team Manager
Individual Contributor

Industry
Federal Government							Manufacturing		
Energy

34%

11%

3%

Pharmaceutical

1%

Food & Agriculture1%

Oil & Gas

1%

Technology		

“Critical Infrastructure”

11%			

Financial Services & Insurance 		10%

Education		 8%State & Local Government

6%Services

5%

Retail3%

Telecommunications

2%

Healthcare2%

Non-profit

1%

Other

2%

05“Other”

1015203253035HALF OF NON-GOVERNMENTAL ORGANIZATIONS HAVE NOT FULLY ADOPTED NIST STANDARDSDoes your organization follow NIST standards for cybersecurity?
All Non-Federal

25%

Critical Infrastructure

21%

Other

26%
024%
25%

20

12% 4% 3%

31%
46%

24%

26%

4060

4% 4%
15% 6% 3%80100Somewhat – We follow them as a best practiceand pick and choose the parts that work for us

Yes – We are required toYes – We have chosen to strictly follow theguidelines, although it is not required
Somewhat – We follow the guidelines
closely, but have not fully adopted

No – We don’t follow NIST at all
What is NIST?

ALL FIND AT LEAST SOME VALUE IN NIST GUIDELINES, REGARDLESS OF LEVEL OF ADOPTION
What is your personal opinion of the value of the NIST guidelines for cybersecurity outcomes?
All
5%
25%
29%

Extremely valuable

A little value

Very valuableNot valuable at all (0% in all categories)

Somewhat valuable
41%

Federal Government

Critical Infrastructure

Other

5%5% 9%

5%

29%

32%

26%

24%

39%
48%

45%

33%

4

95% BELIEVE THAT THE GOVERNMENT SHOULD PLAY A BIGGER
ROLE IN SECURING NON-GOVERNMENTAL ORGANIZATIONS
In your opinion, what additional efforts should the federal government take in ensuring the securityof data and systems of non-governmental organizations? Choose all that apply.
Improve and strengthen NIST standards				

Enforce NIST standards outside the federal government				

39%Introduce new legislation with enforcement and oversight ofsecurity standards				38%

Be more aggressive in use of diplomatic tools to discourage
foreign hackers			

Regulate cryptocurrencies to create barriers to ransomware			Give more support to victims of ransomware			

Other (please specify)

43%

36%
34%
28%

2%

The federal government should not take any role incybersecurity outside their own agencies

5%

010

203040

Other: Most frequent replies: Make NIST easier to understand; Hold50

technology vendors accountable

CRITICAL INFRASTRUCTURE IS SEEKING IMPROVEMENT AND ENFORCEMENT OFSECURITY STANDARDS, INCLUDING NIST GUIDELINES, FROM THE FED
In your opinion, what additional efforts should the federal government take in ensuring the security ofdata and systems of non-governmental organizations? Choose all that apply.		
30%								Improve and strengthen NIST standards

52%
50%

Enforce NIST standards outside the federal government									Introduce new legislation with enforcement and oversight ofsecurity standards								Be more aggressive in use of diplomatic tools to discourage
foreign hackers

17%			 35%				

Regulate cryptocurrencies to create barriers to ransomware

22%			 35%			

Give more support to victims of ransomware				

17%

36%

41%
40%

31%

30%

41%
43%

50%

Federal Government
43%

Critical Infrastructure
Other35%

4%
4%
6%

The federal government should not take any role incybersecurity outside their own agencies
01052030

40506099% OF FEDERAL SECURITY PROS THINK THE GOVERNMENT SHOULD DO MORE TO PROTECTTHEIR OWN DATA & SYSTEMS, INCLUDING BETTER ENFORCEMENT OF NIST STANDARDSIn your opinion, what additional efforts should the federal government take in ensuring the security ofgovernment data and systems? Choose all that apply.
Introduce new legislation with enforcement and 						38%oversight of security standards
Better enforcement of NIST standards 				Regulate cryptocurrencies to create barriers toransomware 			

36%
28%

Improve and strengthen NIST standards 				 25%18%

Give more support to victims of ransomware
Be more aggressive in use of diplomatic tools to 		discourage foreign hackers
Other (please specify)

2%

The federal government is doing enough and doesn’t
need to do more to protect their data and systems

1%

16%

0510152025303540
Other: Proper staffing; rehire the guy that actually knew what he was doing

6

FEDERAL SECURITY PROFESSIONALS BELIEVE GOVERNMENT SYSTEMS ARE MORE
SECURE THAN OTHER INDUSTRIESIn your opinion, how does the security of federal government data and systems compare to thecybersecurity efforts and outcomes of non-governmental organizations?
All

43%

Federal agencies typically do a better job with security
than non-governmental organizations

43%

There is no difference
Federal agencies typically do a worse job with security

14%
Federal Government

39%

56%

Critical Infrastructure

33%

51%

Other15%

5%

36%

45%
20%

ON THE FLIP SIDE, INDUSTRY SECURITY PROS TYPICALLY THINK THE FEDERAL GOVERNMENT
DOES A WORSE JOB WITH SECURITY
In your opinion, how does the security of federal government data and systems compare to compare
to your industry’s cybersecurity efforts and outcomes?
Non-Federal

Critical Infrastructure
18%

28%
46%

Other

32%
45%

50%
33%

25%

23%
Federal agencies typically do a better job with security
than the industry I work in
There is no difference
Federal agencies typically do a worse job with security
7NEARLY A QUARTER OF FEDERAL SECURITY PROFESSIONALS FEEL THEY ARE FALLING
BEHIND WHEN IT COMES TO PREPAREDNESS
In your opinion, how prepared is your organization to face new threats and breaches?
Choose the one answer that most closely applies.
All
12%
29%

We are falling behind
We are just barely keeping pace
We are staying ahead
59%

Federal Government
13%

Critical Infrastructure

Other
6%

6%
24%
35%

38%
56%

58%

64%

WIDE RANGE OF REASONS GIVEN FOR FALLING BEHIND WITH CYBERSECURITY EFFORTS
Why do you feel your organization is falling behind with cybersecurity efforts?
Leadership doesn’t prioritize cybersecurity			 42%			 42%			

We are lacking internal expertise and resources 			50%				

It’s impossible to keep up with new types of attacks

45%		

50%

Our industry hasn’t traditionally been a target 		

40%				

Other (please specify)

67%

Federal32%

All non-Federal

17%
0%
01020
30
40
50
60
70
80
Other: Over reliance on “stand alone” network security; Staffing positions not backfilled

8THE DIFFERENCE BETWEEN KEEPING PACE AND STAYING AHEAD IS LEADERSHIP AND INVESTMENT
Why do you feel your organization is keeping pace or staying ahead with yourcybersecurity efforts? Choose all that apply.
Our leadership makes it a priority 					 67%						

45%We’re invested heavily in people and 				tools to get the job done 		34%
We do the basics well

62%

45%
50%		

The cost of failure is too high to do 			anything else 		

40%

Staying ahead

32%

Keeping pace

1%
1%

Other (please specify)
01020

30

40

50

60

7080

Other: We got burned by a ransomware attack which had convincedsenior mgmt that they need to put $$$ into security; We are learning

RANSOMWARE TOPS LIST OF SECURITY CONCERNS
Which of the following types of security attacks are you most concerned about?
Choose up to two of the following.
Ransomware 					

53%Vulnerability exploits 				35%Phishing 			

34%

Social engineering 		24%Credential theft 		

23%

Web application attacks 		17%Other (please specify)

1%

I don’t have any security concerns

0%0102030

Other: DDoS; Office 365 attacks

9405060

CRITICAL INFRASTRUCTURE IS MORE CONCERNED ABOUT RANSOMWARE THAN FEDERAL AGENCIES
Which of the following types of security attacks are you most concerned about?
Choose up to two of the following.		28%Ransomware 					 83%			

60%		

Vulnerability exploits 		

33%
32%		
24%

Phishing 		

42%
38%		

Social engineering

13%

Credential theft

25%

4%
0

Federal Government

27%

21%
19%

Web application attacks

40%

29%

Critical Infrastructure
Other

28%
15%
2040

60

80

100

NON-FEDERAL ORGANIZATIONS TOOK GREATER ACTION IN LIGHT OF RECENT ATTACKS
Has your organization made any changes to your cybersecurity efforts as a result of recent attacks on
critical infrastructure? Choose the one answer that most closely applies.
All
13%

2%
2%

Yes, we’ve already taken specific actions
We put plans in place, but haven’t
made the changes yet
We talked a lot, but didn’t do anything

49%

It wasn’t important enough for us totalk about doing something
What recent attacks on
critical infrastructure?

35%

Federal Government

Critical Infrastructure

Other

2%

2%

2%
3%

16%

14%
40%

46%

52%

43%

26%
55%

10

98% OF FED AGENCIES HAVE MADE AT LEAST SOME PROGRESS ON EXECUTIVE ORDERS ONCYBERSECURITY, NEARLY HALF NOTE SIGNIFICANT PROGRESSHas your agency made progress in meeting the requirements of the executive order on cybersecurity?
2%Yes, significant progress
Yes, some progress

49%

No

50%

FEDERAL SECURITY PROS DISAGREE WITH OTHER INDUSTRIES ON
GOVERNMENT RANSOMWARE EFFORTS
In your opinion, is the federal government doing enough to prevent ransomware attacks?
All

44%
56%

Yes
No

Federal Government

Critical Infrastructure

19%

Other
20%

29%
81%

71%

80%

11ALL INDUSTRIES IN AGREEMENT THAT ZERO TRUST WILL IMPROVE SECURITY OUTCOMES
In your opinion, how likely is it that Zero Trust Architecture (ZTA) will materially improve cybersecurity outcomes?
All
2%2%Highly likely
22%

22%

Somewhat likely
Possible, but not likely
Not at all likely
What is Zero Trust Architecture?

53%
Federal Government
4%1%
22%

19%

53%

Critical Infrastructure
19%

21%

60%

12Other

22%

1%
3%

51%

23%

ALMOST ALL BELIEVE INTEGRITY MONITORING IS IMPORTANT TO ZERO TRUSTIn your experience, how important is integrity monitoring to a successful Zero Trust (ZT) strategy?
All
4% 2%

Foundational – ZT can’t be done without integrity monitoring
Somewhat important – It is not required, but is beneficial
Not important - ZT doesn’t require integrity monitoring

50%

43%

What is integrity monitoring?

Federal Government

Critical Infrastructure

Other
5% 4%

6%
42%
52%

50%

50%

35%

56%

THOSE FAMILIAR WITH ZERO TRUST MOST COMMONLY IDENTIFIED SECURE
COMMUNICATION AND LIMITING INDIVIDUAL ACCESS AS CORE TENETS
Which of the following do you consider to be core tenets of Zero Trust? Choose all that apply.		

All of these are core tenets

22%

All communication is secured regardless of network location 				

44%Access to individual enterprise resources is granted on a per-session basis 			39%

All data sources and computing services are considered resources 				Access to resources is determined by dynamic policy that includes a minimum of the observable 			state of client identity, application/service, and the requesting asset
All resource authentication and authorization are dynamic and strictly enforced before access is 			allowed
The enterprise monitors and measures the integrity and security posture of all owned andassociated assets 		
The enterprise collects as much information as possible about the current state of the assets,
11%
network infrastructure and communications, and uses it to improve its security posture
None of these are core tenets

33%
30%
22%

0%

01336%

1020304050

FEDERAL GOVERNMENT GUIDELINES THE TOP SOURCE OF ZERO TRUST INFORMATION
When you look for guidelines, best practices, or other information on Zero Trust Architecture
strategies, what sources do you use? Choose all that apply.
Federal government guidelines (i.e., NIST, DISA, CISA)
Security solution vendor information					53%									 51%

Security consultants				

49%

Industry analysts (i.e., Gartner, Forrester)				

49%

Online communities
Coworkers or other personal contacts			

34%

1			30%

Other (please specify)

1%

I don’t look for information on Zero Trust Architecture

1%01020304050
Other: Industry associations; My own opinions on security

60

FEDERAL GOVERNMENT REPORTS SLIGHTLY BETTER PROGRESS TOWARD ZERO TRUST ADOPTION
How would you describe your company’s progress towards Zero Trust adoption?
Choose the one answer that most closely applies.
All
9%

5%

13%

Mature and fully implementedWell developed, but with work to do50%
In process

7%32%

Awaiting further government guidance
In planning35%

We haven’t even started

Federal Government

Critical Infrastructure

Other

3%
12% 2%

13%4%2%

7% 8%

25%

27%

12%
6%

34%

26%
31%

34%

54%

14

83% EXPECT SOMETHING WORSE THAN RANSOMWARE IS GOING TO HIT THE SECURITY WORLD
Please indicate your agreement with each of the following statements.
3%

3%
26%

20%

51%
Our security discussions are
dominated by concerns about
ransomware

6%

14%

23%

37%

46%

23%

48%

Ransomware was bad, but I
completely expect somethingworse is coming

The NIST guidelines are one of themost effective federal government
tools for combating ransomware

Strongly agree

Disagree somewhat

Agree somewhat

Strongly disagree

15Tripwire is the trusted leader for establishing a strong cybersecurity foundation. We protect the world’s
leading organizations against the most damaging cyberattacks, keeping pace with rapidly changing techcomplexities to defend against ever-evolving threats for more than 20 years. On-site and in the cloud, ourdiverse portfolio of solutions find, monitor and mitigate risks to organizations’ digital infrastructure—allwithout disrupting day-to-day operations or productivity. Think of us as the invisible line that keeps
systems safe. Learn more at tripwire.comThe State of Security: News, trends and insights at tripwire.com/blog
Connect with us on LinkedIn, Twitter and Facebook©2021 Tripwire, Inc. Tripwire, Log Center/LogCenter, IP360, Tripwire Axon and others are trademarks or registered trademarks of Tripwire, Inc. All other product and company
names are property of their respective owners. All rights reserved.
BRDRSFGb
21Q3