Vermont ADS CISO briefs House committee on state IT cybersecurity, cites monitoring, recent incidents

John Toney, chief information security officer for the Agency of Digital Services (ADS), told the House Energy and Digital Infrastructure Committee on May 7 that ADS now monitors hundreds of billions of IT events a year and has published the state’s first cybersecurity foundations policy to standardize protections across executive-branch agencies.

Toney said the agency “will monitor 358,800,000,000 events” and detailed other metrics, including identifying more than 52,000 phishing attempts over nine months and 16 phishing messages that reached users’ inboxes before additional protections were tuned. He also said ADS reduced known vulnerabilities across the enterprise footprint by 75.3% in the past nine months and improved mean resolution speed by 56.3% since he joined the agency.

The policy work is the core of ADS’s strategy, Toney said: “That foundation's policy enables me and my team to roll out configuration management standards … so we have consistency. We have accountability across ADS and across all of our vendors, suppliers, and partners.” He said ADS signed an initial configuration management policy on April 28 and will…