Securing Off-The-Shelf IT

Interview with former Air Force and Energy CIO John Gilligan on core configuration. While Air Force chief information officer, John Gilligan initiated the process that led to the highly praised Federal Desktop Core Configuration, in which personal computers purchased by the government must be preconfigured to included specified security controls. In the first of a two-part interview with GovInfoSecurity.com managing editor Eric Chabrow, Gilligan explains the importance of core configuration, and the challenges the government faces in expanding the program to other types of information and communication technologies. A primary barrier, Gilligan says, is overcoming the culture of each agency deciding how it deems best to procure and secure its IT. "The term personal computer is just more than a description of a particular brand of machine, but it is really how people think of it. It is my computer, it's my organization, and no one outside will tell me how to operate," Gilligan says. Gilligan also served as CIO at the Energy Department, and now heads his own consulting firm, the Gilligan Group. But he remains a big influence on government IT. He led a consortium of federal agencies and private organizations in developing the Consensus Audit Guidelines that define the most critical security controls to protect federal IT systems and coauthored the influential Commission on Cybersecurity for the 44th Presidency report from the Center for Strategic and International Studies, a Washington think tank, that's helping shape federal cybersecurity policy.